View Full Version : Possible browser hijack
clamenza
2009-08-28, 05:55
I'm not sure, though. Thanks for your help in advance.
(referral thread http://forums.spybot.info/showthread.php?p=331448#post331448)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:53:08 PM, on 8/27/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\avgwdsvc.exe
C:\Program Files\MozyHome\mozybackup.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\PROGRA~1\AVG\avgrsx.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\KeyText\KeyText.exe
C:\Program Files\RSIGuard\RSIGuard.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Documents and Settings\Atheist\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.live.com/sphome.aspx
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.live.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.live.com/sphome.aspx
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchgateway.net/search/%s
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: FCTBPos00Pos - {28A27F58-704F-40E1-8053-28E909FBF604} - C:\Program Files\Mob Wars Toolbar\Toolbar.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\avgssie.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\hssie\HssIE.dll
O3 - Toolbar: Mob Wars Toolbar - {6857857C-15D3-435D-AF19-E0217298B416} - C:\Program Files\Mob Wars Toolbar\Toolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON\daemon.exe" -autorun
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2" -"http://www.iwon.com/modules/launchGame/games/includes/blockDotGameIFrame.jhtml?categoryId=3&gameId=9006&browser=IE"
O4 - Global Startup: Firefox.lnk = C:\Program Files\Firefox\firefox.exe
O4 - Global Startup: KeyText.lnk = C:\Program Files\KeyText\KeyText.exe
O4 - Global Startup: RSIGuard.lnk = ?
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\ZoneAlarm\zlclient.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZUfox000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-latest.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B7A3BF85-3D73-44EF-9FB0-06224C0D8D58}: NameServer = 192.168.1.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\avgwdsvc.exe
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe
O23 - Service: Hotspot Shield Routing Service (HssSrv) - AnchorFree Inc. - C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
O23 - Service: Hotspot Shield Tray Service (HssTrayService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE
O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
O23 - Service: MozyHome Backup Service (mozybackup) - Mozy, Inc. - C:\Program Files\MozyHome\mozybackup.exe
O23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - C:\Program Files\OpenVPN\bin\openvpnserv.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 7250 bytes
Hi,
Download DDS and save it to your desktop from here (http://www.techsupportforum.com/sectools/sUBs/dds) or here (http://download.bleepingcomputer.com/sUBs/dds.scr) or here (http://www.forospyware.com/sUBs/dds).
Disable any script blocker, and then double click dds.scr to run the tool.
When done, DDS will open two (2) logs:
DDS.txt
Attach.txt
Save both reports to your desktop. Post them back to your topic.
Download GMER (http://www.gmer.net) here by clicking download exe -button and then saving it your desktop:
Double-click .exe that you downloaded
Click rootkit-tab and then scan.
Don't check
Show All
box while scanning in progress!
When scanning is ready, click Copy.
This copies log to clipboard
Post log in your reply.
clamenza
2009-08-29, 23:12
DDS (Ver_09-07-30.01) - NTFSx86
Run by Atheist at 17:09:49.40 on Sat 08/29/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2037.1477 [GMT -4:00]
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\MozyHome\mozybackup.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\KeyText\KeyText.exe
C:\Program Files\RSIGuard\RSIGuard.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\PROGRA~1\AVG\avgwdsvc.exe
C:\PROGRA~1\AVG\avgrsx.exe
C:\Documents and Settings\Atheist\Desktop\dds.scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://my.yahoo.com/
uSearch Page = hxxp://search.live.com
uSearch Bar = hxxp://search.live.com/sphome.aspx
uSearchURL,(Default) = hxxp://www.searchgateway.net/search/%s
mSearchAssistant = hxxp://search.live.com/sphome.aspx
uURLSearchHooks: H - No File
BHO: Freecause Toolbar BHO: {28a27f58-704f-40e1-8053-28e909fbf604} - c:\program files\mob wars toolbar\Toolbar.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avgssie.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Hotspot Shield Class: {f9e4a054-e9b1-4bc3-83a3-76a1ae736170} - c:\program files\hotspot shield\hssie\HssIE.dll
TB: Mob Wars Toolbar: {6857857c-15d3-435d-af19-e0217298b416} - c:\program files\mob wars toolbar\Toolbar.dll
TB: {719D74AB-1AF9-43A1-8C62-D8750628D93E} - No File
TB: {2787EA8E-8D87-48AF-88AD-B30246C917AB} - No File
TB: {D1A1FD57-93FC-45FE-BC2A-B3A5D47D6674} - No File
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
TB: {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - No File
uRun: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\nero\lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [DAEMON Tools Lite] "c:\program files\daemon\daemon.exe" -autorun
uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockw~1\SWHELP~1.EXE -Update -1100465 -"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2" -"http://www.iwon.com/modules/launchGame/games/includes/blockDotGameIFrame.jhtml?categoryId=3&gameId=9006&browser=IE"
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [NBKeyScan] "c:\program files\nero\nero8\nero backitup\NBKeyScan.exe"
mRun: [Logitech Utility] Logi_MwX.Exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [ZoneAlarm Client] "c:\program files\zonealarm\zlclient.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [dvd43] c:\program files\dvd43\dvd43_tray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\firefox.lnk - c:\program files\firefox\firefox.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\keytext.lnk - c:\program files\keytext\KeyText.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\rsiguard.lnk - c:\program files\rsiguard\RSIGuard.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\zoneal~1.lnk - c:\program files\zonealarm\zlclient.exe
uPolicies-explorer: NoLogoff = 01000000
uPolicies-explorer: NoActiveDesktop = 01000000
uPolicies-explorer: NoRecentDocsNetHood = 01000000
uPolicies-explorer: NoSMMyDocs = 01000000
uPolicies-explorer: NoSMMyPictures = 01000000
uPolicies-explorer: NoNetworkConnections = 01000000
uPolicies-system: NoColorChoice = 0 (0x0)
uPolicies-system: NoSizeChoice = 0 (0x0)
uPolicies-system: NoVisualStyleChoice = 0 (0x0)
uPolicies-system: SetVisualStyle = c:\windows\resources\themes\Luna.theme
IE: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZUfox000
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-latest.cab
TCP: {B7A3BF85-3D73-44EF-9FB0-06224C0D8D58} = 192.168.1.1
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\atheist\applic~1\mozilla\firefox\profiles\zcnsf976.dawkins\
FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com
FF - plugin: c:\program files\firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
---- FIREFOX POLICIES ----
c:\program files\firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
============= SERVICES / DRIVERS ===============
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-6-5 335240]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-6-5 27784]
R1 mozyFilter;mozyFilter;c:\windows\system32\drivers\mozy.sys [2009-2-7 54776]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2009-1-30 353672]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avgwdsvc.exe [2008-6-5 297752]
R2 HssSrv;Hotspot Shield Routing Service;c:\program files\hotspot shield\hsswpr\hsssrv.exe [2009-8-6 331824]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-7-4 24652]
R3 HssDrv;Hotspot Shield Helper Miniport;c:\windows\system32\drivers\hssdrv.sys [2009-5-20 33840]
R3 tap0901;TAP-Win32 Adapter V9;c:\windows\system32\drivers\tap0901.sys [2009-7-21 28592]
S2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2008-6-21 13352]
S3 HssTrayService;Hotspot Shield Tray Service;c:\program files\hotspot shield\bin\HssTrayService.exe [2009-8-10 57640]
S3 IntuitUpdateService;Intuit Update Service;c:\program files\common files\intuit\update service\IntuitUpdateService.exe [2008-12-9 13088]
S3 s125bus;Sony Ericsson Device 125 driver (WDM);c:\windows\system32\drivers\s125bus.sys [2007-4-24 83336]
S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter;c:\windows\system32\drivers\s125mdfl.sys [2007-4-24 15112]
S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver;c:\windows\system32\drivers\s125mdm.sys [2007-4-24 108680]
S3 s125mgmt;Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s125mgmt.sys [2007-4-24 100488]
S3 s125obex;Sony Ericsson Device 125 USB WMC OBEX Interface;c:\windows\system32\drivers\s125obex.sys [2007-4-24 98696]
S3 tap0801;TAP-Win32 Adapter V8;c:\windows\system32\drivers\tap0801.sys [2006-10-1 26624]
============== File Associations ===============
chm.file="hh.exe" %1
txtfile=c:\windows\notepad.exe %1
=============== Created Last 30 ================
2009-08-27 23:35 <DIR> --d----- C:\Hotspot Shield
2009-08-27 23:34 <DIR> --d----- c:\program files\Hotspot Shield
2009-08-20 19:44 <DIR> --d----- c:\program files\Amazon
2009-08-13 09:22 128,512 -------- c:\windows\system32\dllcache\dhtmled.ocx
2009-08-13 09:22 1,315,328 -------- c:\windows\system32\dllcache\msoe.dll
2009-08-12 11:50 <DIR> --d----- c:\docume~1\alluse~1\applic~1\TVU Networks
2009-08-11 15:21 <DIR> --d----- c:\program files\WMV9_VCM
2009-08-11 15:21 162,168 a------- c:\windows\Screen Recorder Uninstaller.exe
2009-08-11 15:21 <DIR> --d----- c:\program files\Screen Recorder
2009-08-11 15:21 <DIR> --d----- c:\program files\common files\River Past
2009-08-11 15:21 <DIR> --d----- c:\docume~1\atheist\applic~1\River Past G5
2009-08-11 15:21 <DIR> --d----- c:\docume~1\alluse~1\applic~1\River Past G5
2009-08-10 21:59 <DIR> --d----- c:\program files\uTorrent
2009-08-10 21:58 <DIR> --d----- c:\docume~1\atheist\applic~1\uTorrent
2009-08-09 17:00 <DIR> --d----- c:\docume~1\atheist\applic~1\tor
2009-08-09 10:36 <DIR> --d----- c:\program files\Tor Browser
2009-08-08 22:13 18,816 a------- c:\windows\system32\drivers\dvd43llh.sys
2009-08-08 22:13 <DIR> --d----- c:\program files\dvd43
2009-08-05 05:01 204,800 -------- c:\windows\system32\dllcache\mswebdvd.dll
==================== Find3M ====================
2009-08-28 09:42 335,240 a------- c:\windows\system32\drivers\avgldx86.sys
2009-08-28 09:42 11,952 a------- c:\windows\system32\avgrsstx.dll
2009-08-05 05:01 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-07-25 05:23 411,368 a------- c:\windows\system32\deploytk.dll
2009-07-22 15:13 28,592 a------- c:\windows\system32\drivers\tap0901.sys
2009-07-19 18:48 11,067,392 a------- c:\windows\system32\dllcache\ieframe.dll
2009-07-19 09:18 5,937,152 a------- c:\windows\system32\dllcache\mshtml.dll
2009-07-17 15:01 58,880 a------- c:\windows\system32\atl.dll
2009-07-17 15:01 58,880 -------- c:\windows\system32\dllcache\atl.dll
2009-07-13 23:43 286,208 a------- c:\windows\system32\wmpdxm.dll
2009-07-13 23:43 10,841,088 -------- c:\windows\system32\dllcache\wmp.dll
2009-07-13 23:43 286,208 -------- c:\windows\system32\dllcache\wmpdxm.dll
2009-07-03 13:09 915,456 a------- c:\windows\system32\wininet.dll
2009-07-03 13:09 915,456 a------- c:\windows\system32\dllcache\wininet.dll
2009-07-03 13:09 12,800 -------- c:\windows\system32\dllcache\xpshims.dll
2009-07-03 13:09 1,208,832 a------- c:\windows\system32\dllcache\urlmon.dll
2009-07-03 13:09 206,848 a------- c:\windows\system32\dllcache\occache.dll
2009-07-03 13:09 594,432 a------- c:\windows\system32\dllcache\msfeeds.dll
2009-07-03 13:09 55,296 a------- c:\windows\system32\dllcache\msfeedsbs.dll
2009-07-03 13:09 1,985,536 a------- c:\windows\system32\dllcache\iertutil.dll
2009-07-03 13:09 25,600 a------- c:\windows\system32\dllcache\jsproxy.dll
2009-07-03 13:09 184,320 a------- c:\windows\system32\dllcache\iepeers.dll
2009-07-03 13:09 246,272 -------- c:\windows\system32\dllcache\ieproxy.dll
2009-07-03 13:09 386,048 a------- c:\windows\system32\dllcache\iedkcs32.dll
2009-07-03 07:01 173,056 a------- c:\windows\system32\dllcache\ie4uinit.exe
2009-06-25 04:25 730,112 a------- c:\windows\system32\lsasrv.dll
2009-06-25 04:25 301,568 a------- c:\windows\system32\kerberos.dll
2009-06-25 04:25 147,456 a------- c:\windows\system32\schannel.dll
2009-06-25 04:25 136,192 a------- c:\windows\system32\msv1_0.dll
2009-06-25 04:25 56,832 a------- c:\windows\system32\secur32.dll
2009-06-25 04:25 54,272 a------- c:\windows\system32\wdigest.dll
2009-06-25 04:25 730,112 -------- c:\windows\system32\dllcache\lsasrv.dll
2009-06-25 04:25 301,568 -------- c:\windows\system32\dllcache\kerberos.dll
2009-06-25 04:25 147,456 -------- c:\windows\system32\dllcache\schannel.dll
2009-06-25 04:25 136,192 -------- c:\windows\system32\dllcache\msv1_0.dll
2009-06-25 04:25 56,832 -------- c:\windows\system32\dllcache\secur32.dll
2009-06-25 04:25 54,272 -------- c:\windows\system32\dllcache\wdigest.dll
2009-06-24 07:18 92,928 -------- c:\windows\system32\dllcache\ksecdd.sys
2009-06-16 10:36 119,808 a------- c:\windows\system32\t2embed.dll
2009-06-16 10:36 81,920 a------- c:\windows\system32\fontsub.dll
2009-06-16 10:36 119,808 -------- c:\windows\system32\dllcache\t2embed.dll
2009-06-16 10:36 81,920 -------- c:\windows\system32\dllcache\fontsub.dll
2009-06-12 08:31 76,288 a------- c:\windows\system32\telnet.exe
2009-06-12 08:31 76,288 -------- c:\windows\system32\dllcache\telnet.exe
2009-06-10 10:13 84,992 a------- c:\windows\system32\avifil32.dll
2009-06-10 10:13 84,992 -------- c:\windows\system32\dllcache\avifil32.dll
2009-06-10 09:19 2,066,432 a------- c:\windows\system32\mstscax.dll
2009-06-10 09:19 2,066,432 -------- c:\windows\system32\dllcache\mstscax.dll
2009-06-10 02:14 132,096 a------- c:\windows\system32\wkssvc.dll
2009-06-10 02:14 132,096 -------- c:\windows\system32\dllcache\wkssvc.dll
2009-06-03 15:09 1,291,264 a------- c:\windows\system32\quartz.dll
2009-06-03 15:09 1,291,264 -------- c:\windows\system32\dllcache\quartz.dll
2009-06-02 06:12 102,912 a------- c:\windows\system32\dllcache\iecompat.dll
2007-02-16 11:31 227,328 a------- c:\program files\mpTrim.exe
2008-06-27 23:13 4,184 a--sh--- c:\windows\system32\KGyGaAvL.sys
============= FINISH: 17:10:17.40 ===============
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-07-30.01)
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 6/3/2008 7:23:26 AM
System Uptime: 8/26/2009 3:29:32 PM (74 hours ago)
Motherboard: Dell Inc. | | 0CU409
Processor: Intel(R) Core(TM)2 Duo CPU E6550 @ 2.33GHz | Socket 775 | 2327/333mhz
==== Disk Partitions =========================
C: is FIXED (NTFS) - 125 GiB total, 40.018 GiB free.
