1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

"Congratulations, You Won!" Audio Virus?

Discussion in 'Virus & Other Malware Removal' started by vivalamusic, Nov 26, 2011.

Thread Status:
Not open for further replies.
Advertisement
  1. vivalamusic

    vivalamusic Thread Starter

    Joined:
    Dec 31, 1969
    Messages:
    20
    Hi, I'm new to this website. Anyways, it started yesterday. Even after I exited everything out including my internet browser (Firefox) and all my applications running on my laptop. It keeps saying, "Congratulations, you won!" randomly even if the ad isn't on the page I'm on or if I have nothing up on my laptop. How do you get rid of it?

    OS Version: Microsoft® Windows Vista™ Home Premium, Service Pack 2, 32 bit
    Processor: Pentium(R) Dual-Core CPU T4200 @ 2.00GHz, x64 Family 6 Model 23 Stepping 10
    Processor Count: 2
    RAM: 3002 Mb
    Graphics Card: Mobile Intel(R) 4 Series Express Chipset Family, 1309 Mb
    Hard Drives: C: Total - 294097 MB, Free - 204446 MB; E: Total - 11143 MB, Free - 1740 MB;
    Motherboard: Wistron, 3612
     
  2. Larusso

    Larusso

    Joined:
    Aug 9, 2011
    Messages:
    808
    Hy
    my name is Daniel and I will be assisting you with your Malware related problems.

    Before we move on, please read the following points carefully.
    • First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
    • Perform everything in the correct order. Sometimes one step requires the previous one.
    • If you have any problems while you are following my instructions, Stop there and tell me the exact nature of your problem.
    • Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
    • Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
    • If I don't hear from you within 3 days from this initial or any subsequent post, I will have to unsubscribe from this thread and move on to assist someone else.
    • Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
    • My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.



    [​IMG]
    Download DDS and save it to your desktop from here or here or here.
    Disable any script blocker, and then double click dds to run the tool.
    • When done, DDS will open two (2) logs:
      1. DDS.txt
      2. Attach.txt
    • Save both reports to your desktop.
    Please post both in your next reply




    Please download Gmer from here and save it to your Desktop.
    • Double click on the randomly named GMER.exe. If asked to allow gmer.sys driver to load, please consent.
    • If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO.


      [​IMG]
      Click the image to enlarge it


    • In the right panel, you will see several boxes that have been checked. Uncheck the following ...
      • Sections
      • IAT/EAT
      • Drives/Partition other than Systemdrive (typically C:\)
      • Show All (don't miss this one)
    • Then click the Scan button & wait for it to finish.
    • Once done click on the [Save..] button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post.
    • Save it where you can easily find it, such as your desktop

    **Caution**
    Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries



    Please post in your next reply
    dds.txt
    attach.txt
    ark.txt
     
  3. vivalamusic

    vivalamusic Thread Starter

    Joined:
    Dec 31, 1969
    Messages:
    20
    Thank you in advance.

    Here is the DDS:



