DOS attack!

D

doubleoseverin

New member
Hi there I wonder if you can help me.

I have panda internet security which reported a DOS attack. I have done a full scan with spybot; well two actually as it could not remove two malwares, namely hotbar and zango. But on the second scan it did not report hotbar and still could not fully remove zango. The description of hotbar is that it causes excessive network traffic. Could this be the reason why panda reported the DOS attack? I'm not quite sure how DOS attacks works, could you please direct me to a good description of it?

Also now, when I go to every new page on the internet using IE I get a runtime error, which obviously is very annoying ;(

Anyway here's the HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:12:55, on 02/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Mobiscope\mobiscope_cpanel.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAGE.EXE
C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
C:\Program Files\Mobiscope\mobiscope_server.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\AVENGINE.EXE
C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\SRVLOAD.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\WebProxy.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\PavBckPT.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.inbox.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=70037
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.inbox.com/?tbid=70037
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.inbox.com/search/ie.aspx?tb_id=70037
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.inbox.com/support/sa_customize.aspx?TbId=70037
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.inbox.com/search/ie.aspx?tb_id=70037
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.inbox.com/support/sa_customize.aspx?TbId=70037
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: (no name) - {E1BACF55-35E1-4E47-9247-2D48660E5545} - (no file)
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Mobiscope] "C:\Program Files\Mobiscope\mobiscope_cpanel.exe" /OSRUN
O4 - HKLM\..\Run: [\\Server\stylus-photo-rx500---cups+gutenprint-v5.0.0] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAGE.EXE /P52 "\\Server\stylus-photo-rx500---cups+gutenprint-v5.0.0" /O52 "\\Server\stylus-photo-rx500---cups+gutenprint-v5.0.0" /M "Stylus Photo RX520"
O4 - HKLM\..\Run: [\\LINUX-69V7\Stylus-Photo-RX500---CUPS+Gutenprint-v5.0.2] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAGE.EXE /P56 "\\LINUX-69V7\Stylus-Photo-RX500---CUPS+Gutenprint-v5.0.2" /O56 "\\LINUX-69V7\Stylus-Photo-RX500---CUPS+Gutenprint-v5.0.2" /M "Stylus Photo RX520"
O4 - HKLM\..\Run: [\\SERVER\Stylus-Photo-RX500---CUPS+Gutenprint-v5.0.2] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAGE.EXE /P52 "\\SERVER\Stylus-Photo-RX500---CUPS+Gutenprint-v5.0.2" /O52 "\\SERVER\Stylus-Photo-RX500---CUPS+Gutenprint-v5.0.2" /M "Stylus Photo RX520"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Internet Security 2008\Inicio.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe

--
End of file - 7572 bytes


Thanks...
 
DOS Attack!

Hi there again. Sorry it's taken me so long to reply. Anyway here's the uninstall list:

Adobe Flash Player 9 ActiveX
Adobe Flash Player 9 ActiveX
Adobe Flash Player ActiveX
Adobe Reader 7.0
EPSON Printer Software
EPSON Scan
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB952287)
HSP56 MR Drivers
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Mobiscope 2.4
nAVI Vx3 MPEG-4 Codec
Nero 6 Ultra Edition
Panda Internet Security 2008
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937143)
Security Update for Windows XP (KB937894)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB939653)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB942615)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Spybot - Search & Destroy
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB932823-v3)
Update for Windows XP (KB933360)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB942840)
Update for Windows XP (KB951072-v2)
VIA Rhine-Family Fast Ethernet Adapter
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
WinRAR archiver


...Thanks. I know you doubt that I had a DOS attack, but even connecting to my router, a lot of the images don't load up. Also I thought I'd sorted out the runtime error thing that kept coming up in IE by uninstalling it and reinstalling it. It seemed to work until I switch my computer off. It is now back... Very annoying. All help much appreciated :)
 
hi,

thanks for the info. i was hoping the uninstall list would show the hotbar and zango items, as these two can come bundled in other software one can download.
we can try another download for any malware that might be lurking around:
link and directions:

Please download Malwarebytes' Anti-Malware to your desktop:

http://www.besttechie.net/tools/mbam-setup.exe

* Double-click mbam-setup.exe and follow the prompts to install the program.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt

please post the malwarebytes log and we will see what it looks like
 
mbam log

here's the log as requested:

Malwarebytes' Anti-Malware 1.28
Database version: 1257
Windows 5.1.2600 Service Pack 2

11/10/2008 11:46:32
mbam-log-2008-10-11 (11-46-32).txt

Scan type: Full Scan (C:\|)
Objects scanned: 79600
Time elapsed: 33 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\568267acfc5644dab06f058006ddbae3 (Adware.Zango) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\zango 10.1.181.0 (Adware.Zango) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
 
hi,

looks like malwarebytes removed some registry entries. Have you considered using firefox for your web browsing? you can have and use two or more browsers on your computer.
 
still slow :(

My computer still seems very slow and I don't think hotbar has been got rid of which I think is the main cause of the slowness. I have switched over to firefox but as I say, it's still all a bit slow. I will do a defrag and see if that helps any but it seems also that the processing has slowed...