D: is CDROM ()
==== Disabled Device Manager Items =============
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: TAP-Win32 Adapter V8
Device ID: ROOT\NET\0000
Manufacturer: TAP-Win32 Provider
Name: TAP-Win32 Adapter V8
PNP Device ID: ROOT\NET\0000
Service: tap0801
==== System Restore Points ===================
RP398: 7/29/2009 9:36:21 AM - Software Distribution Service 3.0
RP399: 7/30/2009 3:12:20 PM - System Checkpoint
RP400: 8/1/2009 12:11:52 AM - Removed Live Search Club Toolbar
RP401: 8/2/2009 10:32:34 AM - System Checkpoint
RP402: 8/3/2009 1:08:44 PM - System Checkpoint
RP403: 8/4/2009 3:51:09 PM - System Checkpoint
RP404: 8/4/2009 9:48:02 PM - Installed Java(TM) 6 Update 15
RP405: 8/6/2009 11:06:03 AM - System Checkpoint
RP406: 8/7/2009 7:43:49 PM - System Checkpoint
RP407: 8/8/2009 2:12:30 PM - Installed MozyHome Remote Backup
RP408: 8/10/2009 11:42:53 AM - System Checkpoint
RP409: 8/11/2009 1:53:50 PM - System Checkpoint
RP410: 8/13/2009 9:24:16 AM - Software Distribution Service 3.0
RP411: 8/14/2009 6:39:56 PM - System Checkpoint
RP412: 8/15/2009 7:50:46 PM - System Checkpoint
RP413: 8/17/2009 12:08:49 AM - System Checkpoint
RP414: 8/19/2009 4:26:07 PM - System Checkpoint
RP415: 8/21/2009 11:32:19 AM - System Checkpoint
RP416: 8/22/2009 3:38:19 PM - System Checkpoint
RP417: 8/23/2009 4:48:33 PM - System Checkpoint
RP418: 8/24/2009 5:13:47 PM - System Checkpoint
RP419: 8/24/2009 11:14:33 PM - Removed Nero 8 Ultra Edition HD
RP420: 8/26/2009 9:54:05 AM - Software Distribution Service 3.0
RP421: 8/27/2009 11:03:08 AM - System Checkpoint
RP422: 8/28/2009 12:55:13 PM - System Checkpoint
==== Installed Programs ======================
µTorrent
7-Zip 4.65
Adobe Digital Editions
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.6
Adobe Shockwave Player 11.5
Amazon MP3 Downloader 1.0.5
AnswerWorks 5.0 English Runtime
Audacity 1.2.6
AVG Free 8.5
AVIcodec (remove only)
Canon Digital Camera USB WIA Driver
Chinese Simplified Fonts Support For Adobe Reader 8
Coupon Printer for Windows
Critical Update for Windows Media Player 11 (KB959772)
DAEMON Tools Toolbar
DVD Shrink 3.2
DVD43 v4.4.1
Eraser
FLVPlayer4Free Free FLV Player 2.8.0.0
High Definition Audio Driver Package - KB835221
HijackThis 2.0.2
Hooked on Phonics Learn to Read
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB970653-v3)
Hotspot Shield 1.22
ImgBurn
Intel(R) Graphics Media Accelerator Driver
Intel(R) PRO Network Connections 12.1.8.0
IrfanView (remove only)
Java(TM) 6 Update 15
KeyText v2.25
Logitech MouseWare 9.79.1
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft National Language Support Downlevel APIs
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Software Update for Web Folders (English) 12
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Windows Media Video 9 VCM
MIKSOFT Mobile AMR converter
Mob Wars Toolbar
Mozilla Firefox (3.5.2)
MozyHome Remote Backup
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 6.0 Parser (KB933579)
Need for Speed™ ProStreet Demo
neroxml
NoteTab Light 5 (Remove only)
OpenVPN 2.0.9
PDFCreator
PowerDVD
River Past Screen Recorder
RSIGuard Stretch Edition
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB969679)
Security Update for Microsoft Office Excel 2007 (KB969682)
Security Update for Microsoft Office Publisher 2007 (KB969693)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office Word 2007 (KB969604)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Spybot - Search & Destroy
TurboTax 2008
TurboTax 2008 WinPerFedFormset
TurboTax 2008 WinPerProgramHelp
TurboTax 2008 WinPerReleaseEngine
TurboTax 2008 WinPerTaxSupport
TurboTax 2008 WinPerUserEducation
TurboTax 2008 wnyiper
TurboTax 2008 wrapper
TVUPlayer 2.4.7.2
Tweak UI
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office PowerPoint 2007 Help (KB957247)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Windows Internet Explorer 8 (KB971180)
Update for Windows Internet Explorer 8 (KB971930)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951618-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973815)
VC 9.0 Runtime
Viewpoint Media Player
VLC media player 1.0.1
WebFldrs XP
Windows Genuine Advantage Validation Tool (KB892130)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live installer
Windows Media Format 11 runtime
Windows Media Player 11
Windows Search 4.0
Windows XP Service Pack 3
WinISO 5.3
WinRAR archiver
ZoneAlarm
==== Event Viewer Messages From Past Week ========
8/29/2009 4:17:20 PM, error: Dhcp [1002] - The IP address lease 10.10.35.234 for the Network Card with network address 00FF636CE4BA has been denied by the DHCP server 10.17.95.254 (The DHCP Server sent a DHCPNACK message).
8/29/2009 12:14:07 AM, error: Dhcp [1002] - The IP address lease 10.13.28.151 for the Network Card with network address 00FF636CE4BA has been denied by the DHCP server 10.10.47.254 (The DHCP Server sent a DHCPNACK message).
8/29/2009 12:08:27 AM, error: Dhcp [1002] - The IP address lease 10.20.116.218 for the Network Card with network address 00FF636CE4BA has been denied by the DHCP server 10.13.31.254 (The DHCP Server sent a DHCPNACK message).
8/29/2009 12:02:07 AM, error: Dhcp [1002] - The IP address lease 10.6.114.185 for the Network Card with network address 00FF636CE4BA has been denied by the DHCP server 10.20.127.254 (The DHCP Server sent a DHCPNACK message).
8/28/2009 3:51:01 PM, error: Dhcp [1002] - The IP address lease 10.8.96.13 for the Network Card with network address 00FF636CE4BA has been denied by the DHCP server 10.6.127.254 (The DHCP Server sent a DHCPNACK message).
8/24/2009 7:13:26 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service upnphost with arguments "" in order to run the server: {204810B9-73B2-11D4-BF42-00B0D0118B56}
8/24/2009 11:15:25 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
==== End Of File ===========================
clamenza
2009-08-30, 00:51
GMER 1.0.15.15077 [0pslw3j3.exe] - http://www.gmer.net
Rootkit scan 2009-08-29 18:50:23
Windows 5.1.2600 Service Pack 3
---- System - GMER 1.0.15 ----
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwConnectPort [0xA900DFC0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateFile [0xA900AC80]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateKey [0xA9025170]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreatePort [0xA900E580]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateProcess [0xA9022900]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateProcessEx [0xA9022B10]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateSection [0xA9026B10]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateWaitablePort [0xA900E670]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDeleteFile [0xA900B210]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDeleteKey [0xA90259F0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDeleteValueKey [0xA90257A0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDuplicateObject [0xA9022280]
SSDT spqi.sys ZwEnumerateKey [0xB9EC5CA4]
SSDT spqi.sys ZwEnumerateValueKey [0xB9EC6032]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwLoadKey [0xA9025F10]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwLoadKey2 [0xA9025F90]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwOpenFile [0xA900B070]
SSDT spqi.sys ZwOpenKey [0xB9EA70C0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwOpenProcess [0xA9024180]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwOpenThread [0xA9023F40]
SSDT spqi.sys ZwQueryKey [0xB9EC610A]
SSDT spqi.sys ZwQueryValueKey [0xB9EC5F8A]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwRenameKey [0xA90266F0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwReplaceKey [0xA9026150]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwRequestWaitReplyPort [0xA900DBE0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwRestoreKey [0xA9026540]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSecureConnectPort [0xA900E190]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSetInformationFile [0xA900B440]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSetValueKey [0xA90254E0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSystemDebugControl [0xA9023200]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwTerminateProcess [0xA9023080]
INT 0x63 ? 8A4F5BF8
INT 0x73 ? 8A614BF8
INT 0x73 ? 8A614BF8
INT 0x73 ? 8A614BF8
INT 0x73 ? 8A614BF8
INT 0x73 ? 8A4F5BF8
INT 0x73 ? 8A4F5BF8
INT 0x73 ? 8A614BF8
INT 0x94 ? 8A4F5BF8
INT 0xA4 ? 8A4F5BF8
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!ZwCallbackReturn + 2C7C 80504518 12 Bytes [80, E5, 00, A9, 00, 29, 02, ...]
? spqi.sys The system cannot find the file specified. !
? srescan.sys The system cannot find the file specified. !
.text USBPORT.SYS!DllUnload B95F88AC 5 Bytes JMP 8A4F51D8
.text asw2e9fl.SYS B93B4386 35 Bytes [00, 00, 00, 00, 00, 00, 20, ...]
.text asw2e9fl.SYS B93B43AA 24 Bytes [00, 00, 00, 00, 00, 00, 00, ...]
.text asw2e9fl.SYS B93B43C4 3 Bytes [00, 70, 02] {ADD [EAX+0x2], DH}
.text asw2e9fl.SYS B93B43C9 1 Byte [30]
.text asw2e9fl.SYS B93B43C9 11 Bytes [30, 00, 00, 00, 5C, 02, 00, ...] {XOR [EAX], AL; ADD [EAX], AL; POP ESP; ADD AL, [EAX]; ADD [EAX], AL; ADD [EAX], AL}
.text ...
? System32\Drivers\hiber_WMILIB.SYS The system cannot find the path specified. !
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [B9EA8042] spqi.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [B9EA813E] spqi.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [B9EA80C0] spqi.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [B9EA8800] spqi.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [B9EA86D6] spqi.sys
IAT \SystemRoot\System32\Drivers\asw2e9fl.SYS[HAL.dll!KfAcquireSpinLock] 18C4830E
IAT \SystemRoot\System32\Drivers\asw2e9fl.SYS[HAL.dll!READ_PORT_UCHAR] 1C8D9E88
IAT \SystemRoot\System32\Drivers\asw2e9fl.SYS[HAL.dll!KeGetCurrentIrql] 9E880000
IAT \SystemRoot\System32\Drivers\asw2e9fl.SYS[HAL.dll!KfRaiseIrql] 00001CA9
IAT \SystemRoot\System32\Drivers\asw2e9fl.SYS[HAL.dll!KfLowerIrql] 0E798366
IAT \SystemRoot\System32\Drivers\asw2e9fl.SYS[HAL.dll!HalGetInterruptVector] 74AAB000
IAT \SystemRoot\System32\Drivers\asw2e9fl.SYS[HAL.dll!HalTranslateBusAddress] 8186C636
IAT \SystemRoot\System32\Drivers\asw2e9fl.SYS[HAL.dll!KeStallExecutionProcessor] 1A00001C
IAT \SystemRoot\System32\Drivers\asw2e9fl.SYS[HAL.dll!KfReleaseSpinLock] 1C8386C6
IAT \SystemRoot\System32\Drivers\asw2e9fl.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] C6020000
IAT \SystemRoot\System32\Drivers\asw2e9fl.SYS[HAL.dll!READ_PORT_USHORT] 001C8E86
IAT \SystemRoot\System32\Drivers\asw2e9fl.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 86C60200
IAT \SystemRoot\System32\Drivers\asw2e9fl.SYS[HAL.dll!WRITE_PORT_UCHAR] 00001CAA
IAT \SystemRoot\System32\Drivers\asw2e9fl.SYS[WMILIB.SYS!WmiSystemControl] 8800001C
IAT \SystemRoot\System32\Drivers\asw2e9fl.SYS[WMILIB.SYS!WmiCompleteRequest] 001CB19E
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] [A9012B20] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] [A9012930] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] [A9013260] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] [A9010E90] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol] [A9010E90] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] [A9012B20] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter] [A9012930] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter] [A9013260] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] [A9012B20] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] [A9010E90] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] [A9013260] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] [A9012930] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [A9013260] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [A9012930] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [A9012B20] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] [A9010E90] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [A9012B20] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [A9012930] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [A9013260] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs 8A6821F8
AttachedDevice \FileSystem\Ntfs \Ntfs mozy.sys (Mozy Change Monitor Filter Driver/Mozy, Inc.)
Device \FileSystem\Fastfat \FatCdrom 8926F1F8
Device \FileSystem\Udfs \UdfsCdRom 895B61F8
Device \FileSystem\Udfs \UdfsDisk 895B61F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{636CE4BA-5FA5-48EF-9709-51C294E2168F} 898111F8
Device \Driver\Tcpip \Device\Ip vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
Device \Driver\sptd \Device\2197283876 spqi.sys
Device \Driver\usbuhci \Device\USBPDO-0 8A4F41F8
Device \Driver\usbehci \Device\USBPDO-1 8A4F31F8
Device \Driver\usbuhci \Device\USBPDO-2 8A4F41F8
Device \Driver\usbuhci \Device\USBPDO-3 8A4F41F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{0225C3CC-961E-43FD-AE15-3C4737267C61} 898111F8
Device \Driver\usbuhci \Device\USBPDO-4 8A4F41F8
Device \Driver\Tcpip \Device\Tcp vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
Device \Driver\usbuhci \Device\USBPDO-5 8A4F41F8
Device \Driver\usbehci \Device\USBPDO-6 8A4F31F8
Device \Driver\usbuhci \Device\USBPDO-7 8A4F41F8
Device \Driver\Ftdisk \Device\HarddiskVolume1 8A6841F8
Device \Driver\Cdrom \Device\CdRom0 8A4F6500
Device \Driver\Ftdisk \Device\HarddiskVolume2 8A6841F8
Device \Driver\Ftdisk \Device\HarddiskVolume3 8A6841F8
Device \Driver\Ftdisk \Device\HarddiskVolume4 8A6841F8
Device \Driver\Ftdisk \Device\HarddiskVolume5 8A6841F8
Device \Driver\NetBT \Device\NetBt_Wins_Export 898111F8
Device \Driver\NetBT \Device\NetbiosSmb 898111F8
Device \Driver\PCI_PNP7626 \Device\0000004d spqi.sys
Device \Driver\NetBT \Device\NetBT_Tcpip_{B7A3BF85-3D73-44EF-9FB0-06224C0D8D58} 898111F8
Device \Driver\Tcpip \Device\Udp vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\RawIp vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
Device \Driver\usbuhci \Device\USBFDO-0 8A4F41F8
Device \Driver\usbuhci \Device\USBFDO-1 8A4F41F8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 89665500
Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
Device \Driver\usbuhci \Device\USBFDO-2 8A4F41F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 89665500
Device \Driver\usbehci \Device\USBFDO-3 8A4F31F8
Device \Driver\usbuhci \Device\USBFDO-4 8A4F41F8
Device \Driver\Ftdisk \Device\FtControl 8A6841F8
Device \Driver\usbuhci \Device\USBFDO-5 8A4F41F8
Device \Driver\usbuhci \Device\USBFDO-6 8A4F41F8
Device \Driver\usbehci \Device\USBFDO-7 8A4F31F8
Device \Driver\asw2e9fl \Device\Scsi\asw2e9fl1 8A48D500
Device \FileSystem\Fastfat \Fat 8926F1F8
AttachedDevice \FileSystem\Fastfat \Fat mozy.sys (Mozy Change Monitor Filter Driver/Mozy, Inc.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
Device \FileSystem\Cdfs \Cdfs 895E81F8
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xAF 0x66 0xFF 0x40 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xB2 0x39 0xAE 0x18 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x83 0xB6 0x02 0xD1 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0xAF 0x1D 0x32 0x8A ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x61 0x5C 0x8D 0xA6 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xAF 0x66 0xFF 0x40 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xB2 0x39 0xAE 0x18 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x83 0xB6 0x02 0xD1 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0xAF 0x1D 0x32 0x8A ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x61 0x5C 0x8D 0xA6 ...