    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\system32\WLANExt.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Windows\system32\svchost.exe -k hpdevmgmt
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Windows\System32\svchost.exe -k HPZ12
    C:\Windows\System32\svchost.exe -k HPZ12
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files\SMINST\BLService.exe
    C:\Program Files\CyberLink\Shared files\RichVideo.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\DRIVERS\xaudio.exe
    C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
    C:\Windows\system32\svchost.exe -k HPService
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Users\Ashley\AppData\Roaming\68991\79146.exe
    C:\Users\Ashley\AppData\Roaming\91B86\lvvm.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Windows\System32\hkcmd.exe
    C:\Windows\System32\igfxpers.exe
    C:\Program Files\HP\QuickPlay\QPService.exe
    C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
    C:\Program Files\HP\HP Software Update\hpwuschd2.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
    C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
    C:\Program Files\AIM\aim.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Users\Ashley\AppData\Roaming\Microsoft\4606\F16.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Windows\system32\igfxsrvc.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
    C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
    C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
    C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Mozilla Firefox\plugin-container.exe
    C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe
    c:\Program Files\MSN\Toolbar\3.0.0541.0\msntask.exe
    C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Windows\System32\ping.exe
    C:\Windows\system32\msiexec.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
    uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
    mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
    mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
    uInternet Settings,ProxyOverride = *.local
    uURLSearchHooks: H - No File
    uWinlogon: Shell=explorer.exe,c:\users\ashley\appdata\roaming\68991\79146.exe
    uWindows: Load=c:\users\ashley\appdata\roaming\91b86\lvvm.exe
    BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
    BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
    BHO: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
    TB: Microsoft Live Search Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll
    TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
    EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
    uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
    uRun: [HPAdvisor] c:\program files\hewlett-packard\hp advisor\HPAdvisor.exe autorun=AUTORUN
    uRun: [Aim] "c:\program files\aim\aim.exe" /d locale=en-US
    uRun: [Google Update] "c:\users\ashley\appdata\local\google\update\GoogleUpdate.exe" /c
    uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
    uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
    uRun: [F16.exe] c:\users\ashley\appdata\roaming\microsoft\4606\F16.exe
    uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
    mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun: [Persistence] c:\windows\system32\igfxpers.exe
    mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"
    mRun: [UpdateLBPShortCut] "c:\program files\cyberlink\labelprint\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\labelprint" updatewithcreateonce "software\cyberlink\labelprint\2.5"
    mRun: [UpdatePSTShortCut] "c:\program files\cyberlink\dvd suite\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\dvd suite" updatewithcreateonce "software\cyberlink\PowerStarter"
    mRun: [UCam_Menu] "c:\program files\cyberlink\youcam\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\youcam" updatewithcreateonce "software\cyberlink\youcam\2.0"
    mRun: [QlbCtrl.exe] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start
    mRun: [UpdateP2GoShortCut] "c:\program files\cyberlink\power2go\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\power2go" updatewithcreateonce "software\cyberlink\power2go\6.0"
    mRun: [UpdatePDIRShortCut] "c:\program files\cyberlink\powerdirector\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\powerdirector" updatewithcreateonce "software\cyberlink\powerdirector\7.0"
    mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe
    mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
    mRun: [<NO NAME>]
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [MozillaAgent] c:\windows\temp\_ex-68.exe
    mRun: [w8fRZ9hTXjClBzN8234A] c:\windows\system32\AV Protection 2011v121.exe
    mRun: [XA0uvS2ib3n5Q6W] c:\users\ashley\appdata\roaming\dwme.exe
    mRun: [F16.exe] c:\program files\lp\4606\F16.exe
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
    mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
    IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
    LSP: mswsock.dll
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
    TCP: DhcpNameServer = 192.168.1.1
    TCP: Interfaces\{D1A7D160-A066-4283-AA6A-D6E291EE1173} : DhcpNameServer = 192.168.1.1
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
    Notify: igfxcui - igfxdev.dll
    SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
    mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - c:\users\ashley\appdata\roaming\mozilla\firefox\profiles\9j1v10w6.default\
    FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll
    FF - plugin: c:\programdata\nexonus\ngm\npNxGameUS.dll
    FF - plugin: c:\users\ashley\appdata\local\google\update\1.3.21.79\npGoogleUpdate3.dll
    .
    ---- FIREFOX POLICIES ----
    FF - user.js: network.protocol-handler.warn-external.dnupdate - false
    ============= SERVICES / DRIVERS ===============
    .
    R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]
    R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]
    R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2011-8-11 116608]
    R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
    R2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\sminst\BLService.exe [2008-10-23 365952]
    R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2011-10-22 1153368]
    R3 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2008-10-23 193840]
    R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-6-29 112128]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
    .
    =============== Created Last 30 ================
    .
    2011-11-26 19:14:58 -------- d-----w- c:\users\ashley\appdata\roaming\SUPERAntiSpyware.com
    2011-11-26 19:04:10 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
    2011-11-26 19:04:10 -------- d-----w- c:\program files\SUPERAntiSpyware
    2011-11-26 19:00:19 -------- d-----w- c:\users\ashley\appdata\roaming\Malwarebytes
    2011-11-26 19:00:10 -------- d-----w- c:\programdata\Malwarebytes
    2011-11-26 19:00:07 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-11-26 19:00:07 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-11-26 04:45:27 111616 ----a-w- c:\programdata\Son83Ntr.exe
    2011-11-26 04:36:29 476904 ----a-w- c:\program files\mozilla firefox\plugins\npdeployJava1.dll
    2011-11-25 23:12:54 111616 ----a-w- c:\windows\system32\03D37iu.com_
    2011-11-24 18:41:20 -------- d-----w- c:\program files\PC Tools Security
    2011-11-24 18:33:06 -------- d-----w- c:\programdata\PC Tools
    2011-11-24 16:16:16 286208 ----a-w- c:\users\ashley\appdata\roaming\firefox.exe
    2011-11-24 14:23:41 -------- d-----w- c:\users\ashley\appdata\roaming\QQJ7dEK8gZhXjV
    2011-11-24 14:23:41 -------- d-----w- c:\users\ashley\appdata\roaming\klIBtzPNyAu
    2011-11-24 14:18:26 -------- d-----w- c:\users\ashley\appdata\roaming\FS2obd8fR9TqUrA
    2011-11-24 14:18:25 -------- d-----w- c:\users\ashley\appdata\roaming\J8fRZ9hTXjCIzxu
    2011-11-24 14:17:36 286208 ----a-w- c:\users\ashley\appdata\roaming\microsoft\4606\F16.exe
    2011-11-24 14:06:08 -------- d-----w- c:\users\ashley\appdata\roaming\pA1uvD2ob4m58R9
    2011-11-24 14:06:07 -------- d-----w- c:\users\ashley\appdata\roaming\vK8gRZ9hYwUlBzN
    2011-11-24 14:05:59 -------- d-----w- c:\program files\LP
    2011-11-24 14:05:54 286208 ----a-w- c:\users\ashley\appdata\roaming\dwme.exe
    2011-11-24 14:05:54 -------- d-----w- c:\users\ashley\appdata\roaming\nfRL9hTXqUeIrOy
    2011-11-24 14:03:56 -------- d-----w- c:\users\ashley\appdata\roaming\VqhYkeBtz0c1D4m
    2011-11-24 14:03:56 -------- d-----w- c:\users\ashley\appdata\roaming\S5sQJ7EK8R
    2011-11-23 22:47:50 2835968 ----a-w- c:\users\ashley\appdata\roaming\java.exe
    2011-11-23 22:27:49 -------- d-----w- c:\users\ashley\appdata\roaming\XWWK77fEL9
    2011-11-23 22:27:49 -------- d-----w- c:\users\ashley\appdata\roaming\jSSS2iibD3pG4QH
    2011-11-22 22:16:30 -------- d-----w- c:\users\ashley\appdata\roaming\91B86
    2011-11-22 22:16:24 101888 ----a-w- c:\users\ashley\appdata\roaming\microsoft\4606\240E.tmp
    2011-11-22 22:16:09 -------- d-----w- c:\users\ashley\appdata\roaming\T3GG44aQH
    2011-11-22 22:16:09 -------- d-----w- c:\users\ashley\appdata\roaming\qrrrzOONtxAucSi
    2011-11-22 22:15:55 -------- d-----w- c:\users\ashley\appdata\roaming\68991
    2011-11-22 22:15:50 -------- d-----w- c:\users\ashley\appdata\roaming\RppnGG4aQH6sK7E
    2011-11-22 22:15:48 -------- d-----w- c:\users\ashley\appdata\roaming\mFF44pmG5sQJd
    2011-11-22 22:15:47 -------- d-----w- c:\users\ashley\appdata\roaming\dZ99hhYXwjUV
    2011-11-22 20:17:49 6668624 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{3510a141-4214-4d11-8627-a15ae38768b5}\mpengine.dll
    2011-11-20 03:43:03 -------- d-----w- c:\program files\iPod
    2011-11-20 03:42:57 -------- d-----w- c:\program files\iTunes
    2011-11-15 23:01:48 -------- d-----r- c:\program files\Skype
    2011-11-14 14:27:26 4335776 ----a-w- c:\program files\mozilla firefox\extensions\{82af8dca-6de9-405d-bd5e-43525bdad38a}\components\SkypeFfComponent.dll
    2011-11-12 18:56:19 -------- d-----w- c:\programdata\AVS4YOU
    2011-11-12 18:56:07 -------- d-----w- c:\users\ashley\appdata\roaming\AVS4YOU
    2011-11-12 18:53:39 -------- d-----w- c:\program files\common files\AVSMedia
    2011-11-12 18:52:03 24576 ----a-w- c:\windows\system32\msxml3a.dll
    2011-11-12 18:52:02 -------- d-----w- c:\program files\AVS4YOU
    2011-11-11 22:07:40 -------- d-----w- c:\programdata\Wondershare
    2011-11-11 22:07:11 -------- d-----w- c:\program files\Wondershare
    2011-11-08 20:00:44 2409784 ----a-w- c:\program files\windows mail\OESpamFilter.dat
    2011-11-08 20:00:36 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys
    2011-11-08 20:00:20 707584 ----a-w- c:\program files\common files\system\wab32.dll
    .
    ==================== Find3M ====================
    .
    2011-11-12 14:21:22 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2011-10-03 10:06:03 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2011-09-11 16:31:00 505392 ----a-w- c:\windows\system32\msvcp71.dll
    2011-09-11 16:31:00 353840 ----a-w- c:\windows\system32\msvcr71.dll
    2011-09-11 16:30:59 1066544 ----a-w- c:\windows\system32\MFC71.dll
    2011-09-11 16:30:59 1053232 ----a-w- c:\windows\system32\MFC71u.dll
    2011-09-06 13:30:12 2043392 ----a-w- c:\windows\system32\win32k.sys
    2011-09-02 13:39:07 1383424 ----a-w- c:\windows\system32\mshtml.tlb
    2011-08-31 03:05:04 83816 ----a-w- c:\windows\system32\dns-sd.exe
    2011-08-31 03:05:04 73064 ----a-w- c:\windows\system32\dnssd.dll
    2011-08-31 03:05:04 50536 ----a-w- c:\windows\system32\jdns_sd.dll
    2011-08-31 03:05:04 178536 ----a-w- c:\windows\system32\dnssdX.dll
    .
    ============= FINISH: 15:44:31.86 ===============