Thanks beforehand
 
hi,

a scan with spybot still shows hotbar? for the slowness: have you installed any software recently maybe which might account for the change? a dfrag couldnt hurt.
 
still slow :(

done another check with spybot and two other malwares came up. I think one was hitbar and I can't remember the other one but it got rid of them anyway. But what I am worried about is that zango is back and spybot couldn't get rid of that and said it was in the memory. Router still slow to access. Have removed the mobiscope program as it was a security camera program that sends video from a camera connected to your computer to your mobile phone and thought that might be slowing things down, but there doesn't seem to be any improvement.

Thanks
 
hard disk been constantly accessed

Should have put this in the previous post, but it appears that my hard disk is constantly been accessed. Is it possible that somebody has put a bit of malware on my computer that is reckognised by spybot yet. I'm extremely worried about putting details in such as passwords and card details as I'm afraid they might be getting sent somewhere by a malicious program. There must be some way to track these kind of processes down and get rid of them. I have got another machine and am doing a text search of all the files on the computer that might have my passwords etc stored but the trouble is these will get sent instantly to wherever it's going I presume and if the details where stored on the computer I would have thought that the malicious software would be clever enough to encrypt it anyway. Please help this super paranoid person. Thanks...
 
hi doubleoseverin,

you have a Panda suite, spybot and malwarebytes. is it possible for malware to go undetected by these? yes, but iam not saying thats what happening to you.
hotbar and zango are really quite tame compared to some malicious malware one can get on there machine.

we will get another download to use as a another check for malware. its called combofix. when you run it it will ask you to install the Microsoft Recovery Console (most likely its not installed)just follow the prompts. after its done it will produce a log. please post the log in your next reply. link and directions:

Download combofix from one of these links and save it to your Desktop:

http://subs.geekstogo.com/ComboFix.exe
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze.
 
combofix and HJT logs

I think I executed combofix 3 times because the first time panda reported that it had blocked a dangerous action. The second time (after switching panda off) it did all the scans then deleted some zango files, then a message came up saying that it could not execute the specified program. Waited 5 mins then did a restart. On the third running of it, it seemed to delete the remaining zango files as well as the directory, as you can see on the log, but I'm afraid it is not the complete log because as I say I had to run it a number of times, but here it is anyway:

ComboFix 08-10-24.02 - severin double 2008-10-25 7:29:48.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.164 [GMT -7:00]
Running from: C:\Documents and Settings\severin double\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\severin double\Application Data\Zango
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\38333
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\386385
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\38868
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\389687
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\39245
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\39280
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\398331
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\398397
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\400701
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\40256
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\402844
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\40726
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\41115
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\41215
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\41333
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\41364
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\41421
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\41952
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\42013
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\420256
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\42208
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\422154
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\423535
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\42915
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\43120
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\43142
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\432060
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\43236
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\43377
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\43638
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\43719
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\43906
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\439286
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\43979
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\44214
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\44228
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\44229
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\44323
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\4442
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\44458
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\44789
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\44878
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\44896
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\449626
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\450215
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\45214
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\45437
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\45462
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\454667
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\455743
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\455745
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\456216
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\45833
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\459921
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\460342
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\461563
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\468530
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\471072
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\471643
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\4721
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\472662
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\4732
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\47371
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\474943
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\475788
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\477253
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\482315
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\482360
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\489917
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\49432
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\49821
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\49957
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\50618
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\506799
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\507892
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\50830
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\50887
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\51194
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\51233
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\51374
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\51495
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\51666
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\518339
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\51880
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\520179
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\52335
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\525034
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\52583
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\526389
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\528235
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\531510
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\532492
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\533670
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\53481
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\53842
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\539163
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\541324
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\54189
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\54469
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\54473
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\549635
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\5535
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\55725
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\561083
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\56113
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\566240
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\56815
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\569262
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\56962
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\57137
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\57640
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\578150
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\57904
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\579123
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\57918
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\57942
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\57966
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\580774
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\58197
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\582319
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\583749
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\58804
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\58913
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\591949
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\59221
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\59234
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\59297
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\59598
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\59844
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\59845
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\60429
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\604347
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\611081
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\61194
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\61202
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\61203
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\61207
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\61212
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\616704
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\61779
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\61837
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\61853
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\61951
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\622354
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\623297
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\6280
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\628262
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\6292
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\63014
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\6304
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\6368
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\63770
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\63778
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\639205
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64412
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64434
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64446
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64451
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64467
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64495
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64517
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64605
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64646
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\6465
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\6468
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64754
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\6558
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\656635
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\65770
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\6580
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\66836
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\66851
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\66852
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\67209
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\67215
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\67220
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\67329
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\67469
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\67491
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\67506
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\67564
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\67733
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\68016
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\68040
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\68064
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\68094
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\68257
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\6873
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\68903
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\69263
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\69325
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\69626
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\699826
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\70132
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\7018
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\702281
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\70463
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\70608
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\70650
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\70773
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\70805
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\70823
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\708559
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\70907
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\70966
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\71009
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\711791
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\711945
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\712297
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\71340
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\71531
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\715568
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\71999
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\722362
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\72748
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\72873
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\72889
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\72916
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\73143
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\732186
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\73282
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\73387
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\73485
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\73664
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\73670
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\737665
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\737950
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\738022
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\73922
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\742963
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\743331
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\743403
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\743543
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\74398
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744260
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744413
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744431
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744513
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744603
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744617
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744627
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744786
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744793
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744819
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744832
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744864
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744869
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744881
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744930
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744934
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744977
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744999
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745024
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\74503
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745082
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745102
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745112
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745119
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745138
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745201
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745202
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745220
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745261
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745268
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745269
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745304
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745356
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745415
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745838
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745869
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\746039
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\747343
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\747687
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\747716
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\747936
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\748028
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\748059
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\748176
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\7482
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\748330
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\748385
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\748411
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\748602
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\748603
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\748883
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\749325
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\749571
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\750156
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\751223
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\751224
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\751235
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\751236
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\752614
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753052
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753197
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753230
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753250
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753259
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753300
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753309
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753317
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753327
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753331
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753334
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753335
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753340
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753345
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753346
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753356
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753359
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753366
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753371
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753372
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753377
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\77461
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\77494
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79079
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79246
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79257
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79432
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79497
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79805
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79806
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79824
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79972
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79977
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79986
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\80193
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\80670
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\80815
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\81010
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\8120
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\81830
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\82292
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\82442
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\82633
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\82645
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\83463
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\84293
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\84369
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\8438
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\85083
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\85268
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\85365
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\85547
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\86090
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\86172
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\86379
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\86460
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\86593
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\872
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\873
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\87385
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\87387
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\87439
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\87576
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\87843
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\89658
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\89673
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\89936
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\90082
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\90098
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\90149
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\90163
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\90247
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\90358
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\90711
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\91204
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\92573
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\92721
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\93116
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\93192
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\93279
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\93899
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\93908
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\93934
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\93958
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\94407
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\94515
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\95615
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\95646
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\95716
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\95717
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\95774
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\95798
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\95825
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\96971
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\97436
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\97498
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\97499
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\97524
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\97734
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\98248
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\99008
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\99163
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\99739
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\dynamic\ustat\3744.dat
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\avatar.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\btntrans.idx
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\btntrans1.dat
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\buttondir.txt
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\components.cdf
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\cursors.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_1000.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_2000.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_3000.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_bar.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_bbar1.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_logos.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_other.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\d_icons_weather.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\default.cdf
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_511745-514279.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_bidzC_ZT_IE-ca.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_bidzC_ZT_IE-us.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_categorize.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_comparison.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_explorer-Mails.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_explorer-people.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_favorites.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_Games.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_Hide.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_hotbarcom.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_Hotmail.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_hsskin.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_jemster.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_jemsterie.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_jemsteruk.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_jobsearch.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_Mails.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_MobileSidewalk.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_new.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_premium.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_reun.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_ringtones.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_SearchBoxTrapper.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_searchfor.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_searchgo.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_weather.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Default_yellowpages.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\editblbuttons.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\email-def-511724-548964.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\email-def-511724-9595.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\email-t1-bg.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\icons2.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\ie_games_icon.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\ie_video.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\keywords.idx
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\keywords1.dat
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\layout.cdf
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\linkpathlegal.txt
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\progress.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\s_icons_buttons.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\sales_buttons.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\sdfmodifier.xml
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\t2_bg.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\theweb.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\top7.cdf
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\Top7_theweb.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\tsd_bg.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\zango_btn.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\1\zango_ie_menu.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\avatar.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\btntrans.idx
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\btntrans1.dat
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\buttondir.txt
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\components.cdf
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\cursors.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_1000.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_2000.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_3000.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_bar.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_bbar1.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_logos.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_other.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\d_icons_weather.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\default.cdf
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_511745-514279.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_bidzC_ZT_IE-ca.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_bidzC_ZT_IE-us.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_categorize.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_comparison.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_explorer-Mails.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_explorer-people.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_favorites.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_Games.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_Hide.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_hotbarcom.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_Hotmail.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_hsskin.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_jemster.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_jemsterie.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_jemsteruk.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_jobsearch.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_Mails.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_MobileSidewalk.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_new.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_premium.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_reun.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_ringtones.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_SearchBoxTrapper.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_searchfor.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_searchgo.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_weather.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Default_yellowpages.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\editblbuttons.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\email-def-511724-548964.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\email-def-511724-9595.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\email-t1-bg.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\icons2.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\ie_games_icon.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\ie_video.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\keywords.idx
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\keywords1.dat
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\layout.cdf
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\linkpathlegal.txt
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\progress.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\s_icons_buttons.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\sales_buttons.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\sdfmodifier.xml
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\t2_bg.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\theweb.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\top7.cdf
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\Top7_theweb.mnu
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\tsd_bg.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\zango_btn.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\2\zango_ie_menu.res
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\avatar.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\BtnTrans.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\BtnTrans1.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\buttondir.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\cursors.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_1000.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_2000.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_3000.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_bar.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_bbar1.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_logos.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_other.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_weather.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\default.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\editblbuttons.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\email-t1-bg.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\icons2.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\ie_games_icon.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\ie_video.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\keywords.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\keywords1.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\layout.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\linkpathlegal.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\progress.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\s_icons_buttons.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\sales_buttons.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\samplegroups2.txt
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\samplegroups2.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\sdfmodifier.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\t2_bg.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\top7.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\tsd_bg.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\zango_btn.xip
C:\Documents and Settings\severin double\Application Data\Zango\v3.0\Zango\static\DownLoad\zango_ie_menu.xip