clamenza
2009-08-30, 00:51
---- Files - GMER 1.0.15 ----
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\C18DUOHT\0730_save4[1].gif 10315 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\C18DUOHT\08_01_09[1].jpg 28758 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\C18DUOHT\1000_arrow_safecount_li-350x250-1l-eng-usd[1].swf 9532 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\C18DUOHT\10098_s[1].jpg 767 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\C18DUOHT\100px-Gold_Christian_Cross_no_Red.svg[1].png 3016 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\C18DUOHT\bar_back[1].gif 166 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\C18DUOHT\bcom_etaf_scripts[1].js 3896 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\C18DUOHT\beacon[2].htm 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\C18DUOHT\beacon[5].htm 253 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\C18DUOHT\beacon[6].htm 253 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\C18DUOHT\beacon[8].htm 253 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\C18DUOHT\begley_237-thumb7[1].jpg 3882 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\C18DUOHT\bg[2].gif 1367 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\C18DUOHT\desktop.ini 67 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\G9BK7TUW\023073_160_600[1].swf 28535 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\G9BK7TUW\charity_sm[5].gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\G9BK7TUW\charity_sm[6].gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\G9BK7TUW\charity_sm[7].gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\G9BK7TUW\charity_sm[8].gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\G9BK7TUW\charity_sm[9].gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\G9BK7TUW\chart-nav-bg[1].png 235 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\H2Z069PW\072709_TRU_BillMeLater[1].jpg 50661 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\H2Z069PW\0810_1834_1293356[1].htm 103263 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\H2Z069PW\082409dayahead_115x65[1].jpg 2575 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\H2Z069PW\082809spiegel_115x65[1].jpg 3015 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\H2Z069PW\090522-cps-sc-480x60[1].gif 11753 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\H2Z069PW\090624-siemens_tg-660x90[1].swf 15805 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\H2Z069PW\090712_DS_01_10__img_2070949085[1].jpg 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\chrissi[1].jpg 2226 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\christiancafe[1].jpg 5538 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\Chicktionary_smallCANF0JY5.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\Chicktionary_smallCANF0SWU.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\Chicktionary_smallCANQLC73.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\Chicktionary_smallCANVDN0G.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\Chicktionary_smallCAOF1AG9.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\Chicktionary_smallCAP1K16A.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\Chicktionary_smallCAP2C12A.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\Chicktionary_smallCAP8QI38.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\Chicktionary_smallCAPL9B7Y.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\Chicktionary_smallCAPLC7NB.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\Chicktionary_smallCAPMX5BH.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\Chicktionary_smallCAPNLFTH.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\Chicktionary_smallCAPOR14A.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\Chicktionary_smallCAPS9JTW.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\Chicktionary_smallCAPXDTML.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\Chicktionary_smallCAQ0U16G.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\Chicktionary_smallCAQ2QMYD.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\Chicktionary_smallCAQ2SESA.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\Chicktionary_smallCAQE7M7F.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\Chicktionary_smallCAQO5PBH.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\Chicktionary_smallCAQZ97C2.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\Chicktionary_smallCAR22B9D.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\Chicktionary_smallCAR24BCP.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\Chicktionary_smallCARDB98J.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\J7NKMXQA\Chicktionary_smallCARFCCHF.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\JVHQ1NDN\airmiles2500_smCA0DUAP0.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\JVHQ1NDN\airmiles2500_smCA1MA4B7.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\JVHQ1NDN\airmiles2500_smCA1NB1ZV.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\JVHQ1NDN\airmiles2500_smCA306RGV.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\JVHQ1NDN\airmiles2500_smCA3G4V47.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\JVHQ1NDN\airmiles2500_smCA5ZM51M.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\K076DGPA\Chicktionary_smallCAC9VW04.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\K076DGPA\Chicktionary_smallCACCLJZ1.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\K076DGPA\Chicktionary_smallCACFWSML.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\K076DGPA\Chicktionary_smallCACMOZXV.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\K076DGPA\Chicktionary_smallCACY1FIJ.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\K076DGPA\Chicktionary_smallCAD0JT96.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\K076DGPA\Chicktionary_smallCAD9U3SG.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\K076DGPA\Chicktionary_smallCADEJ6I8.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\K076DGPA\Chicktionary_smallCADOZPUA.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\K076DGPA\Chicktionary_smallCADUQIKE.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\K076DGPA\Chicktionary_smallCAE02QD7.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\K076DGPA\Chicktionary_smallCAE71C7J.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\K076DGPA\Chicktionary_smallCAEI2D34.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\MU7QXMXQ\00615748000-1[1].jpg 1535 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\MU7QXMXQ\073109weisman_115x65[1].jpg 2892 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\MU7QXMXQ\0c97cdf7843828fe0dc528a94be360a1[1].jpg 2473 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\MU7QXMXQ\1-1[1].htm 5568 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\MU7QXMXQ\Chicktionary_small[5].gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\MU7QXMXQ\Chicktionary_small[6].gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\MU7QXMXQ\Chicktionary_small[7].gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\MU7QXMXQ\Chicktionary_small[8].gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\MU7QXMXQ\Chicktionary_small[9].gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\NG1P2OWB\f2[1].gif 216 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\NG1P2OWB\favicon[1].ico 6598 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\NG1P2OWB\favicon[1].png 306 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\NG1P2OWB\favicon[2].ico 1406 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\NG1P2OWB\favicon[4].ico 1406 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\NG1P2OWB\FeatureLoader.js[1].php 17062 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\NG1P2OWB\female[1].gif 1284 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\NG1P2OWB\fireseeds[1].jpg 39111 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\080209reuterscollapse_115x65[1].jpg 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\080608_mscm_stationery_announcement_image[1].gif 640 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\090712_ALB_01_72__img_1549193217[1].jpg 1586 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\home_sel[1].png 1586 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\honcode08[1].gif 1931 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\hoverchart_r4_c1_f56[1].png 705 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\hoverchart_r4_c4_f14[1].png 428 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\hoverchart_r4_c5_f14[1].png 674 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\hrdp_0812w_z_federal_cash_for_clunkers+crusher_camaro+side_view[1].jpg 5802 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCA4RZEWG.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCA4SEJWV.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCA58AZHU.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCA5E1WAF.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCA5SPVTE.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCA6D9SU9.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCA6S4DI2.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCA85O8UO.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCA86P7IE.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCA89JSVI.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCA89OJW9.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCA8RKNVR.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCA8S6LT9.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCA8VSADD.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCA8W0P54.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCA92RXAJ.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCA9C25YB.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCA9IRLZ4.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCA9PJ5HB.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCA9VVTYS.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCAA3NDV2.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCAB3KLPS.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCABDJ5XY.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCABGWQVD.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCABIK774.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCABRP8Z2.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCABSDGT8.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCABVZMKM.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCAC8AVBF.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\news-ultraviolet-t[1].jpg 12266 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\newsgoth-editors-picks[1].gif 1002 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\newsgoth-real-or-fake[1].gif 993 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\newsletter-textarea[1].gif 447 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\newsreel_next[1].gif 322 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\noimage[1].gif 3198 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\now-playing-arrow[1].gif 114 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\MattLauer_small[3].gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\MattLauer_small[4].gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\MattLauer_small[5].gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\MattLauer_small[6].gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\MattLauer_small[7].gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\MattLauer_small[8].gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\MattLauer_small[9].gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\ma_mail_1[1].gif 1402 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\menuLeftBG[1].jpg 568 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\menuRightBG_btm[1].jpg 1106 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\Flexicon_smallCA30PJDA.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\Flexicon_smallCAETK281.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\Flexicon_smallCAJ582BO.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\Flexicon_smallCAQ64Z8L.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\Flexicon_small[4].gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\fms[1].htm 379 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\ft[3] 4327 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\hat[1].css 15072 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\Chicktionary_smallCASEGQ8F.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\Chicktionary_smallCASFOEFF.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\Chicktionary_smallCASI2DBR.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\Chicktionary_smallCASIRM3L.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\Chicktionary_smallCASISUAX.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\Chicktionary_smallCASX443N.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\Chicktionary_smallCASXFFUR.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\Chicktionary_smallCASZ52ZY.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\Chicktionary_smallCAT7SBS9.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\Chicktionary_smallCAT9ITMJ.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\Chicktionary_smallCATC3XHD.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\Chicktionary_smallCATMMSSV.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\Chicktionary_smallCATVBDRY.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\Chicktionary_smallCATX2HTK.gif 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCAFRITWO.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCAFZ49JT.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCAG2FDBL.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCAGFXMDB.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCAGNRGSY.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCAH18U55.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCAHB7DXR.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCAHF1Q4D.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCAHSDEOP.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCAI07GC2.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCAICJ3HZ.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCAINXDXX.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCAJ12IO8.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCAJIT35N.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCAJPVAVN.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCAJRYTA4.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCAJW8XXN.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCAK3LZ2E.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCAK76SWO.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCAKLDEED.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCAKLZZ8X.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\RIN8FSHY\JR900001_smCALGEY1H.png 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\T1IP0QRX\ebel[1].png 1159 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\T1IP0QRX\email-small[1].png 747 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\T1IP0QRX\Empty_Movie[1].swf 30 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\T1IP0QRX\endfiller[1].gif 1016 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\T1IP0QRX\epop[1].js 3335 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\T1IP0QRX\expand_main_table[1].gif 45 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\T1IP0QRX\f1[1].gif 216 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\T1IP0QRX\favicon[1].ico 25214 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\T1IP0QRX\favicon[2].ico 1150 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\T1IP0QRX\fav[1].ico 1150 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\WIVK3KTW\-1[1].js 0 bytes
File C:\Documents and Settings\Atheist\Local Settings\Temporary Internet Files\Content.IE5\WIVK3KTW\080309angwingoogle_115x65[1].jpg 2659 bytes
---- EOF - GMER 1.0.15 ----
Hi,
Please visit this webpage for download links, and instructions for running ComboFix tool:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Please ensure you read this guide carefully and install the Recovery Console first.
The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.
Once installed, you should see a blue screen prompt that says:
The Recovery Console was successfully installed.
Please continue as follows:
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link (http://www.bleepingcomputer.com/forums/topic114351.html)
Remember to re-enable them afterwards.
Click Yes to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please include the following reports for further review, and so we may continue cleansing the system:
C:\ComboFix.txt
New dds.txt log.
A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.
clamenza
2009-08-30, 19:23
ComboFix 09-08-29.01 - Atheist 08/30/2009 13:15.1.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2037.1423 [GMT -4:00]
Running from: c:\documents and settings\Atheist\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\RoomPanel.dll
c:\windows\COUPON~1.OCX
c:\windows\CouponPrinter.ocx
c:\windows\desktop
c:\windows\desktop\Hooked on Phonics Learn to Read.lnk
c:\windows\Installer\a63a0.msi
c:\windows\winhelp.ini
.
((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-30 )))))))))))))))))))))))))))))))
.
2009-08-28 03:35 . 2009-08-28 03:35 -------- d-----w- C:\Hotspot Shield
2009-08-28 03:34 . 2009-08-28 03:35 -------- d-----w- c:\program files\Hotspot Shield
2009-08-26 13:54 . 2009-08-28 03:34 -------- d-----w- c:\windows\LastGood
2009-08-25 01:41 . 2009-08-25 01:43 -------- d-----w- c:\documents and settings\Atheist\Application Data\ImgBurn
2009-08-25 01:38 . 2009-08-25 01:38 -------- d-----w- c:\program files\ImgBurn
2009-08-24 01:00 . 2009-08-24 01:00 -------- d-----w- c:\program files\7-Zip
2009-08-20 23:44 . 2009-08-20 23:44 -------- d-----w- c:\documents and settings\Atheist\Application Data\Amazon
2009-08-20 23:44 . 2009-08-20 23:44 -------- d-----w- c:\program files\Amazon
2009-08-14 21:50 . 2009-08-14 21:50 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-08-13 13:22 . 2009-07-10 13:27 1315328 ------w- c:\windows\system32\dllcache\msoe.dll
2009-08-12 15:50 . 2009-08-12 15:50 -------- d-----w- c:\documents and settings\All Users\Application Data\TVU Networks
2009-08-12 13:58 . 2009-08-12 14:00 5519752 ----a-w- c:\documents and settings\Atheist\Application Data\TVU Networks\TVU AutoUpgrade\TVUPlayer2.4.7.2.exe
2009-08-11 19:21 . 2009-08-11 19:21 -------- d-----w- c:\program files\WMV9_VCM
2009-08-11 19:21 . 2009-08-11 19:23 -------- d-----w- c:\documents and settings\All Users\Application Data\River Past G5
2009-08-11 19:21 . 2009-08-11 19:21 162168 ----a-w- c:\windows\Screen Recorder Uninstaller.exe
2009-08-11 19:21 . 2009-08-11 19:21 -------- d-----w- c:\program files\Screen Recorder
2009-08-11 19:21 . 2009-08-11 19:21 -------- d-----w- c:\program files\Common Files\River Past
2009-08-11 19:21 . 2009-08-11 19:21 -------- d-----w- c:\documents and settings\Atheist\Application Data\River Past G5
2009-08-11 01:59 . 2009-08-11 01:59 -------- d-----w- c:\program files\uTorrent
2009-08-11 01:58 . 2009-08-25 21:05 -------- d-----w- c:\documents and settings\Atheist\Application Data\uTorrent
2009-08-09 21:00 . 2009-08-10 00:43 -------- d-----w- c:\documents and settings\Atheist\Application Data\Vidalia
2009-08-09 21:00 . 2009-08-09 21:00 -------- d-----w- c:\documents and settings\Atheist\Application Data\tor
2009-08-09 14:36 . 2009-08-09 14:52 -------- d-----w- c:\program files\Tor Browser
2009-08-09 02:13 . 2009-08-09 02:13 18816 ----a-w- c:\windows\system32\drivers\dvd43llh.sys
2009-08-09 02:13 . 2009-08-09 02:13 -------- d-----w- c:\program files\dvd43
2009-08-06 01:24 . 2009-08-09 02:16 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-08-06 01:24 . 2009-08-09 02:16 -------- d-----w- c:\program files\NOS
2009-08-05 09:01 . 2009-08-05 09:01 204800 ------w- c:\windows\system32\dllcache\mswebdvd.dll
2009-08-05 01:47 . 2009-08-05 01:47 152576 ----a-w- c:\documents and settings\Atheist\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-30 17:10 . 2008-06-03 23:20 -------- d-----w- c:\documents and settings\Atheist\Application Data\RSIGuard
2009-08-30 15:40 . 2008-06-05 17:15 -------- d-----w- c:\program files\Firefox