    Here is the Attach:

    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 287 GiB total, 199.36 GiB free.
    E: is FIXED (NTFS) - 11 GiB total, 1.699 GiB free.
    F: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    .
    ==== Installed Programs ======================
    .
    32 Bit HP CIO Components Installer
    6000E609_eDocs
    6000E609_Help
    6000E609a
    Acrobat.com
    Activation Assistant for the 2007 Microsoft Office suites
    ActiveCheck component for HP Active Support Library
    Adobe AIR
    Adobe Flash Player 11 Plugin
    Adobe Flash Player ActiveX
    Adobe Reader 9.4.6
    Adobe Shockwave Player
    AIM 7
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    Atheros Driver Installation Program
    Bonjour
    BPDSoftware
    BPDSoftware_Ini
    BufferChm
    Cisco EAP-FAST Module
    Cisco LEAP Module
    Cisco PEAP Module
    Compatibility Pack for the 2007 Office system
    Conexant HD Audio
    CyberLink DVD Suite
    CyberLink YouCam
    DeviceDiscovery
    Download Updater (AOL LLC)
    ESU for Microsoft Vista
    Google Chrome
    GPBaseService2
    HDAUDIO Soft Data Fax Modem with SmartCP
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    HP Active Support Library
    HP Customer Experience Enhancements
    HP Customer Participation Program 14.0
    HP Doc Viewer
    HP DVD Play 3.7
    HP Help and Support
    HP Imaging Device Functions 14.0
    HP Officejet 6000 E609 Series
    HP Quick Launch Buttons 6.40 H2
    HP Smart Web Printing 4.60
    HP Solution Center 14.0
    HP Total Care Advisor
    HP Update
    HP User Guides 0118
    HP Wireless Assistant
    HPAsset component for HP Active Support Library
    HPNetworkAssistant
    HPProductAssistant
    HPSSupply
    HPTCSSetup
    Intel(R) Graphics Media Accelerator Driver
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 29
    Java(TM) 6 Update 7
    Juno Preloader
    LabelPrint
    LightScribe System Software 1.14.17.1
    Malwarebytes' Anti-Malware version 1.51.2.1300
    MapleStory
    MarketResearch
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft Live Search Toolbar
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Home and Student 2007
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office PowerPoint 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office PowerPoint Viewer 2007 (English)
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Publisher 2007
    Microsoft Office Publisher MUI (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Word 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Silverlight
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Works
    Mozilla Firefox 8.0 (x86 en-US)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    muvee Reveal
    My HP Games
    NetWaiting
    Network
    NetZero Preloader
    Nexon Game Manager
    Norton Internet Security
    Power2Go
    PowerDirector
    ProductContext
    QuickTime
    Realtek 8169 8168 8101E 8102E Ethernet Driver
    Realtek USB 2.0 Card Reader
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
    Shop for HP Supplies
    Skype Click to Call
    Skype™ 5.6
    SmartWebPrinting
    SolutionCenter
    Spotify
    Spybot - Search & Destroy
    Status
    SUPERAntiSpyware
    Synaptics Pointing Device Driver
    The Sims™ Life Stories
    Toolbox
    TrayApp
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
    Update for Office 2007 (KB934528)
    WebReg
    .
    ==== Event Viewer Messages From Past Week ========
    .
    11/26/2011 11:41:45 AM, Error: netbt [4321] - The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.1.4. The computer with the IP address 192.168.1.5 did not allow the name to be claimed by this computer.
    11/26/2011 11:21:04 AM, Error: BROWSER [8009] - The browser was unable to promote itself to master browser. The computer that currently believes it is the master browser is YOUR-0CDC4F5844.
    11/26/2011 10:59:09 AM, Error: Service Control Manager [7001] - The Windows Firewall service depends on the Windows Firewall Authorization Driver service which failed to start because of the following error: Cannot create a file when that file already exists.
    11/26/2011 10:59:09 AM, Error: Service Control Manager [7000] - The Windows Firewall Authorization Driver service failed to start due to the following error: Cannot create a file when that file already exists.
    11/26/2011 10:59:09 AM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    11/25/2011 3:03:55 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the W32Time service.
    11/25/2011 3:03:25 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the FDResPub service.
    11/25/2011 3:02:55 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the LanmanWorkstation service.
    11/25/2011 11:45:10 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the netprofm service.
    11/25/2011 11:44:40 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the fdPHost service.
    11/24/2011 9:43:43 AM, Error: Tcpip [4199] - The system detected an address conflict for IP address 66.159.147.218 with the system having network hardware address 00-18-DE-7A-2E-8C. Network operations on this system may be disrupted as a result.
    11/24/2011 9:23:43 AM, Error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{D1A7D160-A066-4283-AA6A-D6E291EE1173} because another computer on the network has the same name. The server could not start.
    11/24/2011 9:15:17 AM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 69.0.27.239 for the Network Card with network address 00242C1FC72A has been denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).
    11/24/2011 9:05:09 AM, Error: Tcpip [4199] - The system detected an address conflict for IP address 69.0.27.239 with the system having network hardware address 00-18-DE-7A-2E-8C. Network operations on this system may be disrupted as a result.
    11/24/2011 12:55:43 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Netman service.
    11/24/2011 11:33:50 PM, Error: disk [11] - The driver detected a controller error on \...\DR1.
    11/24/2011 11:33:12 PM, Error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly. It has done this 1 time(s).
    11/23/2011 1:10:02 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.33.104 for the Network Card with network address 00242C1FC72A has been denied by the DHCP server 192.168.33.1 (The DHCP Server sent a DHCPNACK message).
    11/19/2011 10:39:43 PM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Apple Mobile Device service, but this action failed with the following error: An instance of the service is already running.
    11/19/2011 10:38:43 PM, Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    11/19/2011 10:38:24 PM, Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    .
    ==== End Of File ===========================

    The ark.text will be posted shortly after the scan is done.
     
  4. Larusso

    Larusso

    Joined:
    Aug 9, 2011
    Messages:
    808
    Any problems with Gmer ?
     
  5. vivalamusic

    vivalamusic Thread Starter

    Joined:
    Dec 31, 1969
    Messages:
    20
    No, just took a really long time.