.
((((((((((((((((((((((((( Files Created from 2008-09-25 to 2008-10-25 )))))))))))))))))))))))))))))))
.

... continued on next post...
 
second part of combofix log

2008-10-25 07:05 . 2008-10-15 09:34 337,408 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll
2008-10-18 08:12 . 2008-10-18 08:12 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-10-18 08:12 . 2008-10-18 08:12 <DIR> d-------- C:\WINDOWS\system32\en
2008-10-18 08:12 . 2008-10-18 08:12 <DIR> d-------- C:\WINDOWS\system32\bits
2008-10-18 08:12 . 2008-10-18 08:12 <DIR> d-------- C:\WINDOWS\l2schemas
2008-10-18 08:06 . 2008-10-18 08:13 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-10-18 06:14 . 2008-09-08 03:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
2008-10-18 06:13 . 2008-09-15 05:12 1,846,400 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
2008-10-18 06:11 . 2008-08-14 03:11 2,189,184 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-10-18 06:11 . 2008-08-14 03:09 2,145,280 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-18 06:11 . 2008-08-14 02:33 2,066,048 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-10-18 06:11 . 2008-08-14 02:33 2,023,936 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-14 07:19 . 2008-04-13 17:12 276,992 --------- C:\WINDOWS\system32\wmphoto.dll
2008-10-14 07:18 . 2008-04-13 17:12 712,704 --------- C:\WINDOWS\system32\windowscodecs.dll
2008-10-14 07:18 . 2008-04-13 17:12 346,112 --------- C:\WINDOWS\system32\windowscodecsext.dll
2008-10-14 07:18 . 2008-04-13 17:12 69,120 --------- C:\WINDOWS\system32\wlanapi.dll
2008-10-14 07:17 . 2008-04-13 11:46 121,984 --------- C:\WINDOWS\system32\drivers\usbvideo.sys
2008-10-14 07:17 . 2008-04-13 11:36 44,672 --------- C:\WINDOWS\system32\drivers\uagp35.sys
2008-10-14 07:17 . 2004-08-03 22:29 25,471 --------- C:\WINDOWS\system32\drivers\watv10nt.sys
2008-10-14 07:17 . 2004-08-03 22:29 22,271 --------- C:\WINDOWS\system32\drivers\watv06nt.sys
2008-10-14 07:17 . 2008-04-13 11:43 14,208 --------- C:\WINDOWS\system32\drivers\wacompen.sys
2008-10-14 07:17 . 2008-04-13 11:56 12,800 --------- C:\WINDOWS\system32\drivers\usb8023x.sys
2008-10-14 07:17 . 2004-08-03 22:29 11,935 --------- C:\WINDOWS\system32\drivers\wadv11nt.sys
2008-10-14 07:17 . 2004-08-03 22:29 11,871 --------- C:\WINDOWS\system32\drivers\wadv09nt.sys
2008-10-14 07:17 . 2004-08-03 22:29 11,807 --------- C:\WINDOWS\system32\drivers\wadv07nt.sys
2008-10-14 07:17 . 2008-04-13 17:12 11,325 --------- C:\WINDOWS\system32\drivers\vchnt5.dll
2008-10-14 07:17 . 2004-08-03 22:29 11,295 --------- C:\WINDOWS\system32\drivers\wadv08nt.sys
2008-10-14 07:16 . 2008-04-13 17:12 53,248 --------- C:\WINDOWS\system32\tsgqec.dll
2008-10-14 07:16 . 2008-04-13 17:12 50,688 --------- C:\WINDOWS\system32\tspkg.dll
2008-10-14 07:15 . 2008-04-13 17:12 20,992 --------- C:\WINDOWS\system32\spupdwxp.exe
2008-10-14 07:15 . 2008-04-13 17:12 7,680 --a------ C:\WINDOWS\system32\spdwnwxp.exe
2008-10-14 07:15 . 2008-10-14 07:15 0 --a------ C:\WINDOWS\nsreg.dat
2008-10-14 07:13 . 2008-04-13 17:12 290,304 --------- C:\WINDOWS\system32\rhttpaa.dll
2008-10-14 07:13 . 2008-04-13 17:12 76,800 --------- C:\WINDOWS\system32\qutil.dll
2008-10-14 07:13 . 2008-04-13 17:12 61,952 --------- C:\WINDOWS\system32\rasqec.dll
2008-10-14 07:13 . 2008-04-13 11:46 59,136 --------- C:\WINDOWS\system32\drivers\rfcomm.sys
2008-10-14 07:13 . 2008-04-13 17:12 32,768 --------- C:\WINDOWS\system32\setupn.exe
2008-10-14 07:13 . 2008-04-13 11:56 30,592 --------- C:\WINDOWS\system32\drivers\rndismpx.sys
2008-10-14 07:13 . 2004-08-03 22:41 13,776 --------- C:\WINDOWS\system32\drivers\recagent.sys
2008-10-14 07:12 . 2008-04-13 17:12 412,160 --------- C:\WINDOWS\system32\photometadatahandler.dll
2008-10-14 07:12 . 2008-04-13 17:12 291,328 --------- C:\WINDOWS\system32\qagentrt.dll
2008-10-14 07:12 . 2008-04-13 17:12 150,528 --------- C:\WINDOWS\system32\qagent.dll