2009-08-29 13:17 . 2008-06-05 05:19 -------- d-----w- c:\program files\AVG
2009-08-28 21:55 . 2009-07-29 00:12 -------- d-----w- c:\documents and settings\Atheist\Application Data\vlc
2009-08-28 20:02 . 2008-09-19 06:00 -------- d-----w- c:\documents and settings\Atheist\Application Data\dvdcss
2009-08-28 13:42 . 2008-06-05 05:19 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-08-28 13:42 . 2008-06-05 05:19 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-08-28 13:42 . 2008-06-05 05:19 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-08-25 03:15 . 2008-08-02 17:54 -------- d-----w- c:\program files\Nero
2009-08-25 03:15 . 2008-08-02 17:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2009-08-25 03:15 . 2008-06-20 16:25 -------- d-----w- c:\program files\Common Files\Nero
2009-08-13 23:51 . 2008-06-05 02:11 -------- d-----w- c:\documents and settings\All Users\Application Data\DVD Shrink
2009-08-12 15:50 . 2009-03-26 16:53 -------- d-----w- c:\program files\TVUPlayer
2009-08-11 01:57 . 2008-11-06 04:58 -------- d-----w- c:\program files\Vuze
2009-08-09 02:18 . 2009-04-09 13:18 2205390 ----a-w- c:\windows\Internet Logs\tvDebug.Zip
2009-08-08 18:12 . 2008-06-05 02:20 -------- d-----w- c:\program files\MozyHome
2009-08-08 18:07 . 2008-06-04 00:10 -------- d-----w- c:\program files\Spybot
2009-08-05 09:01 . 2004-08-10 17:51 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-05 01:48 . 2009-04-09 13:44 -------- d-----w- c:\program files\Java
2009-07-29 00:11 . 2008-09-16 22:57 -------- d-----w- c:\program files\VLC
2009-07-25 09:23 . 2008-11-23 14:31 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-22 19:13 . 2009-07-21 23:22 28592 ----a-w- c:\windows\system32\drivers\tap0901.sys
2009-07-17 19:01 . 2004-08-10 17:50 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-15 12:34 . 2009-06-14 04:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-07-14 03:43 . 2004-08-10 17:51 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 2004-08-10 17:51 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-30 12:06 . 2009-05-20 19:54 33840 ----a-w- c:\windows\system32\drivers\hssdrv.sys
2009-06-25 08:25 . 2004-08-10 17:51 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2004-08-10 17:51 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 2004-08-10 17:51 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 2004-08-10 17:51 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:25 . 2004-08-10 17:51 730112 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 2004-08-10 17:51 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-24 23:06 . 2008-12-22 05:16 1 ----a-w- c:\documents and settings\Atheist\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-06-24 19:03 . 2009-02-07 15:54 54776 ----a-w- c:\windows\system32\drivers\mozy.sys
2009-06-24 11:18 . 2004-08-10 17:51 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-18 16:47 . 2008-06-30 17:07 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-06-16 14:36 . 2004-08-10 17:51 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2004-08-10 17:51 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-15 00:46 . 2008-06-03 11:24 69232 ----a-w- c:\documents and settings\Atheist\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-12 12:31 . 2004-08-10 17:51 76288 ----a-w- c:\windows\system32\telnet.exe
2009-06-11 02:33 . 2009-06-11 02:33 152576 ----a-w- c:\documents and settings\Atheist\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-06-10 14:13 . 2004-08-10 17:50 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 13:19 . 2004-08-10 18:01 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 2004-08-10 17:51 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-03 19:09 . 2004-08-10 17:51 1291264 ----a-w- c:\windows\system32\quartz.dll
2007-02-16 15:31 . 2008-06-23 20:27 227328 ----a-w- c:\program files\mpTrim.exe
2008-06-28 03:13 . 2008-06-28 03:13 4184 --sha-w- c:\windows\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{28A27F58-704F-40E1-8053-28E909FBF604}]
2009-05-31 00:52 1297920 ----a-w- c:\program files\Mob Wars Toolbar\Toolbar.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
2009-08-28 03:34 218160 ----a-w- c:\program files\Hotspot Shield\hssie\HssIE.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6857857C-15D3-435D-AF19-E0217298B416}"= "c:\program files\Mob Wars Toolbar\Toolbar.dll" [2009-05-31 1297920]
[HKEY_CLASSES_ROOT\clsid\{6857857c-15d3-435d-af19-e0217298b416}]
[HKEY_CLASSES_ROOT\FCTB000058757.IEToolbar.3]
[HKEY_CLASSES_ROOT\TypeLib\{AD0FF573-4DD1-4CF7-AA25-41280783CA54}]
[HKEY_CLASSES_ROOT\FCTB000058757.IEToolbar]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{6857857C-15D3-435D-AF19-E0217298B416}"= "c:\program files\Mob Wars Toolbar\Toolbar.dll" [2009-05-31 1297920]
[HKEY_CLASSES_ROOT\clsid\{6857857c-15d3-435d-af19-e0217298b416}]
[HKEY_CLASSES_ROOT\FCTB000058757.IEToolbar.3]
[HKEY_CLASSES_ROOT\TypeLib\{AD0FF573-4DD1-4CF7-AA25-41280783CA54}]
[HKEY_CLASSES_ROOT\FCTB000058757.IEToolbar]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy2]
@="{747E722C-CB46-4a9d-BDFE-192AAD5099B1}"
[HKEY_CLASSES_ROOT\CLSID\{747E722C-CB46-4a9d-BDFE-192AAD5099B1}]
2009-06-24 19:03 2835256 ----a-w- c:\program files\MozyHome\mozyshell.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy3]
@="{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}"
[HKEY_CLASSES_ROOT\CLSID\{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}]
2009-06-24 19:03 2835256 ----a-w- c:\program files\MozyHome\mozyshell.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON\daemon.exe" [2009-04-23 691656]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-06-14 142104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-06-14 138008]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2007-09-17 124200]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"ZoneAlarm Client"="c:\program files\ZoneAlarm\zlclient.exe" [2009-02-16 981384]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"dvd43"="c:\program files\dvd43\dvd43_tray.exe" [2009-06-29 827904]
"Logitech Utility"="Logi_MwX.Exe" - c:\windows\LOGI_MWX.EXE [2003-12-17 19968]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Firefox.lnk - c:\program files\Firefox\firefox.exe [2008-6-5 908280]
KeyText.lnk - c:\program files\KeyText\KeyText.exe [2008-6-5 409600]
RSIGuard.lnk - c:\program files\RSIGuard\RSIGuard.exe [2008-6-5 6926336]
ZoneAlarm.lnk - c:\program files\ZoneAlarm\zlclient.exe [2009-3-29 981384]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLogoff"= 01000000
"NoRecentDocsNetHood"= 01000000
"NoSMMyDocs"= 01000000
"NoSMMyPictures"= 01000000
"NoNetworkConnections"= 01000000
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-28 13:42 11952 ----a-w- c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PowerDVD.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PDVDDXSrv.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\avgupd.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Screen Recorder\\ScreenRecorder.exe"=
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [6/5/2008 1:19 AM 335240]
R1 mozyFilter;mozyFilter;c:\windows\system32\drivers\mozy.sys [2/7/2009 11:54 AM 54776]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\avgwdsvc.exe [6/5/2008 1:19 AM 297752]
R2 HssSrv;Hotspot Shield Routing Service;c:\program files\Hotspot Shield\HssWPR\hsssrv.exe [8/6/2009 2:58 PM 331824]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [7/4/2008 6:08 PM 24652]
R3 HssDrv;Hotspot Shield Helper Miniport;c:\windows\system32\drivers\hssdrv.sys [5/20/2009 3:54 PM 33840]
R3 tap0901;TAP-Win32 Adapter V9;c:\windows\system32\drivers\tap0901.sys [7/21/2009 7:22 PM 28592]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [6/21/2008 10:19 PM 13352]
S3 HssTrayService;Hotspot Shield Tray Service;c:\program files\Hotspot Shield\bin\HssTrayService.exe [8/10/2009 7:19 PM 57640]
S3 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [12/9/2008 12:37 PM 13088]
S3 tap0801;TAP-Win32 Adapter V8;c:\windows\system32\drivers\tap0801.sys [10/1/2006 8:37 AM 26624]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - AUJASNKJ
*NewlyCreated* - HOTSPOTSHIELDSERVICE
*NewlyCreated* - HSSSRV
*NewlyCreated* - HSSTRAYSERVICE
*Deregistered* - aujasnkj
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
HKCU-RunOnce-Shockwave Updater - c:\windows\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2
HKLM-Run-NBKeyScan - c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://my.yahoo.com/
uSearchURL,(Default) = hxxp://www.searchgateway.net/search/%s
IE: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZUfox000
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
FF - ProfilePath - c:\documents and settings\Atheist\Application Data\Mozilla\Firefox\Profiles\de6b8akp.default\
FF - prefs.js: browser.search.selectedEngine - Answers.com
FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com
FF - prefs.js: keyword.URL - hxxp://search.freecause.com/search?fr=freecause&ourmark=3&type=58757&p=
FF - component: c:\documents and settings\Atheist\Application Data\Mozilla\Firefox\Profiles\de6b8akp.default\extensions\{18b8f08d-62fe-4dfc-ad6c-9ce46515d5ec}\components\Engine.dll
FF - plugin: c:\documents and settings\Atheist\Application Data\Mozilla\Firefox\Profiles\de6b8akp.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000006.dll
FF - plugin: c:\program files\Firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
---- FIREFOX POLICIES ----
c:\program files\Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.
.
------- File Associations -------
.
chm.file="hh.exe" %1
txtfile=c:\windows\notepad.exe %1
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-30 13:17
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Completion time: 2009-08-30 13:20
ComboFix-quarantined-files.txt 2009-08-30 17:19
Pre-Run: 43,797,123,072 bytes free
Post-Run: 43,919,659,008 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
308 --- E O F --- 2009-08-26 13:54
clamenza
2009-08-30, 19:26
DDS (Ver_09-07-30.01) - NTFSx86
Run by Atheist at 13:24:53.42 on Sun 08/30/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2037.1439 [GMT -4:00]
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\MozyHome\mozybackup.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\KeyText\KeyText.exe
C:\Program Files\RSIGuard\RSIGuard.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\PROGRA~1\AVG\avgwdsvc.exe
C:\PROGRA~1\AVG\avgrsx.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Atheist\Desktop\dds.scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://my.yahoo.com/
uSearchURL,(Default) = hxxp://www.searchgateway.net/search/%s
uURLSearchHooks: H - No File
BHO: Freecause Toolbar BHO: {28a27f58-704f-40e1-8053-28e909fbf604} - c:\program files\mob wars toolbar\Toolbar.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avgssie.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Hotspot Shield Class: {f9e4a054-e9b1-4bc3-83a3-76a1ae736170} - c:\program files\hotspot shield\hssie\HssIE.dll
TB: Mob Wars Toolbar: {6857857c-15d3-435d-af19-e0217298b416} - c:\program files\mob wars toolbar\Toolbar.dll
TB: {719D74AB-1AF9-43A1-8C62-D8750628D93E} - No File
TB: {2787EA8E-8D87-48AF-88AD-B30246C917AB} - No File
TB: {D1A1FD57-93FC-45FE-BC2A-B3A5D47D6674} - No File
uRun: [DAEMON Tools Lite] "c:\program files\daemon\daemon.exe" -autorun
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [Logitech Utility] Logi_MwX.Exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [ZoneAlarm Client] "c:\program files\zonealarm\zlclient.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [dvd43] c:\program files\dvd43\dvd43_tray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\firefox.lnk - c:\program files\firefox\firefox.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\keytext.lnk - c:\program files\keytext\KeyText.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\rsiguard.lnk - c:\program files\rsiguard\RSIGuard.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\zoneal~1.lnk - c:\program files\zonealarm\zlclient.exe
uPolicies-explorer: NoLogoff = 01000000
uPolicies-explorer: NoRecentDocsNetHood = 01000000
uPolicies-explorer: NoSMMyDocs = 01000000
uPolicies-explorer: NoSMMyPictures = 01000000
uPolicies-explorer: NoNetworkConnections = 01000000
IE: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZUfox000
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-latest.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\atheist\applic~1\mozilla\firefox\profiles\de6b8akp.default\
FF - prefs.js: browser.search.selectedEngine - Answers.com
FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com
FF - prefs.js: keyword.URL - hxxp://search.freecause.com/search?fr=freecause&ourmark=3&type=58757&p=
FF - component: c:\documents and settings\atheist\application data\mozilla\firefox\profiles\de6b8akp.default\extensions\{18b8f08d-62fe-4dfc-ad6c-9ce46515d5ec}\components\Engine.dll
FF - plugin: c:\documents and settings\atheist\application data\mozilla\firefox\profiles\de6b8akp.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071303000006.dll
FF - plugin: c:\program files\firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
---- FIREFOX POLICIES ----
c:\program files\firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
============= SERVICES / DRIVERS ===============
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-6-5 335240]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-6-5 27784]
R1 mozyFilter;mozyFilter;c:\windows\system32\drivers\mozy.sys [2009-2-7 54776]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2009-1-30 353672]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avgwdsvc.exe [2008-6-5 297752]
R2 HssSrv;Hotspot Shield Routing Service;c:\program files\hotspot shield\hsswpr\hsssrv.exe [2009-8-6 331824]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-7-4 24652]
R3 HssDrv;Hotspot Shield Helper Miniport;c:\windows\system32\drivers\hssdrv.sys [2009-5-20 33840]
R3 tap0901;TAP-Win32 Adapter V9;c:\windows\system32\drivers\tap0901.sys [2009-7-21 28592]
S2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2008-6-21 13352]
S3 HssTrayService;Hotspot Shield Tray Service;c:\program files\hotspot shield\bin\HssTrayService.exe [2009-8-10 57640]
S3 IntuitUpdateService;Intuit Update Service;c:\program files\common files\intuit\update service\IntuitUpdateService.exe [2008-12-9 13088]
S3 s125bus;Sony Ericsson Device 125 driver (WDM);c:\windows\system32\drivers\s125bus.sys [2007-4-24 83336]
S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter;c:\windows\system32\drivers\s125mdfl.sys [2007-4-24 15112]
S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver;c:\windows\system32\drivers\s125mdm.sys [2007-4-24 108680]
S3 s125mgmt;Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s125mgmt.sys [2007-4-24 100488]
S3 s125obex;Sony Ericsson Device 125 USB WMC OBEX Interface;c:\windows\system32\drivers\s125obex.sys [2007-4-24 98696]
S3 tap0801;TAP-Win32 Adapter V8;c:\windows\system32\drivers\tap0801.sys [2006-10-1 26624]
============== File Associations ===============
chm.file="hh.exe" %1
txtfile=c:\windows\notepad.exe %1
=============== Created Last 30 ================
2009-08-30 13:18 <DIR> --d----- c:\windows\system32\dllcache\cache
2009-08-30 13:14 <DIR> a-dshr-- C:\cmdcons
2009-08-30 13:13 229,376 a------- c:\windows\PEV.exe
2009-08-30 13:13 161,792 a------- c:\windows\SWREG.exe
2009-08-30 13:13 98,816 a------- c:\windows\sed.exe
2009-08-30 13:12 <DIR> --ds---- C:\ComboFix
2009-08-27 23:35 <DIR> --d----- C:\Hotspot Shield
2009-08-27 23:34 <DIR> --d----- c:\program files\Hotspot Shield
2009-08-20 19:44 <DIR> --d----- c:\program files\Amazon
2009-08-13 09:22 128,512 -------- c:\windows\system32\dllcache\dhtmled.ocx
2009-08-13 09:22 1,315,328 -------- c:\windows\system32\dllcache\msoe.dll
2009-08-12 11:50 <DIR> --d----- c:\docume~1\alluse~1\applic~1\TVU Networks
2009-08-11 15:21 <DIR> --d----- c:\program files\WMV9_VCM
2009-08-11 15:21 162,168 a------- c:\windows\Screen Recorder Uninstaller.exe
2009-08-11 15:21 <DIR> --d----- c:\program files\Screen Recorder
2009-08-11 15:21 <DIR> --d----- c:\program files\common files\River Past
2009-08-11 15:21 <DIR> --d----- c:\docume~1\atheist\applic~1\River Past G5
2009-08-11 15:21 <DIR> --d----- c:\docume~1\alluse~1\applic~1\River Past G5
2009-08-10 21:59 <DIR> --d----- c:\program files\uTorrent
2009-08-10 21:58 <DIR> --d----- c:\docume~1\atheist\applic~1\uTorrent
2009-08-09 17:00 <DIR> --d----- c:\docume~1\atheist\applic~1\tor
2009-08-09 10:36 <DIR> --d----- c:\program files\Tor Browser
2009-08-08 22:13 18,816 a------- c:\windows\system32\drivers\dvd43llh.sys
2009-08-08 22:13 <DIR> --d----- c:\program files\dvd43
2009-08-05 05:01 204,800 -------- c:\windows\system32\dllcache\mswebdvd.dll
==================== Find3M ====================
2009-08-28 09:42 335,240 a------- c:\windows\system32\drivers\avgldx86.sys
2009-08-28 09:42 11,952 a------- c:\windows\system32\avgrsstx.dll
2009-08-05 05:01 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-07-25 05:23 411,368 a------- c:\windows\system32\deploytk.dll
2009-07-22 15:13 28,592 a------- c:\windows\system32\drivers\tap0901.sys
2009-07-19 18:48 11,067,392 a------- c:\windows\system32\dllcache\ieframe.dll
2009-07-19 09:18 5,937,152 a------- c:\windows\system32\dllcache\mshtml.dll
2009-07-19 09:18 5,937,152 a------- c:\windows\system32\dllcache\cache\mshtml.dll
2009-07-17 15:01 58,880 a------- c:\windows\system32\atl.dll
2009-07-17 15:01 58,880 -------- c:\windows\system32\dllcache\atl.dll
2009-07-13 23:43 286,208 a------- c:\windows\system32\wmpdxm.dll
2009-07-13 23:43 10,841,088 -------- c:\windows\system32\dllcache\wmp.dll
2009-07-13 23:43 286,208 -------- c:\windows\system32\dllcache\wmpdxm.dll
2009-07-03 07:01 173,056 a------- c:\windows\system32\dllcache\ie4uinit.exe
2009-06-25 04:25 730,112 a------- c:\windows\system32\lsasrv.dll
2009-06-25 04:25 301,568 a------- c:\windows\system32\kerberos.dll
2009-06-25 04:25 147,456 a------- c:\windows\system32\schannel.dll
2009-06-25 04:25 136,192 a------- c:\windows\system32\msv1_0.dll
2009-06-25 04:25 56,832 a------- c:\windows\system32\secur32.dll
2009-06-25 04:25 54,272 a------- c:\windows\system32\wdigest.dll
2009-06-25 04:25 730,112 -------- c:\windows\system32\dllcache\lsasrv.dll
2009-06-25 04:25 301,568 -------- c:\windows\system32\dllcache\kerberos.dll
2009-06-25 04:25 147,456 -------- c:\windows\system32\dllcache\schannel.dll
2009-06-25 04:25 136,192 -------- c:\windows\system32\dllcache\msv1_0.dll
2009-06-25 04:25 56,832 -------- c:\windows\system32\dllcache\secur32.dll
2009-06-25 04:25 54,272 -------- c:\windows\system32\dllcache\wdigest.dll
2009-06-24 07:18 92,928 -------- c:\windows\system32\dllcache\ksecdd.sys
2009-06-16 10:36 119,808 a------- c:\windows\system32\t2embed.dll
2009-06-16 10:36 81,920 a------- c:\windows\system32\fontsub.dll
2009-06-16 10:36 119,808 -------- c:\windows\system32\dllcache\t2embed.dll
2009-06-16 10:36 81,920 -------- c:\windows\system32\dllcache\fontsub.dll
2009-06-12 08:31 76,288 a------- c:\windows\system32\telnet.exe
2009-06-12 08:31 76,288 -------- c:\windows\system32\dllcache\telnet.exe
2009-06-10 10:13 84,992 a------- c:\windows\system32\avifil32.dll
2009-06-10 10:13 84,992 -------- c:\windows\system32\dllcache\avifil32.dll
2009-06-10 09:19 2,066,432 a------- c:\windows\system32\mstscax.dll
2009-06-10 09:19 2,066,432 -------- c:\windows\system32\dllcache\mstscax.dll
2009-06-10 02:14 132,096 a------- c:\windows\system32\wkssvc.dll
2009-06-10 02:14 132,096 -------- c:\windows\system32\dllcache\wkssvc.dll
2009-06-03 15:09 1,291,264 a------- c:\windows\system32\quartz.dll
2009-06-03 15:09 1,291,264 -------- c:\windows\system32\dllcache\quartz.dll
2009-06-02 06:12 102,912 a------- c:\windows\system32\dllcache\iecompat.dll
2007-02-16 11:31 227,328 a------- c:\program files\mpTrim.exe
2008-06-27 23:13 4,184 a--sh--- c:\windows\system32\KGyGaAvL.sys
============= FINISH: 13:25:02.87 ===============
clamenza
2009-08-30, 19:27
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-07-30.01)
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 6/3/2008 7:23:26 AM
System Uptime: 8/27/2009 12:19:25 AM (85 hours ago)
Motherboard: Dell Inc. | | 0CU409
Processor: Intel(R) Core(TM)2 Duo CPU E6550 @ 2.33GHz | Socket 775 | 2327/333mhz
==== Disk Partitions =========================
C: is FIXED (NTFS) - 125 GiB total, 40.935 GiB free.