    Here is the ark.text:

    GMER 1.0.15.15641 - http://www.gmer.net
    Rootkit scan 2011-11-28 06:20:07 <--- I'm not sure if that's suppose to be there...?
    Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD3200BEVT-60ZCT1 rev.13.01A13


    ---- System - GMER 1.0.15 ----

    SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS ZwTerminateProcess [0x8FEDD640]

    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
    AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

    ---- Registry - GMER 1.0.15 ----

    Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\AC5F6FF803E4B3E49B1502C4AA2A17A6\[email protected] 1065027686

    ---- Files - GMER 1.0.15 ----

    File C:\Users\Ashley\AppData\Local\Mozilla\Firefox\Profiles\9j1v10w6.default\Cache\1\14\40196m01 1361 bytes
    File C:\Windows\$NtUninstallKB5054$\1120660564 0 bytes
    File C:\Windows\$NtUninstallKB5054$\4030260102 0 bytes
    File C:\Windows\$NtUninstallKB5054$\4030260102\@ 2048 bytes
    File C:\Windows\$NtUninstallKB5054$\4030260102\bckfg.tmp 703 bytes
    File C:\Windows\$NtUninstallKB5054$\4030260102\cfg.ini 207 bytes
    File C:\Windows\$NtUninstallKB5054$\4030260102\Desktop.ini 4608 bytes
    File C:\Windows\$NtUninstallKB5054$\4030260102\keywords 0 bytes
    File C:\Windows\$NtUninstallKB5054$\4030260102\kwrd.dll 223744 bytes
    File C:\Windows\$NtUninstallKB5054$\4030260102\L 0 bytes
    File C:\Windows\$NtUninstallKB5054$\4030260102\L\qnbwvoto 67072 bytes
    File C:\Windows\$NtUninstallKB5054$\4030260102\lsflt7.ver 5176 bytes
    File C:\Windows\$NtUninstallKB5054$\4030260102\U 0 bytes
    File C:\Windows\$NtUninstallKB5054$\4030260102\U\[email protected] 1536 bytes
    File C:\Windows\$NtUninstallKB5054$\4030260102\U\[email protected] 224768 bytes
    File C:\Windows\$NtUninstallKB5054$\4030260102\U\[email protected] 1024 bytes
    File C:\Windows\$NtUninstallKB5054$\4030260102\U\[email protected] 1024 bytes
    File C:\Windows\$NtUninstallKB5054$\4030260102\U\[email protected] 12800 bytes
    File C:\Windows\$NtUninstallKB5054$\4030260102\U\[email protected] 97792 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0BUZIJKG\Q84CAFMC2L9CAKYMQXRCA0DSU2LCA0QA5M2CAWBGLNWCAOYD3AYCADZCY7DCAK24AHHCAYL24LJCAAA2BFOCAA2LZG9CA9FX8K1CAXJ3L0DCA8BNAVHCAFYW7MZCAES19TY.htm 445 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0BUZIJKG\AFZKG00CA9JQYDZCASE0CAWCA5OG2LOCAFEO110CADM5YXECAEV1J4ACA2B6HB7CAEOSCOWCAM2FV7SCAWIJ614CAHGRCQWCAWDSXMLCA5W2NRUCAY3Y8XTCAPRM5W6CARP678M 4475 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0BUZIJKG\naNy-PS2iP8[1].js 13997 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0BUZIJKG\W4PCA36QX5NCAIH7ZPNCA3VFMWZCAWH06GFCAEWAD56CALIBY2PCA5QVWNSCASFTD87CAECWT8YCAL5Q3TRCAEKKKNXCA8MYZTMCAAQGI43CA9R13HOCAIBCLTOCASFMV7F.htm 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0BUZIJKG\AJ6FXDCCAVZ2TMUCAD7WVZBCAZ44RN5CAVHMEKNCALLYMJBCAJF7SXTCAZO7TN7CA7FQ0PFCATA7YB9CAZTWS0ACAH6Q87JCAVDK151CAMBUYQICAJES7BQCAONCAFACAV2W99Q 4463 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0BUZIJKG\A0L54C0CAI481IVCA0UDR76CA32HD60CAGC20DRCAKT7RWOCA11KJCECAJU5F16CAVZTDITCAJXP27SCA0KWMSNCA3U7V4ICAE0QHY5CAZBO9LHCAEKZZ12CAMAQAL7CALU5CAA 1304 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0BUZIJKG\bounce[2].htm 687 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0BUZIJKG\3KFCA587952CA0CK9JHCAA51S8TCAHQXVCICA73YN1BCAQYQ46FCA9YAERICA0P7G54CAQU523PCAM5H0U0CATGF7QECABPPISICA86V5SWCADK906YCAP7FU7LCAZEWNZ7.htm 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0BUZIJKG\AT1WBE7CAR0O0TOCAKOL332CAJ7PAITCASK3NYGCA1Z28Q9CA0CYZKOCA2KJNVQCAP6K8JCCAWPXTXXCA3SAQHYCAF743V4CAGFF529CASD1H4HCA41M2FNCAQXF9CMCAQFPTVM 4469 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0BUZIJKG\AT4977VCAVGTPEKCAMOZXVTCA8P2X8ACAFFW7AXCAZ2FL33CA8YXWGQCAICDPKNCAP0K3YXCAXU6C6QCA0W9Z1BCA0XA8ZVCAHJ5N5NCAHMA59FCAZ9UFUUCATYIYI8CAMY0D2Z 4185 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0BUZIJKG\CHYCAMUDYISCA6FN6X2CAJE8GSOCAD8K79UCAL9OB13CAVXFKPYCAY9H9MSCASH2K2NCA3VISE0CAILQW85CABQ66CYCAFRZ2TLCAZDSQ7UCAGZTXD4CA4MCL2ICAC8GXXD.htm 791 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0BUZIJKG\A19QVA2CAU6CK1SCAQY2DVNCAQLUP10CA6KKTVMCAKUQ1G3CAZGU1QKCAUTAGV2CA6W0OE0CAVARWVHCAX5U0PNCA08XI19CAX30YTNCAJ37Z2ZCA3B26RZCA8KQ5L8CAYNNJHJ 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0BUZIJKG\ajsCABIK6UV.php 5213 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0BUZIJKG\ajsCAL2QKSY.php 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0BUZIJKG\ADWMM1LCAL0IQF3CAOLKDW3CAVJHCR6CAY1V1G5CATEVOQJCA94WX77CAJA3FYECAZA2J0KCAF7S9FTCA7XG1J4CAUZJC51CA1CTGTMCA1SAZKZCALFM63ACA26WUD3CAMUJ8SG 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0BUZIJKG\1YPCAXPEWX8CAQ0DN63CAQ1OC20CA4XLRB0CA44FRXCCAIPVSQGCANBSEOOCA5RI5JCCA64E92ICAMFWENICALRJN83CAHHOTYTCAOGMWGLCAK3ZIWSCAWAOB13CAOUU4I8.htm 