2008-10-14 07:12 . 2008-04-13 17:12 62,464 --------- C:\WINDOWS\system32\qcliprov.dll
2008-10-14 07:11 . 2008-04-13 17:12 4,274,816 --------- C:\WINDOWS\system32\nv4_disp.dll
2008-10-14 07:11 . 2004-08-03 22:29 1,897,408 --------- C:\WINDOWS\system32\drivers\nv4_mini.sys
2008-10-14 07:11 . 2004-08-03 22:41 180,360 --------- C:\WINDOWS\system32\drivers\ntmtlfax.sys
2008-10-14 07:11 . 2008-04-13 17:12 144,384 --------- C:\WINDOWS\system32\onex.dll
2008-10-14 07:09 . 2008-04-13 17:12 155,136 --------- C:\WINDOWS\system32\mssha.dll
2008-10-14 07:09 . 2008-04-13 11:14 76,800 --------- C:\WINDOWS\system32\msshavmsg.dll
2008-10-14 07:07 . 2008-04-13 17:11 397,312 --------- C:\WINDOWS\system32\mmcex.dll
2008-10-14 07:07 . 2008-04-13 17:11 184,320 --------- C:\WINDOWS\system32\microsoft.managementconsole.dll
2008-10-14 07:07 . 2008-04-13 17:11 106,496 --------- C:\WINDOWS\system32\mmcfxcommon.dll
2008-10-14 07:07 . 2008-04-13 17:11 86,016 --------- C:\WINDOWS\system32\mdmxsdk.dll
2008-10-14 07:07 . 2008-04-13 17:12 33,792 --------- C:\WINDOWS\system32\mmcperf.exe
2008-10-14 07:07 . 2004-08-03 22:41 11,868 --------- C:\WINDOWS\system32\drivers\mdmxsdk.sys
2008-10-14 07:05 . 2008-04-13 17:11 650,752 --------- C:\WINDOWS\system32\dot3ui.dll
2008-10-14 07:04 . 2008-04-13 17:11 1,888,992 --------- C:\WINDOWS\system32\ati3duag.dll
2008-10-14 07:03 . 2008-04-13 17:11 136,192 --------- C:\WINDOWS\system32\aaclient.dll
2008-10-14 07:03 . 2008-04-13 11:36 44,928 --------- C:\WINDOWS\system32\drivers\agpcpq.sys
2008-10-14 07:03 . 2008-04-13 11:36 43,008 --------- C:\WINDOWS\system32\drivers\amdagp.sys
2008-10-14 07:03 . 2008-04-13 11:36 42,752 --------- C:\WINDOWS\system32\drivers\alim1541.sys
2008-10-14 07:03 . 2008-04-13 11:36 42,368 --------- C:\WINDOWS\system32\drivers\agp440.sys
2008-10-14 07:03 . 2008-04-13 17:11 4,255 --------- C:\WINDOWS\system32\drivers\adv01nt5.dll
2008-10-14 07:03 . 2008-04-13 17:11 3,967 --------- C:\WINDOWS\system32\drivers\adv02nt5.dll
2008-10-14 07:03 . 2008-04-13 17:11 3,775 --------- C:\WINDOWS\system32\drivers\adv11nt5.dll
2008-10-14 07:03 . 2008-04-13 17:11 3,711 --------- C:\WINDOWS\system32\drivers\adv09nt5.dll
2008-10-14 07:03 . 2008-04-13 17:11 3,647 --------- C:\WINDOWS\system32\drivers\adv07nt5.dll
2008-10-14 07:03 . 2008-04-13 17:11 3,615 --------- C:\WINDOWS\system32\drivers\adv05nt5.dll
2008-10-14 07:03 . 2008-04-13 17:11 3,135 --------- C:\WINDOWS\system32\drivers\adv08nt5.dll
2008-10-11 11:05 . 2008-10-18 07:03 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-11 11:05 . 2008-10-11 11:05 <DIR> d-------- C:\Documents and Settings\severin double\Application Data\Malwarebytes
2008-10-11 11:05 . 2008-10-11 11:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-11 11:05 . 2008-10-16 20:25 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-11 11:05 . 2008-10-16 20:25 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-01 23:27 . 2008-10-01 23:29 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-10-01 23:27 . 2008-10-01 23:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-01 23:09 . 2008-10-01 23:09 <DIR> d-------- C:\Program Files\Trend Micro
2008-09-27 12:58 . 2008-09-27 12:58 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-09-26 05:55 . 2008-04-11 12:04 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-09-26 05:26 . 2008-10-25 07:28 246,960 --a------ C:\WINDOWS\system32\drivers\APPFCONT.DAT.bck
2008-09-26 05:26 . 2008-10-25 07:28 1,184 --a------ C:\WINDOWS\system32\drivers\APPFLTR.CFG.bck
2008-09-26 05:11 . 2008-10-19 05:56 8,627 --a------ C:\WINDOWS\system32\PAV_FOG.OPC
2008-09-26 04:59 . 2008-10-25 07:27 13,880 --a------ C:\WINDOWS\system32\drivers\COMFiltr.sys
2008-09-26 04:56 . 2008-09-26 04:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\sentinel
2008-09-26 04:54 . 2008-10-25 07:28 246,960 --a------ C:\WINDOWS\system32\drivers\APPFCONT.DAT