D: is CDROM ()
==== Disabled Device Manager Items =============
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: TAP-Win32 Adapter V8
Device ID: ROOT\NET\0000
Manufacturer: TAP-Win32 Provider
Name: TAP-Win32 Adapter V8
PNP Device ID: ROOT\NET\0000
Service: tap0801
==== System Restore Points ===================
RP398: 7/29/2009 9:36:21 AM - Software Distribution Service 3.0
RP399: 7/30/2009 3:12:20 PM - System Checkpoint
RP400: 8/1/2009 12:11:52 AM - Removed Live Search Club Toolbar
RP401: 8/2/2009 10:32:34 AM - System Checkpoint
RP402: 8/3/2009 1:08:44 PM - System Checkpoint
RP403: 8/4/2009 3:51:09 PM - System Checkpoint
RP404: 8/4/2009 9:48:02 PM - Installed Java(TM) 6 Update 15
RP405: 8/6/2009 11:06:03 AM - System Checkpoint
RP406: 8/7/2009 7:43:49 PM - System Checkpoint
RP407: 8/8/2009 2:12:30 PM - Installed MozyHome Remote Backup
RP408: 8/10/2009 11:42:53 AM - System Checkpoint
RP409: 8/11/2009 1:53:50 PM - System Checkpoint
RP410: 8/13/2009 9:24:16 AM - Software Distribution Service 3.0
RP411: 8/14/2009 6:39:56 PM - System Checkpoint
RP412: 8/15/2009 7:50:46 PM - System Checkpoint
RP413: 8/17/2009 12:08:49 AM - System Checkpoint
RP414: 8/19/2009 4:26:07 PM - System Checkpoint
RP415: 8/21/2009 11:32:19 AM - System Checkpoint
RP416: 8/22/2009 3:38:19 PM - System Checkpoint
RP417: 8/23/2009 4:48:33 PM - System Checkpoint
RP418: 8/24/2009 5:13:47 PM - System Checkpoint
RP419: 8/24/2009 11:14:33 PM - Removed Nero 8 Ultra Edition HD
RP420: 8/26/2009 9:54:05 AM - Software Distribution Service 3.0
RP421: 8/27/2009 11:03:08 AM - System Checkpoint
RP422: 8/28/2009 12:55:13 PM - System Checkpoint
RP423: 8/30/2009 1:13:36 PM - ComboFix created restore point
==== Installed Programs ======================
µTorrent
7-Zip 4.65
Adobe Digital Editions
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.6
Adobe Shockwave Player 11.5
Amazon MP3 Downloader 1.0.5
AnswerWorks 5.0 English Runtime
Audacity 1.2.6
AVG Free 8.5
AVIcodec (remove only)
Chinese Simplified Fonts Support For Adobe Reader 8
Coupon Printer for Windows
Critical Update for Windows Media Player 11 (KB959772)
DVD Shrink 3.2
DVD43 v4.4.1
Eraser
FLVPlayer4Free Free FLV Player 2.8.0.0
High Definition Audio Driver Package - KB835221
Hooked on Phonics Learn to Read
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB970653-v3)
Hotspot Shield 1.22
ImgBurn
Intel(R) Graphics Media Accelerator Driver
Intel(R) PRO Network Connections 12.1.8.0
IrfanView (remove only)
Java(TM) 6 Update 15
KeyText v2.25
Logitech MouseWare 9.79.1
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft National Language Support Downlevel APIs
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Software Update for Web Folders (English) 12
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Windows Media Video 9 VCM
MIKSOFT Mobile AMR converter
Mob Wars Toolbar
Mozilla Firefox (3.5.2)
MozyHome Remote Backup
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 6.0 Parser (KB933579)
Need for Speed™ ProStreet Demo
neroxml
NoteTab Light 5 (Remove only)
OpenVPN 2.0.9
PDFCreator
PowerDVD
River Past Screen Recorder
RSIGuard Stretch Edition
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB969679)
Security Update for Microsoft Office Excel 2007 (KB969682)
Security Update for Microsoft Office Publisher 2007 (KB969693)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office Word 2007 (KB969604)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Spybot - Search & Destroy
TurboTax 2008
TurboTax 2008 WinPerFedFormset
TurboTax 2008 WinPerProgramHelp
TurboTax 2008 WinPerReleaseEngine
TurboTax 2008 WinPerTaxSupport
TurboTax 2008 WinPerUserEducation
TurboTax 2008 wnyiper
TurboTax 2008 wrapper
TVUPlayer 2.4.7.2
Tweak UI
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office PowerPoint 2007 Help (KB957247)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Windows Internet Explorer 8 (KB971180)
Update for Windows Internet Explorer 8 (KB971930)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951618-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973815)
VC 9.0 Runtime
Viewpoint Media Player
VLC media player 1.0.1
WebFldrs XP
Windows Genuine Advantage Validation Tool (KB892130)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live installer
Windows Media Format 11 runtime
Windows Media Player 11
Windows Search 4.0
Windows XP Service Pack 3
WinISO 5.3
WinRAR archiver
ZoneAlarm
==== Event Viewer Messages From Past Week ========
8/30/2009 12:07:20 AM, error: Dhcp [1002] - The IP address lease 10.11.19.63 for the Network Card with network address 00FF636CE4BA has been denied by the DHCP server 10.10.63.254 (The DHCP Server sent a DHCPNACK message).
8/30/2009 12:04:30 AM, error: Dhcp [1002] - The IP address lease 10.17.95.140 for the Network Card with network address 00FF636CE4BA has been denied by the DHCP server 10.11.31.254 (The DHCP Server sent a DHCPNACK message).
8/30/2009 1:14:49 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the PEVSystemStart service to connect.
8/29/2009 4:17:20 PM, error: Dhcp [1002] - The IP address lease 10.10.35.234 for the Network Card with network address 00FF636CE4BA has been denied by the DHCP server 10.17.95.254 (The DHCP Server sent a DHCPNACK message).
8/29/2009 12:14:07 AM, error: Dhcp [1002] - The IP address lease 10.13.28.151 for the Network Card with network address 00FF636CE4BA has been denied by the DHCP server 10.10.47.254 (The DHCP Server sent a DHCPNACK message).
8/29/2009 12:08:27 AM, error: Dhcp [1002] - The IP address lease 10.20.116.218 for the Network Card with network address 00FF636CE4BA has been denied by the DHCP server 10.13.31.254 (The DHCP Server sent a DHCPNACK message).
8/29/2009 12:02:07 AM, error: Dhcp [1002] - The IP address lease 10.6.114.185 for the Network Card with network address 00FF636CE4BA has been denied by the DHCP server 10.20.127.254 (The DHCP Server sent a DHCPNACK message).
8/28/2009 3:51:01 PM, error: Dhcp [1002] - The IP address lease 10.8.96.13 for the Network Card with network address 00FF636CE4BA has been denied by the DHCP server 10.6.127.254 (The DHCP Server sent a DHCPNACK message).
8/24/2009 7:13:26 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service upnphost with arguments "" in order to run the server: {204810B9-73B2-11D4-BF42-00B0D0118B56}
8/24/2009 11:15:26 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
==== End Of File ===========================
IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.
µTorrent
Tor Browser
I'd like you to read this thread (http://forums.spybot.info/showthread.php?t=282).
Please go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red).
I'm really doubtful about the deletions...
Any specific reason for that statement?
clamenza
2009-08-30, 20:22
c:\windows\COUPON~1.OCX
c:\windows\CouponPrinter.ocx
c:\windows\desktop\Hooked on Phonics Learn to Read.lnk
Hi again,
Those coupon printer things are a bit dubious and location of the third file is not normal. We can dequarantine those though.
Open notepad and copy/paste the text in the quotebox below into it:
DeQuarantine::
c:\Qoobox\Quarantine\c\windows\COUPON~1.OCX.vir
c:\Qoobox\Quarantine\c\windows\CouponPrinter.ocx.vir
c:\Qoobox\Quarantine\c\windows\desktop\Hooked on Phonics Learn to Read.lnk.vir
Folder::
c:\program files\uTorrent
c:\documents and settings\Atheist\Application Data\uTorrent
c:\documents and settings\Atheist\Application Data\tor
c:\program files\Tor Browser
c:\program files\Vuze
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=-
DDS::
uURLSearchHooks: H - No File
TB: {719D74AB-1AF9-43A1-8C62-D8750628D93E} - No File
TB: {2787EA8E-8D87-48AF-88AD-B30246C917AB} - No File
TB: {D1A1FD57-93FC-45FE-BC2A-B3A5D47D6674} - No File
IE: &Search - http://edits.mywebsearch.com/toolbar...tml?p=ZUfox000
Save this as
CFScript
A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.
Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.
Check here (http://www.adobe.com/software/flash/about/) to see if your Flash is up-to-date (do it separately with each of your browsers). If not, uninstall vulnerable versions by following instructions here (http://kb2.adobe.com/cps/141/tn_14157.html). Fresh version can be obtained here (http://get.adobe.com/flashplayer/).
Download ATF (Atribune Temp File) Cleaner© by Atribune (http://www.atribune.org/ccount/click.php?id=1) to your desktop.
Double-click ATF Cleaner.exe to open it
Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.
If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
Click Exit on the Main menu to close the program.
Please run an online scan with Kaspersky Online Scanner (http://www.kaspersky.com/virusscanner) as instructed in the screenshot here (http://i275.photobucket.com/albums/jj285/Bleeping/KAS/KAS9.gif).
Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log.
clamenza
2009-08-30, 22:54
I understand your concerns. I just don't download things I don't understand, including on P2P which I hardly use. I installed the coupon printer from KFC's website (that grilled chicken deal made famous by Oprah), while I placed the shortcut on the desktop intentionally.
Anyway, I'll get the logs up.
clamenza
2009-08-30, 23:14
ComboFix 09-08-30.01 - Atheist 08/30/2009 16:59.2.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2037.1325 [GMT -4:00]
Running from: c:\documents and settings\Atheist\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Atheist\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Atheist\Application Data\tor
c:\documents and settings\Atheist\Application Data\tor\cached-certs
c:\documents and settings\Atheist\Application Data\tor\cached-consensus
c:\documents and settings\Atheist\Application Data\tor\cached-descriptors
c:\documents and settings\Atheist\Application Data\tor\cached-descriptors.new
c:\documents and settings\Atheist\Application Data\tor\lock
c:\documents and settings\Atheist\Application Data\tor\state
c:\documents and settings\Atheist\Application Data\uTorrent
c:\documents and settings\Atheist\Application Data\uTorrent\dht.dat
c:\documents and settings\Atheist\Application Data\uTorrent\dht.dat.old
c:\documents and settings\Atheist\Application Data\uTorrent\resume.dat
c:\documents and settings\Atheist\Application Data\uTorrent\resume.dat.old
c:\documents and settings\Atheist\Application Data\uTorrent\rss.dat
c:\documents and settings\Atheist\Application Data\uTorrent\rss.dat.old
c:\documents and settings\Atheist\Application Data\uTorrent\settings.dat
c:\documents and settings\Atheist\Application Data\uTorrent\settings.dat.old
c:\program files\Tor Browser
c:\program files\Tor Browser\App\libeay32.dll
c:\program files\Tor Browser\App\libgnurx-0.dll
c:\program files\Tor Browser\App\mingwm10.dll
c:\program files\Tor Browser\App\polipo.exe
c:\program files\Tor Browser\App\QtCore4.dll
c:\program files\Tor Browser\App\QtGui4.dll
c:\program files\Tor Browser\App\QtNetwork4.dll
c:\program files\Tor Browser\App\QtXml4.dll
c:\program files\Tor Browser\App\ssleay32.dll
c:\program files\Tor Browser\App\tor-resolve.exe
c:\program files\Tor Browser\App\tor.exe
c:\program files\Tor Browser\App\vidalia.exe
c:\program files\Tor Browser\Data\Polipo\polipo.conf
c:\program files\Tor Browser\Data\Tor\cached-certs
c:\program files\Tor Browser\Data\Tor\cached-consensus
c:\program files\Tor Browser\Data\Tor\cached-descriptors
c:\program files\Tor Browser\Data\Tor\cached-descriptors.new
c:\program files\Tor Browser\Data\Tor\geoip
c:\program files\Tor Browser\Data\Tor\lock
c:\program files\Tor Browser\Data\Tor\state
c:\program files\Tor Browser\Data\Tor\torrc
c:\program files\Tor Browser\Data\Vidalia\geoip-cache
c:\program files\Tor Browser\Data\Vidalia\vidalia.conf
c:\program files\Tor Browser\Docs\MinGW\COPYING
c:\program files\Tor Browser\Docs\Polipo\COPYING
c:\program files\Tor Browser\Docs\Polipo\README
c:\program files\Tor Browser\Docs\Qt\LICENSE.GPL3
c:\program files\Tor Browser\Docs\Qt\LICENSE.LGPL
c:\program files\Tor Browser\Docs\README-TorBrowserBundle
c:\program files\Tor Browser\Docs\Tor\AUTHORS
c:\program files\Tor Browser\Docs\Tor\LICENSE
c:\program files\Tor Browser\Docs\Tor\README
c:\program files\Tor Browser\Docs\Vidalia\CREDITS
c:\program files\Tor Browser\Docs\Vidalia\LICENSE-GPLV2
c:\program files\Tor Browser\Docs\Vidalia\LICENSE-GPLV3
c:\program files\Tor Browser\Docs\Vidalia\LICENSE-LGPLV3
c:\program files\Tor Browser\Docs\Vidalia\LICENSE-OPENSSL
c:\program files\Tor Browser\Docs\Vidalia\LICENSE
c:\program files\Tor Browser\FirefoxPortable\App\AppInfo\appicon.ico
c:\program files\Tor Browser\FirefoxPortable\App\AppInfo\appicon_16.png
c:\program files\Tor Browser\FirefoxPortable\App\AppInfo\appicon_32.png
c:\program files\Tor Browser\FirefoxPortable\App\AppInfo\appinfo.ini
c:\program files\Tor Browser\FirefoxPortable\App\AppInfo\installer.ini
c:\program files\Tor Browser\FirefoxPortable\App\DefaultData\plugins\plugins_readme.txt
c:\program files\Tor Browser\FirefoxPortable\App\DefaultData\profile\bookmarks.html
c:\program files\Tor Browser\FirefoxPortable\App\DefaultData\profile\chrome\userChrome-example.css
c:\program files\Tor Browser\FirefoxPortable\App\DefaultData\profile\chrome\userContent-example.css
c:\program files\Tor Browser\FirefoxPortable\App\DefaultData\profile\localstore.rdf
c:\program files\Tor Browser\FirefoxPortable\App\DefaultData\profile\mimeTypes.rdf
c:\program files\Tor Browser\FirefoxPortable\App\DefaultData\profile\prefs.js
c:\program files\Tor Browser\FirefoxPortable\App\DefaultData\settings\FirefoxPortableSettings.ini
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\AccessibleMarshal.dll
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\application.ini
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\blocklist.xml
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\browserconfig.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\chrome\browser.jar
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\chrome\browser.manifest
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\chrome\classic.jar
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\chrome\classic.manifest
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\chrome\comm.jar
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\chrome\comm.manifest
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\chrome\en-US.jar
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\chrome\en-US.manifest
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\chrome\pippki.jar
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\chrome\pippki.manifest
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\chrome\reporter.jar
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\chrome\reporter.manifest
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\chrome\toolkit.jar
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\chrome\toolkit.manifest
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\aboutCertError.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\aboutPrivateBrowsing.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\aboutRights.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\aboutRobots.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\aboutSessionRestore.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\browser.xpt
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\browserdirprovider.dll
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\brwsrcmp.dll
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\FeedConverter.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\FeedProcessor.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\FeedWriter.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\fuelApplication.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\jsconsole-clhandler.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\NetworkGeolocationProvider.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsAddonRepository.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsBadCertHandler.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsBlocklistService.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsBrowserContentHandler.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsBrowserGlue.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsContentDispatchChooser.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsContentPrefService.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsDefaultCLH.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsDownloadManagerUI.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsExtensionManager.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsHandlerService.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsHelperAppDlg.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsLivemarkService.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsLoginInfo.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsLoginManager.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsLoginManagerPrompter.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsMicrosummaryService.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsPlacesDBFlush.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsPlacesTransactionsService.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsPostUpdateWin.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsPrivateBrowsingService.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsProxyAutoConfig.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsSafebrowsingApplication.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsSearchService.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsSearchSuggestions.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsSessionStartup.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsSessionStore.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsSetDefaultBrowser.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsSidebar.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsTaggingService.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsTryToClose.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsUpdateService.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsUrlClassifierLib.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsUrlClassifierListManager.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsURLFormatter.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\nsWebHandlerApp.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\pluginGlue.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\storage-Legacy.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\storage-mozStorage.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\txEXSLTRegExFunctions.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\components\WebContentConverter.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\crashreporter-override.ini
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\crashreporter.exe
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\crashreporter.ini
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\defaults\autoconfig\platform.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\defaults\autoconfig\prefcalls.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\defaults\pref\channel-prefs.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\defaults\pref\firefox-branding.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\defaults\pref\firefox-l10n.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\defaults\pref\firefox.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\defaults\pref\reporter.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\defaults\profile\bookmarks.html
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\defaults\profile\chrome\userChrome-example.css
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\defaults\profile\chrome\userContent-example.css
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\defaults\profile\localstore.rdf
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\defaults\profile\mimeTypes.rdf
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\defaults\profile\prefs.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\dictionaries\en-US.aff
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\dictionaries\en-US.dic
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\install.rdf
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\CHANGELOG
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome.manifest
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome.manifest.jar
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome.manifest.nojar
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\content\about.xul
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\content\contents.rdf
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\content\jshooks.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\content\popup.xul
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\content\pref-connection-info.xul
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\content\pref-connection.xul
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\content\preferences.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\content\preferences.xul
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\content\torbutton.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\content\torbutton.xul
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\content\torbutton_tb.xul
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\content\torbutton_util.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\af\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\af\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\ar\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\ar\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\bg\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\bg\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\bms\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\bms\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\bo\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\bo\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\ca\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\ca\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\cs\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\cs\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\da\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\da\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\de\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\de\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\el\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\el\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\en\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\en\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\es\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\es\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\eu\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\eu\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\fa\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\fa\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\fi\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\fi\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\fr\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\fr\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\fur\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\fur\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\gl\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\gl\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\gu\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\gu\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\he\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\he\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\hi\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\hi\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\hr\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\hr\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\hu\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\hu\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\id\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\id\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\is\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\is\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\it\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\it\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\ja\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\ja\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\ka\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\ka\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\km\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\km\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\ko\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\ko\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\ku\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\ku\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\mt\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\mt\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\nb\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\nb\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\nl\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\nl\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\pa\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\pa\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\pl\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\pl\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\pt-BR\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\pt-BR\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\pt\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\pt\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\ro\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\ro\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\ru\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\ru\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\sl\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\sl\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\sq\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\sq\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\sv\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\sv\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\sw\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\sw\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\th\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\th\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\tr\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\tr\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\uk\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\uk\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\vi\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\vi\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\zh-CN\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\zh-CN\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\zh-HK\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\zh-HK\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\zh-TW\torbutton.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\locale\zh-TW\torbutton.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\skin\contents.rdf
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\skin\p.png
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\skin\poff.png
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\skin\punknown.png
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\skin\tor-16.png
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\skin\tor-24.png
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\skin\tor-disabled-16.png
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\skin\tor-disabled-24.png
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\skin\tor-enabled-16.png
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\skin\tor-enabled-24.png
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\skin\tor.png
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome\skin\torbutton.css
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\components\certDialogsOverride.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\components\cookie-jar-selector.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\components\crash-observer.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\components\cssblocker.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\components\ignore-history.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\components\nsSessionStore2.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\components\nsSessionStore3.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\components\torbutton-logger.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\components\window-mapper.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\CREDITS
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\defaults\preferences\preferences.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\install.rdf
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\LICENSE
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\freebl3.chk
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\freebl3.dll
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\greprefs\all.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\greprefs\security-prefs.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\greprefs\xpinstall.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\js3250.dll
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\LICENSE
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\modules\debug.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\modules\distribution.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\modules\DownloadLastDir.jsm
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\modules\DownloadUtils.jsm
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\modules\ISO8601DateUtils.jsm
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\modules\JSON.jsm
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\modules\Microformats.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\modules\PlacesDBUtils.jsm
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\modules\PluralForm.jsm
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\modules\SpatialNavigation.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\modules\utils.js
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\modules\WindowDraggingUtils.jsm
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\modules\XPCOMUtils.jsm
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\mozcrt19.dll
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\nspr4.dll
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\nss3.dll
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\nssckbi.dll
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\nssdbm3.dll
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\nssutil3.dll
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\old-homepage-default.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\platform.ini
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\plc4.dll
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\plds4.dll
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\plugins\npnul32.dll
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\README.txt
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\arrow.gif
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\arrowd.gif
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\broken-image.gif