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0FQ93YPB\pss01_720x300_0408ext[1].swf 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0FQ93YPB\cal-20216088965_1322426665,1240a875540b83a,ads,;;sz=300x250;net=iblocal;env=ifr;ord1=807950;cmw=owl;contx=ads;dc=d;btg=;ord=75102befde[1] 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0FQ93YPB\AQ2G0J2CAQLNV6CCAC86D64CACSTP6OCA20FP9JCA7ACGPRCAUSSC08CA1Q53TQCAX1BLLACAFKZR0VCA81GO04CA7U2XDLCAZFGGTTCADNRC59CAH5NPUSCA84KFOACAMHZ4PB 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0FQ93YPB\APAEOPFCAD1N0L8CACGJIUZCAJO5XXBCAKAT112CA54F5KQCA5X31A1CAX440QSCAWKUP9PCA9EPZ2OCA6X4GUVCAEI7G25CAJ19TLOCADCCNGRCAXTANELCADATNWACAXJWFPJ 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0FQ93YPB\A7ITDGNCA10YIIHCAPKRQUQCA3FMJKUCAUDIJWHCAVEY421CA6M7P5ZCAGXQWRHCAXJQ7V6CA6KC793CAXAPDC2CAT801U3CAGT8HQVCABOPTU7CA958Q6SCAD1P6Z3CADJ34I7 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0FQ93YPB\AE4PFOTCAB84WL0CAZM5754CAJ7JB7HCAMKVQADCAOHN1MYCAE376DZCABMI7F2CAFOBDNFCAP40LGYCA2U9HIWCARI3BWJCA113S2ECAJXRT6ICAK8IWJGCAJT1H9FCAHNRCA8 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0FQ93YPB\AAMEHLNCAFDHDZLCAM5TEPOCA2477OLCA76E5WXCABMEIV5CARAMF3JCA4KOG7GCA48QECCCA7IX46BCAFI304QCAUFU9MCCAYN70GVCAE0X12QCAA6K0VWCAIRRLM6CAJKA9UW 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0FQ93YPB\ajsCAJVO3MA.php 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0FQ93YPB\eventCA85DWGO.flow 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0FQ93YPB\A34K10CCAPOPPLQCATW25PVCAFCYN5KCA2KD8CJCALJIFE6CAW2WZ6NCAGKDXDQCAIAVQTICAJIFPJNCAEOOQZ7CAZ8MEX3CADHQ385CAQ5N6N1CAZ3TAFTCANZ7RYZCAH8MSKQ 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0FQ93YPB\ASIQ28RCAQ1K7RXCA04MK2BCAM1NSNCCA1UVQW0CA0DKEYWCAMZ67ONCADF5MLRCA68SXKECASPNP94CAX7QMX9CAYA6T8HCAYHIE52CAI015F6CAZE48DYCAX5RVSICA4VAH94 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0FQ93YPB\audience;sz=728x90;ord=0fcd98daa5[1] 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0FQ93YPB\7HYCAN4STQZCAS0TYJLCAB55VSICAJR4Y12CAXNJYX4CAJWTA02CACEPNX6CATQGFOBCAYCIJOOCALJOS1TCAWHXCDKCAL4QQJ0CAFV3L8QCAZWHNS5CAS8TLCHCASOZL30.htm 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0FQ93YPB\x113[2].htm 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0FQ93YPB\AL53N4OCASEVMEGCA58NYZUCAWYOHX8CA3KWEG6CA75NWCICA5ZEV3HCA0ADYYDCACTBYNSCABOKL33CAR22BSYCAD77WUUCAQQNS37CA58JLMOCA4F08W7CAHIR7JCCAUQSS74 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0FQ93YPB\A82JXEWCAG6YR22CAC6P5J5CAKWQGVPCA3DGKK6CAWBOS5ZCAE9YINQCA6VR5INCAJL2HARCA20AO36CA84PIVQCAB0EW9KCAUG2O4SCABFA5K3CAHW9PX8CAAMJNFNCA3D2SG3 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0FQ93YPB\ajsCA018B5C.php 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0FQ93YPB\ajsCA223D29.php 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0FQ93YPB\tag[3].jsp 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0FQ93YPB\ajsCATWCCB5.php 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0FQ93YPB\ajsCAMDHOIY.php 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0FQ93YPB\A69ZWFRCAZP70S1CA12NKYWCALV0VE9CAH53DV2CA6GO4B7CATWN94YCAYS7X6SCAQNRBH9CA7RSK32CA3F2I5NCANVL4P0CA916XV0CARQYWI9CAIBP86KCARPAFPUCA09E13Z 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0FQ93YPB\A4J5U9ICAOOTBN8CAANJXHWCA1JV9NXCAYK5UQCCAOUJT20CA9MA244CAVESWPWCAKCYMIKCAVC3AH4CA5OO2H2CAWH100HCAVSTF8MCAHGUHUFCA7RR15NCA2L4FZFCAB55N53 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0FQ93YPB\AHWKJBCCA36215WCAF0LRI4CAICNWLUCA3SAGKYCAZ083ITCADK5V65CA1VM3TOCA4BOVTUCAW5B1JPCA2TR9U7CAECAL8WCAREHQYMCA5OSDCMCA12MIHRCA75B3URCA39JZW6 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0FQ93YPB\AQC1DK7CA4348PFCA94WUMZCA196BHACAPPHXF3CAP3RJ2BCAHP1T52CAR00M7YCAYW4YMKCA28CVXJCA2MVYGQCAU5RQLSCAH5HO3NCA9EZ960CAXR05W4CAXSRGCRCA0SI2XJ 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\49OAZQMC\ca[9] 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\49OAZQMC\ANLHGXTCAY7I84GCAAN1844CA2382QACAONAYL0CAWHKPBCCAYL2QF1CAP68E2RCAAPI6B1CADAST91CA33X1NZCAV1H184CAGL4RQFCA8X5SG2CA9W2XW0CALPQC7FCAXYMSDS 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\49OAZQMC\AM8PXBNCA0SL592CA8LH7BRCAF30Y6UCA0A8PD1CA44V6KCCAJ55DFUCAKABY0ACA1NHHGHCAFWX5HPCAP8QS61CAHI3H29CA8BGZD5CAZYAD3KCAB2BW89CAV2JBP9CAL70GJK 757 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\A7VTE5PCANX0K8VCA5P0C26CAWHU606CAFXICY7CAIQASS0CA3TQUPKCA8WXONPCAM2KYR4CA50ZK2ZCAJXUA0JCAH4SRU8CACKV0CHCA7199Z0CA6GEWN2CA1B6VW2CA7KRLKF 1439 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\a612395f84e2ccda3e2f95dde0511b7a[1].gif 17313 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\ci[1].png 1525 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\A3R7PORCA2UIO0VCA14WR4NCA9APHV7CAJEZGOBCAICB057CATONRHJCA51TLTXCATZ87YQCAJ6PVLBCAH6INKMCAEH9HJHCAF2U4BNCA52HSHTCA7YJ3AKCAWNZU6ZCAWIGKRE 