2008-09-26 04:54 . 2007-06-06 02:43 83,640 --a------ C:\WINDOWS\system32\drivers\pavdrv51.sys
2008-09-26 04:54 . 2008-10-25 07:28 1,184 --a------ C:\WINDOWS\system32\drivers\APPFLTR.CFG
2008-09-26 04:54 . 2008-09-26 04:54 261 --a------ C:\WINDOWS\system32\PavCPL.dat
2008-09-26 04:53 . 2008-09-26 04:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Backup
2008-09-26 04:53 . 2007-07-11 11:39 191,672 --a------ C:\WINDOWS\system32\drivers\idsflt.sys
2008-09-26 04:53 . 2007-05-11 09:33 132,920 --a------ C:\WINDOWS\system32\drivers\NETFLTDI.SYS
2008-09-26 04:53 . 2007-05-11 09:33 71,736 --a------ C:\WINDOWS\system32\drivers\APPFLT.SYS
2008-09-26 04:53 . 2007-05-11 09:33 51,256 --a------ C:\WINDOWS\system32\drivers\dsaflt.sys
2008-09-26 04:53 . 2007-05-11 09:33 37,304 --a------ C:\WINDOWS\system32\drivers\smsflt.sys
2008-09-26 04:53 . 2007-05-11 09:33 30,648 --a------ C:\WINDOWS\system32\drivers\wnmflt.sys
2008-09-26 04:53 . 2007-05-11 09:33 22,072 --a------ C:\WINDOWS\system32\drivers\fnetmon.sys
2008-09-26 04:52 . 2007-03-15 19:38 54,832 --a------ C:\WINDOWS\system32\pavcpl.cpl
2008-09-26 04:51 . 2003-10-22 18:23 446,464 --a------ C:\WINDOWS\system32\HHActiveX.dll
2008-09-26 04:51 . 2007-07-12 08:42 292,144 --a------ C:\WINDOWS\system32\PavSHook.dll
2008-09-26 04:51 . 2007-03-13 18:01 161,328 --a------ C:\WINDOWS\system32\TpUtil.dll
2008-09-26 04:51 . 2007-02-08 11:53 107,568 --a------ C:\WINDOWS\system32\SYSTOOLS.DLL
2008-09-26 04:51 . 2007-02-28 18:04 63,024 --a------ C:\WINDOWS\system32\pavipc.dll
2008-09-26 04:51 . 2007-06-08 08:44 24,760 --a------ C:\WINDOWS\system32\drivers\cpoint.sys
2008-09-26 04:50 . 2008-09-26 04:50 <DIR> d-------- C:\WINDOWS\system32\PAV
2008-09-26 04:50 . 2008-09-26 04:50 <DIR> d-------- C:\Program Files\Panda Security
2008-09-26 04:50 . 2007-04-24 15:43 142,128 --a------ C:\WINDOWS\system32\drivers\netimflt.sys
2008-09-26 04:50 . 2007-02-15 20:02 50,736 --a------ C:\WINDOWS\system32\avldr.dll
2008-09-26 04:50 . 2007-04-24 16:43 1,990 --a------ C:\WINDOWS\system32\drivers\net_m32.inf
2008-09-26 04:46 . 2008-09-26 04:46 <DIR> d-------- C:\Program Files\Common Files\Panda Software
2008-09-26 04:46 . 2007-07-12 05:49 178,872 -ra------ C:\WINDOWS\system32\drivers\PavProc.sys
2008-09-26 04:46 . 2007-05-23 07:40 38,968 -ra------ C:\WINDOWS\system32\drivers\ShlDrv51.sys
2008-09-26 04:42 . 2008-09-26 04:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-26 15:40 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-09-26 13:10 --------- d-----w C:\Documents and Settings\severin double\Application Data\AdobeUM
2008-09-26 12:49 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-26 12:49 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-09-26 12:42 --------- d-----w C:\Program Files\NCH Software
2008-09-26 12:40 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-13 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648]
"\\Server\stylus-photo-rx500---cups+gutenprint-v5.0.0"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAGE.EXE" [2005-04-06 98304]
"\\LINUX-69V7\Stylus-Photo-RX500---CUPS+Gutenprint-v5.0.2"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAGE.EXE" [2005-04-06 98304]
"\\SERVER\Stylus-Photo-RX500---CUPS+Gutenprint-v5.0.2"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAGE.EXE" [2005-04-06 98304]
"APVXDWIN"="C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" [2007-07-23 406832]
"SCANINICIO"="C:\Program Files\Panda Security\Panda Internet Security 2008\Inicio.exe" [2007-07-11 27952]
"PCTVOICE"="pctspk.exe" [2002-03-10 C:\WINDOWS\system32\pctspk.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-13 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
2007-02-15 20:02 50736 C:\WINDOWS\system32\avldr.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\telnet.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=