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\charsetalias.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\charsetData.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\contenteditable.css
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\designmode.css
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\dtd\mathml.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\dtd\xhtml11.dtd
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\EditorOverride.css
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\entityTables\html40Latin1.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\entityTables\html40Special.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\entityTables\html40Symbols.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\entityTables\htmlEntityVersions.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\entityTables\mathml20.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\entityTables\transliterate.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\fonts\mathfont.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\fonts\mathfontStandardSymbolsL.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\fonts\mathfontSTIXNonUnicode.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\fonts\mathfontSTIXSize1.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\fonts\mathfontSymbol.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\fonts\mathfontUnicode.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\forms.css
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\grabber.gif
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\hiddenWindow.html
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\html.css
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\html\folder.png
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\langGroups.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\language.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\loading-image.gif
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\mathml.css
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\quirk.css
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\svg.css
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\table-add-column-after-active.gif
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\table-add-column-after-hover.gif
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\table-add-column-after.gif
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\table-add-column-before-active.gif
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\table-add-column-before-hover.gif
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\table-add-column-before.gif
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\table-add-row-after-active.gif
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\table-add-row-after-hover.gif
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\table-add-row-after.gif
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\table-add-row-before-active.gif
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\table-add-row-before-hover.gif
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\table-add-row-before.gif
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\table-remove-column-active.gif
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\table-remove-column-hover.gif
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\table-remove-column.gif
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\table-remove-row-active.gif
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\table-remove-row-hover.gif
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\table-remove-row.gif
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\ua.css
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\viewsource.css
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\res\wincharset.properties
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\searchplugins\amazondotcom.xml
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\searchplugins\answers.xml
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\searchplugins\creativecommons.xml
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\searchplugins\eBay.xml
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\searchplugins\google.xml
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\searchplugins\wikipedia.xml
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\searchplugins\yahoo.xml
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\smime3.dll
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\softokn3.chk
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\softokn3.dll
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\sqlite3.dll
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\ssl3.dll
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\tbb-firefox.exe
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\uninstall\helper.exe
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\update.locale
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\updater.exe
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\updater.ini
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\xpcom.dll
c:\program files\Tor Browser\FirefoxPortable\App\Firefox\xul.dll
c:\program files\Tor Browser\FirefoxPortable\App\readme.txt
c:\program files\Tor Browser\FirefoxPortable\Data\plugins\plugins_readme.txt
c:\program files\Tor Browser\FirefoxPortable\Data\profile\blocklist.xml
c:\program files\Tor Browser\FirefoxPortable\Data\profile\bookmarkbackups\bookmarks-2009-08-23.json
c:\program files\Tor Browser\FirefoxPortable\Data\profile\bookmarkbackups\bookmarks-2009-08-24.json
c:\program files\Tor Browser\FirefoxPortable\Data\profile\bookmarkbackups\bookmarks-2009-08-26.json
c:\program files\Tor Browser\FirefoxPortable\Data\profile\bookmarkbackups\bookmarks-2009-08-27.json
c:\program files\Tor Browser\FirefoxPortable\Data\profile\bookmarkbackups\bookmarks-2009-08-29.json
c:\program files\Tor Browser\FirefoxPortable\Data\profile\bookmarks.html
c:\program files\Tor Browser\FirefoxPortable\Data\profile\cert8.db
c:\program files\Tor Browser\FirefoxPortable\Data\profile\chrome\userChrome-example.css
c:\program files\Tor Browser\FirefoxPortable\Data\profile\chrome\userContent-example.css
c:\program files\Tor Browser\FirefoxPortable\Data\profile\compatibility.ini
c:\program files\Tor Browser\FirefoxPortable\Data\profile\compreg.dat
c:\program files\Tor Browser\FirefoxPortable\Data\profile\content-prefs.sqlite
c:\program files\Tor Browser\FirefoxPortable\Data\profile\cookies.sqlite
c:\program files\Tor Browser\FirefoxPortable\Data\profile\downloads.sqlite
c:\program files\Tor Browser\FirefoxPortable\Data\profile\extensions.cache
c:\program files\Tor Browser\FirefoxPortable\Data\profile\extensions.ini
c:\program files\Tor Browser\FirefoxPortable\Data\profile\extensions.rdf
c:\program files\Tor Browser\FirefoxPortable\Data\profile\formhistory.sqlite
c:\program files\Tor Browser\FirefoxPortable\Data\profile\key3.db
c:\program files\Tor Browser\FirefoxPortable\Data\profile\localstore.rdf
c:\program files\Tor Browser\FirefoxPortable\Data\profile\mimeTypes.rdf
c:\program files\Tor Browser\FirefoxPortable\Data\profile\permissions.sqlite
c:\program files\Tor Browser\FirefoxPortable\Data\profile\places.sqlite-journal
c:\program files\Tor Browser\FirefoxPortable\Data\profile\places.sqlite
c:\program files\Tor Browser\FirefoxPortable\Data\profile\pluginreg.dat
c:\program files\Tor Browser\FirefoxPortable\Data\profile\prefs.js
c:\program files\Tor Browser\FirefoxPortable\Data\profile\search.sqlite
c:\program files\Tor Browser\FirefoxPortable\Data\profile\secmod.db
c:\program files\Tor Browser\FirefoxPortable\Data\profile\urlclassifier3.sqlite
c:\program files\Tor Browser\FirefoxPortable\Data\profile\webappsstore.sqlite
c:\program files\Tor Browser\FirefoxPortable\Data\profile\XPC.mfl
c:\program files\Tor Browser\FirefoxPortable\Data\profile\xpti.dat
c:\program files\Tor Browser\FirefoxPortable\Data\profile\XUL.mfl
c:\program files\Tor Browser\FirefoxPortable\Data\settings
c:\program files\Tor Browser\FirefoxPortable\FirefoxPortable.exe
c:\program files\Tor Browser\FirefoxPortable\FirefoxPortable.ini
c:\program files\Tor Browser\FirefoxPortable\help.html
c:\program files\Tor Browser\FirefoxPortable\Other\Help\images\donation_button.png
c:\program files\Tor Browser\FirefoxPortable\Other\Help\images\favicon.ico
c:\program files\Tor Browser\FirefoxPortable\Other\Help\images\help_background_footer.png
c:\program files\Tor Browser\FirefoxPortable\Other\Help\images\help_background_header.png
c:\program files\Tor Browser\FirefoxPortable\Other\Help\images\help_logo_top.png
c:\program files\Tor Browser\FirefoxPortable\Other\Source\AppSource.txt
c:\program files\Tor Browser\FirefoxPortable\Other\Source\FirefoxPortable.ini
c:\program files\Tor Browser\FirefoxPortable\Other\Source\FirefoxPortable.jpg
c:\program files\Tor Browser\FirefoxPortable\Other\Source\FirefoxPortable.nsi
c:\program files\Tor Browser\FirefoxPortable\Other\Source\License.txt
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comInstallerConfig.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherLANG_DUTCH.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherLANG_ENGLISH.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherLANG_FRENCH.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherLANG_GERMAN.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherLANG_HUNGARIAN.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherLANG_ITALIAN.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherLANG_JAPANESE.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherLANG_POLISH.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherLANG_PORTUGUESE.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherLANG_PORTUGUESEBR.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherLANG_RUSSIAN.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherLANG_SIMPCHINESE.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherLANG_SPANISH.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherLANG_SPANISHINTERNATIONAL.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherLANG_TRADCHINESE.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherOptionsForm.ini
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherOptionsLANG_DUTCH.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherOptionsLANG_ENGLISH.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherOptionsLANG_FRENCH.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherOptionsLANG_GERMAN.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherOptionsLANG_HUNGARIAN.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherOptionsLANG_ITALIAN.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherOptionsLANG_JAPANESE.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherOptionsLANG_POLISH.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherOptionsLANG_PORTUGUESE.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherOptionsLANG_PORTUGUESEBR.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherOptionsLANG_RUSSIAN.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherOptionsLANG_SIMPCHINESE.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherOptionsLANG_SPANISH.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherOptionsLANG_SPANISHINTERNATIONAL.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\PortableApps.comLauncherOptionsLANG_TRADCHINESE.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\ReadINIStrWithDefault.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\Readme.txt
c:\program files\Tor Browser\FirefoxPortable\Other\Source\ReplaceInFileWithTextReplace.nsh
c:\program files\Tor Browser\FirefoxPortable\Other\Source\SetFileAttributesDirectoryNormal.nsh
c:\program files\Tor Browser\PidginPortable\App\AppInfo\appicon.ico
c:\program files\Tor Browser\PidginPortable\App\AppInfo\appicon_16.png
c:\program files\Tor Browser\PidginPortable\App\AppInfo\appicon_32.png
c:\program files\Tor Browser\PidginPortable\App\AppInfo\appinfo.ini
c:\program files\Tor Browser\PidginPortable\App\AppInfo\installer.ini
c:\program files\Tor Browser\PidginPortable\App\aspell\aspell_readme.txt
c:\program files\Tor Browser\PidginPortable\App\DefaultData\settings\PidginPortableSettings.ini
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\asprintf.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\charset.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\freetype6.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\gdk-pixbuf-query-loaders.exe
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\gspawn-win32-helper-console.exe
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\gspawn-win32-helper.exe
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\gtk-query-immodules-2.0.exe
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\gtkthemeselector.exe
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\iconv.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\intl.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\jpeg62.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\libatk-1.0-0.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\libcairo-2.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\libexpat.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\libfontconfig-1.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\libgailutil-18.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\libgdk-win32-2.0-0.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\libgdk_pixbuf-2.0-0.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\libgio-2.0-0.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\libglib-2.0-0.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\libgmodule-2.0-0.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\libgobject-2.0-0.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\libgthread-2.0-0.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\libgtk-win32-2.0-0.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\libpango-1.0-0.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\libpangocairo-1.0-0.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\libpangoft2-1.0-0.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\libpangowin32-1.0-0.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\libpng12-0.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\libtiff3.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\pango-querymodules.exe
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\xmlparse.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\xmltok.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\bin\zlib1.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\COPYING.LIB-2
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.avail\10-autohint.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.avail\10-no-sub-pixel.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.avail\10-sub-pixel-bgr.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.avail\10-sub-pixel-rgb.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.avail\10-sub-pixel-vbgr.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.avail\10-sub-pixel-vrgb.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.avail\10-unhinted.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.avail\20-fix-globaladvance.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.avail\20-lohit-gujarati.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.avail\20-unhint-small-vera.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.avail\30-amt-aliases.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.avail\30-urw-aliases.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.avail\40-generic.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.avail\49-sansserif.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.avail\50-user.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.avail\51-local.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.avail\60-latin.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.avail\65-fonts-persian.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.avail\65-nonlatin.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.avail\69-unifont.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.avail\70-no-bitmaps.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.avail\70-yes-bitmaps.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.avail\80-delicious.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.avail\90-synthetic.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.avail\README
clamenza
2009-08-30, 23:15
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.d\20-fix-globaladvance.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.d\20-lohit-gujarati.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.d\20-unhint-small-vera.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.d\30-amt-aliases.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.d\30-urw-aliases.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.d\40-generic.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.d\49-sansserif.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.d\50-user.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.d\51-local.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.d\60-latin.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.d\65-fonts-persian.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.d\65-nonlatin.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.d\69-unifont.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.d\80-delicious.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\conf.d\90-synthetic.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\fonts.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\fonts\fonts.dtd
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\gtk-2.0\gdk-pixbuf.loaders
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\gtk-2.0\gtk.immodules
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\gtk-2.0\gtkrc
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\gtk-2.0\im-multipress.conf
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\pango\pango.aliases
c:\program files\Tor Browser\PidginPortable\App\GTK\etc\pango\pango.modules
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\charset.alias
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\engines\libbluecurve.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\engines\libclearlooks.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\engines\libcrux-engine.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\engines\libindustrial.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\engines\liblighthouseblue.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\engines\libmist.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\engines\libpixmap.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\engines\libthinice.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\engines\libwimp.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-ani.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-bmp.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-gif.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-icns.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-ico.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-jpeg.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-pcx.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-png.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-pnm.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-ras.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-tga.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-tiff.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-wbmp.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-xbm.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-xpm.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\lib\gtk-2.0\modules\libgail.dll
c:\program files\Tor Browser\PidginPortable\App\GTK\share\gtkthemeselector\pixmaps\gts.png
c:\program files\Tor Browser\PidginPortable\App\GTK\share\themes\Bluecurve\gtk-2.0\gtkrc
c:\program files\Tor Browser\PidginPortable\App\GTK\share\themes\Clearlooks\gtk-2.0\gtkrc
c:\program files\Tor Browser\PidginPortable\App\GTK\share\themes\Crux\gtk-2.0\gtkrc
c:\program files\Tor Browser\PidginPortable\App\GTK\share\themes\Default\gtk-2.0-key\gtkrc
c:\program files\Tor Browser\PidginPortable\App\GTK\share\themes\Emacs\gtk-2.0-key\gtkrc
c:\program files\Tor Browser\PidginPortable\App\GTK\share\themes\Industrial\gtk-2.0\gtkrc
c:\program files\Tor Browser\PidginPortable\App\GTK\share\themes\Lighthouseblue\gtk-2.0\gtkrc
c:\program files\Tor Browser\PidginPortable\App\GTK\share\themes\Mist\gtk-2.0\gtkrc
c:\program files\Tor Browser\PidginPortable\App\GTK\share\themes\MS-Windows\gtk-2.0\gtkrc
c:\program files\Tor Browser\PidginPortable\App\GTK\share\themes\Raleigh\gtk-2.0\gtkrc
c:\program files\Tor Browser\PidginPortable\App\GTK\share\themes\ThinIce\gtk-2.0\gtkrc
c:\program files\Tor Browser\PidginPortable\App\GTKLegacy\GTKLegacy_readme.txt
c:\program files\Tor Browser\PidginPortable\App\Pidgin\ca-certs\America_Online_Root_Certification_Authority_1.pem
c:\program files\Tor Browser\PidginPortable\App\Pidgin\ca-certs\AOL_Member_CA.pem
c:\program files\Tor Browser\PidginPortable\App\Pidgin\ca-certs\CAcert_Class3.pem
c:\program files\Tor Browser\PidginPortable\App\Pidgin\ca-certs\CAcert_Root.pem
c:\program files\Tor Browser\PidginPortable\App\Pidgin\ca-certs\Equifax_Secure_CA.pem
c:\program files\Tor Browser\PidginPortable\App\Pidgin\ca-certs\GTE_CyberTrust_Global_Root.pem
c:\program files\Tor Browser\PidginPortable\App\Pidgin\ca-certs\Microsoft_Internet_Authority.pem
c:\program files\Tor Browser\PidginPortable\App\Pidgin\ca-certs\Microsoft_Secure_Server_Authority.pem
c:\program files\Tor Browser\PidginPortable\App\Pidgin\ca-certs\StartCom_Free_SSL_CA.pem
c:\program files\Tor Browser\PidginPortable\App\Pidgin\ca-certs\VeriSign_Class_3_Public_Primary_Certification_Authority_-_G5.pem
c:\program files\Tor Browser\PidginPortable\App\Pidgin\ca-certs\Verisign_Class3_Primary_CA.pem
c:\program files\Tor Browser\PidginPortable\App\Pidgin\ca-certs\VeriSign_International_Server_Class_3_CA.pem
c:\program files\Tor Browser\PidginPortable\App\Pidgin\ca-certs\Verisign_RSA_Secure_Server_CA.pem
c:\program files\Tor Browser\PidginPortable\App\Pidgin\freebl3.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\idletrack.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\libgtkspell.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\libjabber.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\libmeanwhile-1.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\liboscar.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\libpurple.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\libsasl.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\libsilc-1-1-2.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\libsilcclient-1-1-2.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\libxml2.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\nspr4.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\nss3.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\nssckbi.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\perlmod\auto\Purple\autosplit.ix
c:\program files\Tor Browser\PidginPortable\App\Pidgin\perlmod\Pidgin.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\perlmod\Pidgin.pm
c:\program files\Tor Browser\PidginPortable\App\Pidgin\perlmod\Purple.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\perlmod\Purple.pm
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pidgin-portable.exe
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pidgin.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\connect0.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\connect1.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\connect2.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\connect3.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\connect4.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\connect5.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\connect6.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\connect7.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\connect8.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working0.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working1.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working10.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working11.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working12.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working13.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working14.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working15.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working16.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working17.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working18.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working19.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working2.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working20.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working21.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working22.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working23.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working24.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working25.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working26.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working27.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working28.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working29.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working3.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working30.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working4.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working5.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working6.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working7.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working8.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\process-working9.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\typing0.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\typing1.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\typing2.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\typing3.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\typing4.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\animations\16\typing5.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\arrow-down.xpm
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\arrow-left.xpm
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\arrow-right.xpm
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\arrow-up.xpm
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\buttons\edit.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\buttons\info.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\buttons\pause.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\dialogs\16\auth.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\dialogs\16\error.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\dialogs\16\info.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\dialogs\16\mail.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\dialogs\16\question.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\dialogs\64\auth.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\dialogs\64\cool.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\dialogs\64\dialog.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\dialogs\64\error.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\dialogs\64\info.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\dialogs\64\mail.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\dialogs\64\question.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\dialogs\64\warning.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emblems\16\aol-client.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emblems\16\birthday.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emblems\16\blocked.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emblems\16\bot.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emblems\16\external.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emblems\16\female.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emblems\16\founder.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emblems\16\free-for-chat.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emblems\16\game.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emblems\16\half-operator.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emblems\16\hiptop.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emblems\16\male.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emblems\16\mobile.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emblems\16\music.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emblems\16\not-authorized.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emblems\16\operator.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emblems\16\qq-member.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emblems\16\secure.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emblems\16\unavailable.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emblems\16\video.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emblems\16\voice.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\act-up.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\airplane.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\alien.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\angel.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\angry.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\arrogant.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\at-wits-end.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\bad.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\bashful.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\beat-up.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\beauty.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\beer.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\blowkiss.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\bomb.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\bowl.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\boy.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\brb.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\bulgy-eyes.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\bunny.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\bye.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\cake.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\call-me.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\camera.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\can.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\car.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\cat.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\chicken.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\cigarette.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\clap.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\clock.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\cloudy.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\clover.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\clown.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\coffee.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\coins.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\computer.