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\AR5SGTICARL0D5LCATQAZY2CA9D5I1NCAAX1LCDCAMEEZDACA30B3IHCA4XJY6NCAYVJIJZCA1ENMQMCAVZX5YDCAW0OM7FCA9B3Y22CAORVZF6CAINCPRJCAE04355CAYCJY6N 4466 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\data_sync[3].htm 508 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\A06T0AWCAI80M9HCAUERA4KCAUQOZZ8CAEAUTXACAZ19JP7CAVQOTP8CANJLMTRCA8C55CNCAP5EKBICALN3HTDCA5PNURRCASA0KW5CANSK3WOCA2QM8Q1CA3B9G2GCASWFCQF 1411 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\A3G3IDQCARU8NHBCAXKXTVXCAZDTX4HCAQ41BWQCATYDLSBCAFV8SGXCA2QMFE3CA259W33CALE1YX6CA1AR5TPCA05XHTACAWDUFSICATDQEKLCAJZEJ3MCAC6RYOHCAHV5FP5 761 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\AP6BFE9CAX6B879CAE3E6WYCAX9GUVKCAV0C301CA9OITJOCADK6HDVCA4OIU2LCAXWO1MPCALD8N23CAN9YE6NCAYUGVF6CA1ERTV6CAKA23RDCA733W83CAT5BPVDCA94R91J 763 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\AT8LHQPCA8SLKZ2CAJYACJICAO9RFBCCAO5QH88CA6MT90DCAMCNSL1CARKW69ZCAKL6INTCA1D6B1QCA8OHZO8CAOHY9UECA68GZJ5CA6KDXC0CA9Z8543CAQL7KSICAGGOSGU 4472 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\ATQ04QECA4M0VFHCAFHBH0YCA0UMKOQCA6HJVTYCAPF1936CA9FACHXCACBP0RDCAXFFF7JCAMCFNABCABKJWI3CA4ABLHKCADTX923CAHGOW1NCAJL0CDXCAEMD39VCA1NXIU2 1037 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\adtrackJ96d70a01ff7d18e221e32fc459fa3166[1].js 8351 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\AD01TKPCAGL3412CABVNTVDCA7NKNVQCA0M1718CAVIWC93CA5M54RFCAOWUSCFCAP7Y5QVCA25ME2HCA5WWCIGCAWT61YICAK5XNROCAQ90QB6CAKHVUB8CASUKYZPCAWZG4MF 4182 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\AD0AVPWCAF8EJWUCAGO1JA7CA0HDD87CA6W1NTHCA7ZW1TZCAI0ZR07CAC74WFICAA2284VCAP54F3KCADKTAGRCAALEHI6CAWYY1KMCAYICIHRCA5W8XL4CAOSQ7ZECAXV1IJ1 760 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\sports[5] 3560 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\vh[6].htm 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\AFSKORZCA2WNCA5CAM5DQ8WCAGHNXP7CA5LUI0KCA84DX1UCA756J0ACAPF7TP6CAJEP1R1CAEB0GYGCAV6S6XXCAJG1K6TCASC7PUZCA7SM399CA3HBW5JCAEAGJNCCAQPSAVR 1024 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\A8Y5WYOCA7LMLN1CA6ZWE6VCA1OZOC2CA5YW7FSCA69PEYJCALN6VV1CAL4KSUQCAH70PZACAOIU4ADCA0JAZJ4CAD91DIMCA072W8LCACHGR51CAJ1GW2TCAHVDTE9CA89707E 4457 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\AW0Z0A9CAE62FUKCABJ755BCA36MW16CAIJEJYVCA71EZFUCA0UISRYCAPBYH79CAYFM25WCAAT8O2QCABRY9UACAO62JFVCAHMH65ZCAUJD3AQCA1Q41PTCADF22Q9CA7RGL50 1019 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\A1O9QMWCA4DEN1WCAX1VOA4CA1NAVFPCARO0TAWCAXI0HR4CA2WG34ZCA0ZLY26CA7SE4SKCAJLIPQMCAUWROWMCAPN2EVNCAZRNSS1CAXMC5I1CAXXPTT3CA8XOJXBCASHFF1R 763 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\ACKWLN2CALHLZ93CA1WWZ1VCAAV9WEUCA76JU4WCAED0I0RCACARL5SCACPEFLLCAFD1DYDCA99KHY8CAWEND9KCAYPF85NCA3Q0NTUCAMI6FVDCAX2SBPHCAVS8QOPCAK2Y318 1401 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\A97IF3XCA250HOLCAJA6ETOCAQ7UJ9TCASBX1YRCAICZEIOCA9A6DN0CAO0T70CCAJKRD08CAOPT9RICA30W66GCA7M0W3XCAWJY3N4CA02OS8ICA8SAQATCAM1RPYWCADD58P1 895 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\FB7CADOMZ45CA1SYNKOCAKTGDE2CAVC0P1KCA65LGNHCAXGFV66CAVUWXSZCAHHB5YACA5N157GCA0A35STCATIUEMRCAEN0U6ZCAEWTDK9CAC7BF7NCA41G4HICAEMZ12I.htm 523 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\ajsCABTX70Y.php 4121 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\ajsCAEFA6BC.php 5010 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\ajsCAFVR6DM.php 4093 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\ajsCAFWEQID.php 5048 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\ajsCAG6R4T3.php 5199 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\9FGCADL32FTCAGAZLI8CAV5T42KCA4XOFG7CATKJKNJCAY2HVVUCAUEV3R9CAR1SWV6CA1Z4T59CA6350DZCATBNHAXCA4JT95NCATGOH9BCAT5E91YCAJTJ1FUCAHOAB1I.htm 659 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\AUZKFLGCAQMTA7VCAI9NK3MCAQLI1LFCADSVOTRCAG6IE45CAR68BU5CAQS7B39CAP3F0RACAO314L8CA7P3NILCAQHKGPTCAWOHBFUCASS0HPDCAPYD8QVCAFWG2SJCATUVFTO 424 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\ANZTF0VCATJHNTNCAOAIMS1CAJY7PJMCAXJO452CAWWUE9TCANCNGM9CAD3HIBSCAN6RH61CAR7KMA3CAISNIATCAYIKZRMCA8V033TCAPGAXS2CAATU9BJCAMBAVISCAM7XEWK 4184 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\A5DOMQ9CARRLHI9CAL0OORFCAJYOTKXCAKP6FC9CAS356UFCAXJY5PCCA0R2DO1CARJS8TSCAMKT0J5CARU07SZCANWVRVFCA23DH3ICAHYACD9CA3RRUZ6CAPWDUH3CAZP37UC 379 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\AGEHUCKCASZHXD6CARCDGO8CAYFSU4ACAAZNLANCAO5V09PCAO97QKJCAXOO1LHCA5C57XQCA05524UCA5ZPDVUCA7HF93ECAQHMRF5CAOR0LBSCAJRHBV4CA3365PACADIM9QY 1415 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\audience;sz=160x600;ord=e5131d2201[1] 437 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\audience;sz=300x250;ord=3e351ce8fb[1] 