R1 APPFLT;App Filter Plugin;C:\WINDOWS\system32\Drivers\APPFLT.SYS [2007-05-11 71736]
R1 DSAFLT;DSA Filter Plugin;C:\WINDOWS\system32\Drivers\DSAFLT.SYS [2007-05-11 51256]
R1 FNETMON;NetMon Filter Plugin;C:\WINDOWS\system32\Drivers\fnetmon.SYS [2007-05-11 22072]
R1 IDSFLT;Ids Filter Plugin;C:\WINDOWS\system32\Drivers\IDSFLT.SYS [2007-07-11 191672]
R1 NETFLTDI;Panda Net Driver [TDI Layer];C:\WINDOWS\system32\Drivers\NETFLTDI.SYS [2007-05-11 09:33 132920]
R1 ShldDrv;Panda File Shield Driver;C:\WINDOWS\system32\DRIVERS\ShlDrv51.sys [2007-05-23 38968]
R1 SMSFLT;SMS Filter Plugin;C:\WINDOWS\system32\Drivers\SMSFLT.SYS [2007-05-11 37304]
R1 WNMFLT;Wifi Monitor Filter Plugin;C:\WINDOWS\system32\Drivers\WNMFLT.SYS [2007-05-11 30648]
R2 cpoint;Panda CPoint Driver;C:\WINDOWS\system32\Drivers\cpoint.sys [2007-06-08 24760]
R2 PavProc;Panda Process Protection Driver;C:\WINDOWS\system32\DRIVERS\PavProc.sys [2007-07-12 178872]
R3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys [ ]
R3 MSI2400;IEEE 802.11b Wireless Network Driver;C:\WINDOWS\system32\DRIVERS\MSI2400.sys [2003-07-04 49792]
R3 NETIMFLT;PANDA NDIS IM Filter Miniport;C:\WINDOWS\system32\DRIVERS\netimflt.sys [2007-04-24 142128]
R3 PavSRK.sys;PavSRK.sys;C:\WINDOWS\system32\PavSRK.sys [ ]
R3 PavTPK.sys;PavTPK.sys;C:\WINDOWS\system32\PavTPK.sys [ ]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9a3fae20-4779-11dd-ac97-000c76708b3c}]
\Shell\AutoRun\command - E:\setupSNK.exe
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\severin double\Application Data\Mozilla\Firefox\Profiles\tb0ji8vv.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.co.uk/
FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-25 07:34:51
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-10-25 7:37:26
ComboFix-quarantined-files.txt 2008-10-25 14:37:22