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\confused.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\console.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\cow.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\cowboy.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\crying.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\curl-lip.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\curse.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\cute.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\cyclops.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\dance.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\dazed.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\desire.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\devil.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\disappointed.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\disdain.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\doctor.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\dog.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\doh.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\dont-know.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\drink.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\drool.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\eat.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\embarrassed.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\excruciating.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\eyeroll.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\female-fighter.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\film.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\fingers-crossed.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\flag.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\foot-in-mouth.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\freaked-out.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\ghost.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\giggle.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\girl.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\glasses-cool.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\glasses-nerdy.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\go-away.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\goat.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\good.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\hammer.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\handcuffs.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\handshake.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\highfive.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\hug-left.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\hug-right.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\hypnotized.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\in-love.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\island.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\jump.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\kiss.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\kissed.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\kissing.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\knife.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\lamp.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\lashes.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\laugh.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\liquor.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\loser.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\love-over.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\love.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\lying.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\mad-tongue.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\mail.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\male-fighter1.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\male-fighter2.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\mean.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\meeting.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\messed.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\mobile.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\mohawk.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\moneymouth.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\monkey.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\moon.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\msn-away.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\msn-busy.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\msn.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\msn_online.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\music.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\musical-note.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\nailbiting.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\neutral.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\on-the-phone.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\party.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\peace.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\phone.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\pig.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\pill.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\pirate.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\pissed-off.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\pizza.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\plate.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\poop.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\pray.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\present.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\pumpkin.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\qq.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\question.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\quiet.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\rain.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\rainbow.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\rose-dead.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\rose.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\rotfl.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\sad.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\sarcastic.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\search.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\secret.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\shame.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\sheep.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\shock.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\shout.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\shut-mouth.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\sick.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\sidefrown.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\silly.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\sinister.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\skeleton.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\skywalker.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\sleepy.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\smile-big.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\smile.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\smirk.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\snail.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\snicker.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\snowman.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\soccerball.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\soldier.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\star.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\starving.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\stop.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\struggle.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\sun.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\sweat.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\talktohand.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\teeth.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\terror.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\theme
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\thinking.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\thunder.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\time-out.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\tongue.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\tremble.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\turtle.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\tv.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\umbrella.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\vampire.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\victory.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\waiting.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\watermelon.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\waving.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\weep.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\wilt.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\wink.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\worship.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\yawn.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\default\yin-yang.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\none\theme
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\angel.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\angry.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\beer.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\camera.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\cigarette.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\coffee.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\confused.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\console.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\cool.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\cross.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\crying.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\devil.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\dont-know.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\grin.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\hug-left.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\hug-right.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\kiss.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\love.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\meeting.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\musical-note.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\nerdy.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\neutral.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\party.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\phone.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\plate.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\question.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\sad.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\shame.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\shock.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\sick.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\silent.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\sleepy.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\smile-big.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\smile.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\theme
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\thinking.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\tongue.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\tv.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\uhm-yeah.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\wink.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\emotes\small\yawn.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\logo.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\16\aim.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\16\bonjour.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\16\gadu-gadu.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\16\google-talk.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\16\icq.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\16\irc.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\16\jabber.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\16\meanwhile.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\16\msn.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\16\myspace.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\16\novell.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\16\qq.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\16\silc.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\16\simple.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\16\yahoo.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\16\zephyr.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\22\aim.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\22\bonjour.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\22\gadu-gadu.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\22\google-talk.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\22\icq.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\22\irc.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\22\jabber.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\22\meanwhile.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\22\msn.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\22\myspace.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\22\novell.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\22\qq.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\22\silc.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\22\simple.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\22\yahoo.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\22\zephyr.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\48\aim.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\48\bonjour.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\48\gadu-gadu.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\48\icq.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\48\irc.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\48\jabber.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\48\meanwhile.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\48\msn.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\48\myspace.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\48\novell.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\48\qq.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\48\silc.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\48\simple.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\48\yahoo.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\protocols\48\zephyr.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\11\available.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\11\away.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\11\busy.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\11\chat.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\11\extended-away.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\11\invisible.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\11\log-in.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\11\log-out.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\11\offline.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\11\person.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\11\rtl\extended-away.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\11\rtl\log-in.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\11\rtl\log-out.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\16\available.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\16\away.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\16\busy.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\16\chat.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\16\extended-away.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\16\invisible.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\16\log-in.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\16\log-out.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\16\offline.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\16\person.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\16\rtl\extended-away.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\16\rtl\log-in.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\16\rtl\log-out.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\22\available.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\22\away.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\22\busy.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\22\chat.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\22\extended-away.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\22\invisible.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\22\log-in.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\22\log-out.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\22\offline.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\22\person.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\22\rtl\extended-away.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\22\rtl\log-in.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\22\rtl\log-out.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\32\available.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\32\away.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\32\busy.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\32\chat.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\32\extended-away.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\32\invisible.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\32\log-in.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\32\log-out.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\32\offline.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\32\person.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\32\rtl\extended-away.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\32\rtl\log-in.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\32\rtl\log-out.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\48\available.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\48\away.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\48\busy.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\48\chat.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\48\extended-away.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\48\invisible.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\48\log-in.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\48\log-out.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\48\offline.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\48\person.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\48\rtl\extended-away.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\48\rtl\log-in.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\status\48\rtl\log-out.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\toolbar\16\change-bgcolor.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\toolbar\16\change-fgcolor.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\toolbar\16\emote-select.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\toolbar\16\font-face.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\toolbar\16\font-size-down.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\toolbar\16\font-size-up.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\toolbar\16\insert-image.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\toolbar\16\insert-link.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\toolbar\16\insert.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\toolbar\16\message-new.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\toolbar\16\plugins.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\toolbar\16\send-file.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\toolbar\16\transfer.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\toolbar\16\unblock.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\toolbar\22\select-avatar.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\16\available_4bit.ico
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\16\away_4bit.ico
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\16\busy_4bit.ico
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\16\connecting_4bit.ico
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\16\extended-away_4bit.ico
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\16\invisible_4bit.ico
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\16\message_4bit.ico
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\16\offline_4bit.ico
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\16\tray-away.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\16\tray-busy.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\16\tray-connecting.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\16\tray-extended-away.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\16\tray-invisible.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\16\tray-message.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\16\tray-new-im.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\16\tray-offline.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\16\tray-online.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\22\tray-away.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\22\tray-busy.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\22\tray-connecting.png
clamenza
2009-08-30, 23:16
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\22\tray-extended-away.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\22\tray-invisible.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\22\tray-message.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\22\tray-new-im.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\22\tray-offline.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\22\tray-online.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\32\tray-away.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\32\tray-busy.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\32\tray-connecting.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\32\tray-extended-away.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\32\tray-invisible.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\32\tray-new-im.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\32\tray-offline.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\32\tray-online.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\48\tray-away.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\48\tray-busy.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\48\tray-connecting.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\48\tray-extended-away.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\48\tray-invisible.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\48\tray-new-im.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\48\tray-offline.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\pixmaps\pidgin\tray\48\tray-online.png
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plc4.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plds4.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\autoaccept.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\buddynote.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\convcolors.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\extplacement.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\gtkbuddynote.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\history.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\iconaway.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\idle.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\joinpart.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\libaim.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\libbonjour.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\libgg.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\libicq.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\libirc.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\libmsn.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\libmyspace.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\libnovell.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\libqq.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\libsametime.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\libsilc.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\libsimple.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\libxmpp.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\libyahoo.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\log_reader.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\markerline.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\newline.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\notify.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\offlinemsg.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\perl.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\pidgin-otr-COPYING.txt
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\pidgin-otr-README.txt
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\pidgin-otr.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\pidginrc.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\psychic.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\relnot.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\sendbutton.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\spellchk.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\ssl-nss.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\ssl.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\statenotify.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\tcl.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\ticker.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\timestamp.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\timestamp_format.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\win2ktrans.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\winprefs.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\plugins\xmppconsole.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\sasl2\saslANONYMOUS.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\sasl2\saslCRAMMD5.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\sasl2\saslDIGESTMD5.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\sasl2\saslGSSAPI.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\sasl2\saslLOGIN.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\sasl2\saslPLAIN.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\smime3.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\softokn3.dll
c:\program files\Tor Browser\PidginPortable\App\Pidgin\sounds\purple\alert.wav
c:\program files\Tor Browser\PidginPortable\App\Pidgin\sounds\purple\login.wav
c:\program files\Tor Browser\PidginPortable\App\Pidgin\sounds\purple\logout.wav
c:\program files\Tor Browser\PidginPortable\App\Pidgin\sounds\purple\receive.wav
c:\program files\Tor Browser\PidginPortable\App\Pidgin\sounds\purple\send.wav
c:\program files\Tor Browser\PidginPortable\App\Pidgin\ssl3.dll
c:\program files\Tor Browser\PidginPortable\Data\settings\.purple\prefs.xml
c:\program files\Tor Browser\PidginPortable\Data\settings\.purple\status.xml
c:\program files\Tor Browser\PidginPortable\Data\settings\PidginPortableSettings.ini
c:\program files\Tor Browser\PidginPortable\help.html
c:\program files\Tor Browser\PidginPortable\Other\Help\images\donation_button.png
c:\program files\Tor Browser\PidginPortable\Other\Help\images\favicon.ico
c:\program files\Tor Browser\PidginPortable\Other\Help\images\help_background_footer.png
c:\program files\Tor Browser\PidginPortable\Other\Help\images\help_background_header.png
c:\program files\Tor Browser\PidginPortable\Other\Help\images\help_logo_top.png
c:\program files\Tor Browser\PidginPortable\Other\Source\AppSource.txt
c:\program files\Tor Browser\PidginPortable\Other\Source\GetWindowsVersion.nsh
c:\program files\Tor Browser\PidginPortable\Other\Source\License.txt
c:\program files\Tor Browser\PidginPortable\Other\Source\PidginPortable.ini
c:\program files\Tor Browser\PidginPortable\Other\Source\PidginPortable.jpg
c:\program files\Tor Browser\PidginPortable\Other\Source\PidginPortable.nsi
c:\program files\Tor Browser\PidginPortable\Other\Source\PortableApps.comInstaller.bmp
c:\program files\Tor Browser\PidginPortable\Other\Source\PortableApps.comInstallerConfig.nsh
c:\program files\Tor Browser\PidginPortable\Other\Source\PortableApps.comInstallerPlugin.nsi
c:\program files\Tor Browser\PidginPortable\Other\Source\PortableApps.comLauncherLANG_ENGLISH.nsh
c:\program files\Tor Browser\PidginPortable\Other\Source\ReadINIStrWithDefault.nsh
c:\program files\Tor Browser\PidginPortable\Other\Source\Readme.txt
c:\program files\Tor Browser\PidginPortable\Other\Source\ReplaceInFileWithTextReplace.nsh
c:\program files\Tor Browser\PidginPortable\PidginPortable.exe
c:\program files\Tor Browser\PidginPortable\PidginPortable.ini
c:\program files\Tor Browser\Start Tor Browser.exe
c:\program files\uTorrent
c:\program files\uTorrent\uTorrent.exe
c:\program files\Vuze
c:\program files\Vuze\plugins\AutoShutdown\AutoShutDownProj.jar
c:\program files\Vuze\plugins\AutoShutdown\delphi_shut.exe
c:\program files\Vuze\plugins\azemp\azemp_2.0.30.jar
c:\program files\Vuze\plugins\azemp\azemp_2.0.30.zip
c:\program files\Vuze\plugins\azemp\azemp_2.0.32.jar
c:\program files\Vuze\plugins\azemp\azemp_2.0.32.zip
c:\program files\Vuze\plugins\azemp\azemp_2.0.34.jar
c:\program files\Vuze\plugins\azemp\azemp_2.0.34.zip
c:\program files\Vuze\plugins\azemp\azemp_2.1.02.jar
c:\program files\Vuze\plugins\azemp\azemp_2.1.02.zip
c:\program files\Vuze\plugins\azemp\azmplay.exe.bak
c:\program files\Vuze\plugins\azemp\cp1250-a.raw.bak
c:\program files\Vuze\plugins\azemp\cp1250-b.raw.bak
c:\program files\Vuze\plugins\azemp\font.desc.bak
c:\program files\Vuze\plugins\azemp\osd-mplayer-a.raw.bak
c:\program files\Vuze\plugins\azemp\osd-mplayer-b.raw.bak
c:\program files\Vuze\plugins\azemp\plugin.properties_2.0.30
c:\program files\Vuze\plugins\azemp\plugin.properties_2.0.32
c:\program files\Vuze\plugins\azemp\plugin.properties_2.0.34
c:\program files\Vuze\plugins\azemp\plugin.properties_2.1.02
c:\program files\Vuze\plugins\azupnpav\azupnpav_0.2.17.jar
c:\program files\Vuze\plugins\azupnpav\azupnpav_0.2.17.zip
c:\program files\Vuze\plugins\azupnpav\azupnpav_0.2.21.jar
c:\program files\Vuze\plugins\azupnpav\azupnpav_0.2.21.zip
c:\program files\Vuze\plugins\azupnpav\azupnpav_0.2.5.jar
c:\program files\Vuze\plugins\azupnpav\azupnpav_0.2.5.zip
c:\program files\Vuze\plugins\azupnpav\plugin.properties_0.2.17
c:\program files\Vuze\plugins\azupnpav\plugin.properties_0.2.21
c:\program files\Vuze\plugins\azupnpav\plugin.properties_0.2.5
c:\windows\COUPON~1.OCX
c:\windows\desktop
c:\windows\desktop\Hooked on Phonics Learn to Read.lnk
.