437 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\AUEYBM5CA3GOAB6CAKL32SLCA48VLXHCALPI531CAEJNQPUCAAMZ83ICA3GJHAYCA2R538JCA5HHGLECAUWK5L1CAVNR1VICATF40BVCA83AAAHCA2KPN3SCAIY7QXTCAMWO6C1 859 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\acbj[2] 882 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\AH4JTK1CA2AAHGJCA8FH5W1CA5PVSC0CA4NUF1ACAVD5BN8CAN58ZI8CA1P99HYCAEO3BV8CAFP3X1XCAWOZ2YTCAKPIXCZCAEI64RKCA1E7TS2CAFT47U3CAYC47OUCAI6RFHY 1314 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\A3HJLRLCA9QOI4CCAA371P9CAKA1SSVCA509M64CAIU8ZMHCAWR9MM4CAZILE7CCATOIR7FCARFPE6XCA17GHVKCAWNR1TOCA1LYUQFCANRV6DECA4DBULPCA233ZBDCAE0FKZO 4475 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\A3MNHBECAMHTF82CAALSUWVCABVA4GWCAG7J36YCAQT71RUCATJ69GICAMEQCYGCAKJFPHVCA7ENN24CA94GHXXCA86ME7RCAVU0SYYCAURXP08CASCX668CAMPV917CAQD0YZW 1047 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5SPMBM3M\YUPCA55N2PJCAOMWME5CAY6CTDDCAFQIRJ8CAIU580OCA7NPSXUCAMJU8S9CATTV5ZFCA6KJ8KUCA7OLFT5CAKEZ047CALO09T7CA3EBYCQCAZ5GU3QCAKZQBG3CAFL045B.htm 290 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\json[3] 28 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\json[4] 28 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\ABTELNNCAP7N8RWCAYY2X3DCATZPX81CAQLVHRNCA6T1JA8CA49GLQYCA3SNRZSCA791PV2CABCB3FZCA7DFDC5CA5HFOHRCAEXZDDUCAICOEYQCA98BB1VCAA54GARCAUDGZID 760 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\DZICAZB5N9KCAQRC58DCAH1XZODCAVAUDZGCAOPK8Q3CAZJZAGQCAWHENY1CATT3Q0CCAE31HB4CAYZITTXCAGMWPB7CA7O1THGCA6J5GR4CASW83TWCAPGZJW3CAFVURF7.htm 1603 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\mickle_tier2_atf[2] 1402 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\display[1].htm 8322 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\FFMCAWZM7NICAOAZUJ8CABMYK0PCAGSGWW1CAK4PE10CA1RYY8RCAQVIGIACAJ236EHCA1K1TYRCALC7T87CAEXFYTJCAGPB2R6CAQD639QCA4K9THMCAN57C39CANJMB8N.htm 507 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\aa9346b8c886174e9c84e7c75d4b0176[1].jpg 27299 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\ARHTLOOCAULEUELCABH4Q81CA1DQ4SGCADRYYV8CAIM4RLNCA1RXL1WCA26QL5SCAPHTPZWCAABK9T1CAIAJX01CA21RU9XCALDUHRGCARMKUATCA65T8OYCAFPHSC2CAY3ZE5X 1420 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\EE2CAGCVB56CAS1VOI8CA55J9RBCAHCCMS2CA2KPX6YCAEVF23KCA2RG5VACAPUOUZ8CA8VKE69CAY2X6K5CAXL9XI9CAENRC95CAQCQT1BCAO29S33CA5UHFCPCA21YI0Q.htm 739 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\visit[1].js 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\WLPCA9GPFFFCA10X7OJCAN2N73ECAZKEMNRCAWS95ECCATNCXGNCAWZ1IU0CAKYW0YLCA8UA43LCARPJ7PKCAQTCTWHCA79YM6JCAMAD7MHCA8HP2GNCA1RVF9ICAURQLUK.htm 867 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\ajsCA7G8R6M.php 5207 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\ajsCA8B97Y0.php 3613 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\AUKYDSUCA0FBHWLCAUD7RTYCA73CGA5CAYY59V6CAPAQOWOCA0OBIYJCAANHK2KCAL6BHPNCAK6SFDDCAJ333U3CAW88YRACA20VCVNCA7WVR4YCALDV0WYCAJK6LVACA6RA8G0 900 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\48f2a1e5acd06b7d92fcfe166036728b[1].jpg 3647 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\aT02MixzPTcyOHg5MCxuPWlmcmFtZSxiPTA=[1].htm 532 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\j[4].ad 372 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\A3ZJFX8CABUYW40CAI677J2CAJU78JWCATR2N31CATYXFYCCA3ZI8EZCA2EIGIOCAZHTGI3CAF9MHDZCARAUA46CADW0CWZCAS6829ZCAPIXYIPCA1YB4AZCAEATSY2CAAJ3OY0 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\AVLMVD8CA7C12WLCAQ9OAMSCAE0QJLHCAIUE3LBCAAA1B5YCALB4IN7CA3Y6ZJQCACIYR4MCABBD0C3CAAL7SAHCAF58501CAOKKWTMCA9K7FPPCARGJLY2CA1UT533CAOORV04 768 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\2H5CAKZ8TDCCAW5XZ1ACA38SXNHCAK6EUA2CAD9KYZDCAYHP8B4CAC4STU4CAQ0VW6QCA4X4NMSCAN1D8BPCAE2E8BTCA0G7SARCAKKTVJUCAGOH0JSCAFF52GDCABJOBMC.htm 542 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\AU21YR8CA4LKBRACATTU5O0CA6B9GDSCAHNSFJ7CAODVDHYCA54GZ2NCA7IV8FJCAGL0ABICAZMC00XCAAOFUN4CA873N5ZCATLSOA1CAZ0IOPACAE0WN05CAM6IP9OCAW6PG4Y 4460 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\A8X0GFICA9OCZJNCANB4JTNCADKIJ13CAG3ADV9CA3OBOI6CAJG3APVCA6K1QW1CAS03IW5CAJB7SPFCADYOK3CCAA66DN9CALGMACPCA3WQG0KCA7QXQ3WCAFN61HGCAVU8D4I 4451 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\AVJY7ZWCASGY44CCA4F4D2SCAI59H2VCAARRW88CAMUE67XCAU128E8CA2429W4CAJB4OSBCANYTWO1CAB3442ACA5SE3QLCA412CWLCAOMAIQ2CAMNTM5SCA954KETCA0X2KWV 4472 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\A6SX3V9CAN1OI7LCA0JBBMQCAY3ICAVCAU6XILLCA8MAPD0CAYWR7SSCA0LE5KSCAINJWG3CAZGPANYCAA0VJKECAJZNGIRCAXRZDL2CA59NRU6CAYXLJHECAMW6WJVCAQ6K2RN 757 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\afrCAJQJNDJ.htm 1633 