Pre-Run: 3,172,044,800 bytes free
Post-Run: 3,445,551,104 bytes free

764 --- E O F --- 2008-10-25 14:10:22
 
hjt log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:39:21, on 25/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\AVENGINE.EXE
c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAGE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\PavBckPT.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.inbox.com/?tbid=70037
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.inbox.com/search/ie.aspx?tb_id=70037
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.inbox.com/support/sa_customize.aspx?TbId=70037
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [\\Server\stylus-photo-rx500---cups+gutenprint-v5.0.0] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAGE.EXE /P52 "\\Server\stylus-photo-rx500---cups+gutenprint-v5.0.0" /O52 "\\Server\stylus-photo-rx500---cups+gutenprint-v5.0.0" /M "Stylus Photo RX520"
O4 - HKLM\..\Run: [\\LINUX-69V7\Stylus-Photo-RX500---CUPS+Gutenprint-v5.0.2] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAGE.EXE /P56 "\\LINUX-69V7\Stylus-Photo-RX500---CUPS+Gutenprint-v5.0.2" /O56 "\\LINUX-69V7\Stylus-Photo-RX500---CUPS+Gutenprint-v5.0.2" /M "Stylus Photo RX520"
O4 - HKLM\..\Run: [\\SERVER\Stylus-Photo-RX500---CUPS+Gutenprint-v5.0.2] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAGE.EXE /P52 "\\SERVER\Stylus-Photo-RX500---CUPS+Gutenprint-v5.0.2" /O52 "\\SERVER\Stylus-Photo-RX500---CUPS+Gutenprint-v5.0.2" /M "Stylus Photo RX520"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Internet Security 2008\Inicio.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe

--
End of file - 6387 bytes

cheers... sev
 
hi,

that looks like the the entire log. sometimes it helps to temporarily disable your AV when starting combofix, as you found out.

copy/paste whats below in the code box into notepad


Code: 
@echo off
dir /a h C:\WINDOWS\system32\en>>check.txt
dir /a h C:\WINDOWS\system32\bits>>check.txt
dir /a h C:\WINDOWS\system32\scripting>>check.txt
start notepad check.txt
cls

save it to your desktop as:
Filename: look.bat
Save as type: All Files (*.*)

double click the look.bat you saved to the desktop. copy/paste what opens in notepad in your reply
 
here's the output...

Volume in drive C has no label.
Volume Serial Number is CC22-7BAF

Directory of C:\Documents and Settings\severin double\Desktop


Directory of C:\WINDOWS\system32\en

18/10/2008 08:12 <DIR> .
18/10/2008 08:12 <DIR> ..
13/04/2008 17:11 28,672 microsoft.managementconsole.resources.dll
13/04/2008 17:11 40,960 mmcex.resources.dll
13/04/2008 17:11 6,656 mmcfxcommon.resources.dll
3 File(s) 76,288 bytes
2 Dir(s) 4,205,355,008 bytes free
Volume in drive C has no label.
Volume Serial Number is CC22-7BAF

Directory of C:\Documents and Settings\severin double\Desktop


Directory of C:\WINDOWS\system32\bits

18/10/2008 08:12 <DIR> .
18/10/2008 08:12 <DIR> ..
13/04/2008 17:12 409,088 qmgr.dll
1 File(s) 409,088 bytes
2 Dir(s) 4,205,350,912 bytes free
Volume in drive C has no label.
Volume Serial Number is CC22-7BAF

Directory of C:\Documents and Settings\severin double\Desktop


Directory of C:\WINDOWS\system32\scripting

18/10/2008 08:12 <DIR> .
18/10/2008 08:12 <DIR> ..
23/02/2008 07:40 11,776 cscript.exe.mui
23/02/2008 07:40 12,800 jscript.dll.mui
23/02/2008 07:40 5,632 msscript.ocx.mui
23/02/2008 07:40 9,216 scrobj.dll.mui
23/02/2008 07:40 9,728 scrrun.dll.mui
23/02/2008 07:40 11,264 vbscript.dll.mui
23/02/2008 07:40 10,240 wscript.exe.mui
23/02/2008 07:40 5,632 wshext.dll.mui
23/02/2008 07:40 7,168 wshom.ocx.mui
9 File(s) 83,456 bytes
2 Dir(s) 4,205,350,912 bytes free
 
hi doubleoseverin,

ok thanks for the info. as far as i can tell the combofix log and the hjt log look ok as far as malware goes. dont see anything to be concerned about in either one. did the defrag improve the performance any?
 
Thank you shelf life.

doubleoseverin this topic has been archived due to inactivity.

As it has been five days or more since your last post, and your helper posted a response to which you did not reply, this topic has been archived and will not be reopened. If you still require help, please start a new topic and include a fresh HijackThis log and a link to this thread.

Applies only to the original poster, anyone else with similar problems please start a new topic.


Previous topic: http://forums.spybot.info/showthread.php?t=34144
 
You must log in or register to reply here.
Back
Top