((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-30 )))))))))))))))))))))))))))))))
.
2009-08-28 03:35 . 2009-08-28 03:35 -------- d-----w- C:\Hotspot Shield
2009-08-28 03:34 . 2009-08-28 03:35 -------- d-----w- c:\program files\Hotspot Shield
2009-08-26 13:54 . 2009-08-28 03:34 -------- d-----w- c:\windows\LastGood
2009-08-25 01:41 . 2009-08-25 01:43 -------- d-----w- c:\documents and settings\Atheist\Application Data\ImgBurn
2009-08-25 01:38 . 2009-08-25 01:38 -------- d-----w- c:\program files\ImgBurn
2009-08-24 01:00 . 2009-08-24 01:00 -------- d-----w- c:\program files\7-Zip
2009-08-20 23:44 . 2009-08-20 23:44 -------- d-----w- c:\documents and settings\Atheist\Application Data\Amazon
2009-08-20 23:44 . 2009-08-20 23:44 -------- d-----w- c:\program files\Amazon
2009-08-14 21:50 . 2009-08-14 21:50 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-08-13 13:22 . 2009-07-10 13:27 1315328 ------w- c:\windows\system32\dllcache\msoe.dll
2009-08-12 15:50 . 2009-08-12 15:50 -------- d-----w- c:\documents and settings\All Users\Application Data\TVU Networks
2009-08-12 13:58 . 2009-08-12 14:00 5519752 ----a-w- c:\documents and settings\Atheist\Application Data\TVU Networks\TVU AutoUpgrade\TVUPlayer2.4.7.2.exe
2009-08-11 19:21 . 2009-08-11 19:21 -------- d-----w- c:\program files\WMV9_VCM
2009-08-11 19:21 . 2009-08-11 19:23 -------- d-----w- c:\documents and settings\All Users\Application Data\River Past G5
2009-08-11 19:21 . 2009-08-11 19:21 162168 ----a-w- c:\windows\Screen Recorder Uninstaller.exe
2009-08-11 19:21 . 2009-08-11 19:21 -------- d-----w- c:\program files\Screen Recorder
2009-08-11 19:21 . 2009-08-11 19:21 -------- d-----w- c:\program files\Common Files\River Past
2009-08-11 19:21 . 2009-08-11 19:21 -------- d-----w- c:\documents and settings\Atheist\Application Data\River Past G5
2009-08-09 21:00 . 2009-08-10 00:43 -------- d-----w- c:\documents and settings\Atheist\Application Data\Vidalia
2009-08-09 02:13 . 2009-08-09 02:13 18816 ----a-w- c:\windows\system32\drivers\dvd43llh.sys
2009-08-09 02:13 . 2009-08-09 02:13 -------- d-----w- c:\program files\dvd43
2009-08-06 01:24 . 2009-08-09 02:16 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-08-06 01:24 . 2009-08-09 02:16 -------- d-----w- c:\program files\NOS
2009-08-05 09:01 . 2009-08-05 09:01 204800 ------w- c:\windows\system32\dllcache\mswebdvd.dll
2009-08-05 01:47 . 2009-08-05 01:47 152576 ----a-w- c:\documents and settings\Atheist\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-30 20:14 . 2008-06-03 23:20 -------- d-----w- c:\documents and settings\Atheist\Application Data\RSIGuard
2009-08-30 18:17 . 2008-06-05 17:15 -------- d-----w- c:\program files\Firefox
2009-08-30 18:17 . 2008-10-13 00:59 -------- d-----w- c:\program files\Coupons
2009-08-29 13:17 . 2008-06-05 05:19 -------- d-----w- c:\program files\AVG
2009-08-28 21:55 . 2009-07-29 00:12 -------- d-----w- c:\documents and settings\Atheist\Application Data\vlc
2009-08-28 20:02 . 2008-09-19 06:00 -------- d-----w- c:\documents and settings\Atheist\Application Data\dvdcss
2009-08-28 13:42 . 2008-06-05 05:19 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-08-28 13:42 . 2008-06-05 05:19 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-08-28 13:42 . 2008-06-05 05:19 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-08-25 03:15 . 2008-08-02 17:54 -------- d-----w- c:\program files\Nero
2009-08-25 03:15 . 2008-08-02 17:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2009-08-25 03:15 . 2008-06-20 16:25 -------- d-----w- c:\program files\Common Files\Nero
2009-08-13 23:51 . 2008-06-05 02:11 -------- d-----w- c:\documents and settings\All Users\Application Data\DVD Shrink
2009-08-12 15:50 . 2009-03-26 16:53 -------- d-----w- c:\program files\TVUPlayer
2009-08-09 02:18 . 2009-04-09 13:18 2205390 ----a-w- c:\windows\Internet Logs\tvDebug.Zip
2009-08-08 18:12 . 2008-06-05 02:20 -------- d-----w- c:\program files\MozyHome
2009-08-08 18:07 . 2008-06-04 00:10 -------- d-----w- c:\program files\Spybot
2009-08-05 09:01 . 2004-08-10 17:51 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-05 01:48 . 2009-04-09 13:44 -------- d-----w- c:\program files\Java
2009-07-29 00:11 . 2008-09-16 22:57 -------- d-----w- c:\program files\VLC
2009-07-25 09:23 . 2008-11-23 14:31 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-22 19:13 . 2009-07-21 23:22 28592 ----a-w- c:\windows\system32\drivers\tap0901.sys
2009-07-17 19:01 . 2004-08-10 17:50 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-15 12:34 . 2009-06-14 04:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-07-14 03:43 . 2004-08-10 17:51 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 2004-08-10 17:51 915456 ------w- c:\windows\system32\wininet.dll
2009-06-30 12:06 . 2009-05-20 19:54 33840 ----a-w- c:\windows\system32\drivers\hssdrv.sys
2009-06-25 08:25 . 2004-08-10 17:51 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2004-08-10 17:51 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 2004-08-10 17:51 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 2004-08-10 17:51 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:25 . 2004-08-10 17:51 730112 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 2004-08-10 17:51 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-24 23:06 . 2008-12-22 05:16 1 ----a-w- c:\documents and settings\Atheist\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-06-24 19:03 . 2009-02-07 15:54 54776 ----a-w- c:\windows\system32\drivers\mozy.sys
2009-06-24 11:18 . 2004-08-10 17:51 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-18 16:47 . 2008-06-30 17:07 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-06-16 14:36 . 2004-08-10 17:51 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2004-08-10 17:51 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-15 00:46 . 2008-06-03 11:24 69232 ----a-w- c:\documents and settings\Atheist\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-12 12:31 . 2004-08-10 17:51 76288 ----a-w- c:\windows\system32\telnet.exe
2009-06-11 02:33 . 2009-06-11 02:33 152576 ----a-w- c:\documents and settings\Atheist\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-06-10 14:13 . 2004-08-10 17:50 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 13:19 . 2004-08-10 18:01 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 2004-08-10 17:51 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-03 19:09 . 2004-08-10 17:51 1291264 ----a-w- c:\windows\system32\quartz.dll
2007-02-16 15:31 . 2008-06-23 20:27 227328 ----a-w- c:\program files\mpTrim.exe
2008-06-28 03:13 . 2008-06-28 03:13 4184 --sha-w- c:\windows\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{28A27F58-704F-40E1-8053-28E909FBF604}]
2009-05-31 00:52 1297920 ----a-w- c:\program files\Mob Wars Toolbar\Toolbar.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
2009-08-28 03:34 218160 ----a-w- c:\program files\Hotspot Shield\hssie\HssIE.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6857857C-15D3-435D-AF19-E0217298B416}"= "c:\program files\Mob Wars Toolbar\Toolbar.dll" [2009-05-31 1297920]
[HKEY_CLASSES_ROOT\clsid\{6857857c-15d3-435d-af19-e0217298b416}]
[HKEY_CLASSES_ROOT\FCTB000058757.IEToolbar.3]
[HKEY_CLASSES_ROOT\TypeLib\{AD0FF573-4DD1-4CF7-AA25-41280783CA54}]
[HKEY_CLASSES_ROOT\FCTB000058757.IEToolbar]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{6857857C-15D3-435D-AF19-E0217298B416}"= "c:\program files\Mob Wars Toolbar\Toolbar.dll" [2009-05-31 1297920]
[HKEY_CLASSES_ROOT\clsid\{6857857c-15d3-435d-af19-e0217298b416}]
[HKEY_CLASSES_ROOT\FCTB000058757.IEToolbar.3]
[HKEY_CLASSES_ROOT\TypeLib\{AD0FF573-4DD1-4CF7-AA25-41280783CA54}]
[HKEY_CLASSES_ROOT\FCTB000058757.IEToolbar]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy2]
@="{747E722C-CB46-4a9d-BDFE-192AAD5099B1}"
[HKEY_CLASSES_ROOT\CLSID\{747E722C-CB46-4a9d-BDFE-192AAD5099B1}]
2009-06-24 19:03 2835256 ----a-w- c:\program files\MozyHome\mozyshell.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy3]
@="{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}"
[HKEY_CLASSES_ROOT\CLSID\{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}]
2009-06-24 19:03 2835256 ----a-w- c:\program files\MozyHome\mozyshell.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON\daemon.exe" [2009-04-23 691656]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-06-14 142104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-06-14 138008]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2007-09-17 124200]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"ZoneAlarm Client"="c:\program files\ZoneAlarm\zlclient.exe" [2009-02-16 981384]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"dvd43"="c:\program files\dvd43\dvd43_tray.exe" [2009-06-29 827904]
"Logitech Utility"="Logi_MwX.Exe" - c:\windows\LOGI_MWX.EXE [2003-12-17 19968]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Firefox.lnk - c:\program files\Firefox\firefox.exe [2008-6-5 908280]
KeyText.lnk - c:\program files\KeyText\KeyText.exe [2008-6-5 409600]
RSIGuard.lnk - c:\program files\RSIGuard\RSIGuard.exe [2008-6-5 6926336]
ZoneAlarm.lnk - c:\program files\ZoneAlarm\zlclient.exe [2009-3-29 981384]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLogoff"= 01000000
"NoRecentDocsNetHood"= 01000000
"NoSMMyDocs"= 01000000
"NoSMMyPictures"= 01000000
"NoNetworkConnections"= 01000000
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-28 13:42 11952 ----a-w- c:\windows\system32\avgrsstx.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PowerDVD.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PDVDDXSrv.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\avgupd.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Screen Recorder\\ScreenRecorder.exe"=
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [6/5/2008 1:19 AM 335240]
R1 mozyFilter;mozyFilter;c:\windows\system32\drivers\mozy.sys [2/7/2009 11:54 AM 54776]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\avgwdsvc.exe [6/5/2008 1:19 AM 297752]
R2 HssSrv;Hotspot Shield Routing Service;c:\program files\Hotspot Shield\HssWPR\hsssrv.exe [8/6/2009 2:58 PM 331824]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [7/4/2008 6:08 PM 24652]
R3 HssDrv;Hotspot Shield Helper Miniport;c:\windows\system32\drivers\hssdrv.sys [5/20/2009 3:54 PM 33840]
R3 tap0901;TAP-Win32 Adapter V9;c:\windows\system32\drivers\tap0901.sys [7/21/2009 7:22 PM 28592]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [6/21/2008 10:19 PM 13352]
S3 HssTrayService;Hotspot Shield Tray Service;c:\program files\Hotspot Shield\bin\HssTrayService.exe [8/10/2009 7:19 PM 57640]
S3 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [12/9/2008 12:37 PM 13088]
S3 tap0801;TAP-Win32 Adapter V8;c:\windows\system32\drivers\tap0801.sys [10/1/2006 8:37 AM 26624]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - AUJASNKJ
*NewlyCreated* - HOTSPOTSHIELDSERVICE
*NewlyCreated* - HSSSRV
*NewlyCreated* - HSSTRAYSERVICE
*Deregistered* - aujasnkj
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://my.yahoo.com/
uSearchURL,(Default) = hxxp://www.searchgateway.net/search/%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
FF - ProfilePath - c:\documents and settings\Atheist\Application Data\Mozilla\Firefox\Profiles\zcnsf976.Dawkins\
FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com
FF - plugin: c:\program files\Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
---- FIREFOX POLICIES ----
c:\program files\Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-30 17:04
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Completion time: 2009-08-30 17:07
ComboFix-quarantined-files.txt 2009-08-30 21:06
ComboFix2.txt 2009-08-30 17:20
C:\DeQuarantine.txt
Pre-Run: 43,942,907,904 bytes free
Post-Run: 43,859,816,448 bytes free
1542 --- E O F --- 2009-08-26 13:54
clamenza
2009-08-30, 23:21
I'm sorry to have wasted your time, but I think I'd like to reverse everything ComboFix has done. I need TOR and utorrent and I really don't think they are causing any problems. These redirects I experience also happen on the same days I visit high-risk sites, so I think I'll just use Ubuntu for them in the future. Thanks a lot for your help. Could you help me undo my mess? :thanks:
c:\Qoobox\Quarantine\c\windows\COUPON~1.OCX.vir -> c:\windows\COUPON~1.OCX ( 71008 bytes )
c:\Qoobox\Quarantine\c\windows\desktop\Hooked on Phonics Learn to Read.lnk.vir -> c:\windows\desktop\Hooked on Phonics Learn to Read.lnk ( 838 bytes )
Hi,
Our policy clearly states that p2p is not allowed. So, I won't help in restoring those. However, following instructions help in restoring those non P2P items that ComboFix.
Open notepad and copy/paste the text in the quotebox below into it:
DeQuarantine::
c:\Qoobox\Quarantine\c\windows\COUPON~1.OCX.vir
c:\Qoobox\Quarantine\c\windows\CouponPrinter.ocx.vir
c:\Qoobox\Quarantine\c\windows\desktop\Hooked on Phonics Learn to Read.lnk.vir
Quit::
Save this as
CFScript
A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe.
clamenza
2009-09-01, 01:27
Thank you.
Ok. I'll close this topic now.