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\AFAF8O5CAALDGOGCAG455VOCAS0AL4QCALU82LSCAV3QVQ1CAUTY08ICAF93O53CAA2SVPDCA1WDMENCAX2BH0ECAG73PT8CAY6ZB4MCASD2ZC8CA6ZO774CARPZ0UKCAWB4OK1 928 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62DP53MA\AIMGJMUCAFHIFWGCA4LJWXWCAGPWRHZCA859N74CA9X1XU0CABYP324CAHGE3BMCABJ6J72CADHPCU7CA3ESE8ICACSV9L7CAP8IEZTCAFF17M1CAO1G6U6CAUZMFSTCAD1J41Y 4457 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\PID_1827007_SpiritOfSpringfield_300x250_r5_fl[1].swf 58965 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\clk[1] 38812 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\QGCCA8DL03KCAX8Z1DZCACC2OX9CA4VZK9PCA5ISX5BCAGKN0JACA6P4XXPCAUGRH6YCA19OJ7ACANQ8KBFCA1R4Q3RCA1TFYELCA9H1K7FCA3W4MJ8CA8Q36PFCAR3PHXA.htm 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\A7B3K8VCAS8L774CAU472HECAFACEJ1CAC33NSCCABGCE6ACABWZJAKCA4PBXSICAJQLGY5CAW1CA0LCALMON92CAVCBYI3CA0BAEVQCAUWPFG5CABLE1AMCAK6JPB3CA3RAMOH 914 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\15ZCAQPUT18CATTBRH9CAN90F79CA2HUHF9CAI8OVV1CAH7SHAOCAY1R1EHCAFSMO9SCA0DRRNBCAWWH6RPCARPJO8OCAF0SS2YCABC4F1OCA5FMZNLCAAYNV2XCAPAHA5U.htm 69 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\ALZ7BMCCAU8MIISCA2APYSPCAU0KR63CA932I86CA6VNNQ6CAG85FCNCA3TFQNVCAZDX2STCAXI0LQJCAH5HP3JCA75XB5OCAMQWDSPCAJE1N13CA31VLXECAQUJMW0CAOVL4AE 1400 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\A9X9ON7CA4V1N9TCAM9PWXZCA3DC09YCAAQ1SBOCA7HJU6LCA6E4HKVCA084B5ICA3NDDSGCAYCV0PACAG6456ACAE1E3XZCA8MO5EVCAVCW3K3CA961VE7CAT2YGM6CAMINVF8 1861 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\AR52Y25CA12888OCADOJPK4CADA5ICFCA0CYW0NCA2H07GPCA7LNIW2CA8V1HMXCAQCPBAJCAS9OT52CAAT7H4SCAUVNIH8CABM9OR9CAA15TRXCATZOY3HCAZD8N98CA3UK9TS 4469 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\A5N1DU7CALXQ09ZCANC3REFCA6DCQFBCA6FV0L7CAOMZO9BCAWFVV6YCA0PZXLKCAV40ZX4CANU38R0CA6U58X4CAEOMP4RCAITX2K3CA7TY9S6CAMV720ECAV2IZ34CA8T2YO6 4466 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\ATWREYCCAI62YSZCARYISYLCAIBTIG7CA09HR42CAARKFH1CA5ZL20VCAA8B0I1CACQUNGBCAXQ2QYDCAGBJVOSCAEI0KYRCA1C4X2QCAPAYNM2CAZX2QU4CA2AX679CAD7V16G 4184 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\AdServerServlet[1].htm 1854 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\AdServerServlet[2].htm 2703 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\JS[3].htm 1358 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\AEM12YOCAIQ2ZU0CAMQK1WFCAP1CH3RCAVRLFOBCA3OZ6P6CASYKFYVCAI4WH8JCAH4WABOCAK8AEXPCAV3AL34CAU54T6ZCA5MD2UBCALC5AOICARZ4OF8CAEM6X1ACAOQE094 893 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\A856U0ZCAFOX05ZCA9JFVV2CAOHMEU2CA2BJTBHCAR0V596CA9GPNETCANGPGT6CA82KHZ4CAP9YX9KCASI0MY6CAKW38CLCAA6WIL0CA0CPW9FCA9LKI9CCA7EWC8JCA1H43Y9 901 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\3SDCAZ42TUGCAJAX98NCAEDAWJUCATU5JUMCAC1EEQTCAUT0C4TCA6WQSZUCA7UD5C7CAGD7N8ZCA9RIAN0CAXL7ZVGCAG7SPCVCAN31PNGCAPVP7Q6CA7BE2ETCAINU5AI.htm 499 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\audience;sz=728x90;ord=c9e5d49459[1] 436 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\ajsCA8N8ZMA.php 3881 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\ajsCAEMURQA.php 4076 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\ajsCAF5Y3AE.php 3557 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\ddcCA1OJJKH.htm 11257 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\AMTRX39CAWLN4JTCAHLVA85CA8KWG85CA717ORYCAWB0M7GCAZ6SG6QCA3VGRV4CAPFOS0YCAL0LLM4CA3507GPCAIG17S3CAFYEIB3CADUZC80CAMKDLN2CA1TRXYCCAXKE4NO 1292 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\AX47J0TCAVP0IZICADTF0OGCABBSTPHCAYB4QQ3CATJBS88CACA9VAICAF5TE66CAPM7U5ACAES8DUTCAOELG0JCA249X6JCAZGDX01CAZ0WQI2CATRDSUFCASAX6MOCA2B147R 892 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\ajsCAMSV78V.php 3872 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\ajsCANG31DM.php 5189 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\ajsCAZJ6BE6.php 4000 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\V66CASPJ1HNCARFNZ7XCALW3KGWCAA3QSIECAF9LFT6CA9H7IOKCAO51CTDCATNLU0ICABDJVC9CA0X9OFKCAB8UKOKCA0N1ZZPCADW1FVECA48YFPLCA4QKFKACAZEE5J1.htm 444 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\AHRMH3ICAP8VRYWCACPD45ACACHO0JZCA114FQGCAY4XRDBCAYK3YD6CAC0S04XCAK57MS9CANBIQEYCABDFTLKCAULNJAWCAK44H8XCAG5PG4ECA2QOEL8CAPOFUI5CAT6P1QH 4469 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\AHA64I9CASFXUAUCAYO8FQUCA1I3XERCAG7923QCANYHCAQCAAZY5PUCA6KHIGECAHJBC1LCA6CDX91CAWIPIEQCAOMZ52WCAW7YKYLCANWM5E2CAOLZXA3CA8GQC3QCA71XZU5 845 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\N9VCAS62VE1CAC6T606CAV3TDQLCAE2DB87CAATRMA1CAL0E3CTCARSV3VMCAPDGSNFCAKJCYRDCAZRC2K7CAV0B5EUCABRNIKPCA738MKFCAJOE4Y3CA8SYF72CA75U38B.htm 792 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8L1YAE5D\SNNCAP87MC3CAGIEW33CACLEB1RCA5LTQT5CACYE5QOCAD9EO5ECAQ3A1PLCAX72JN8CA35SAD9CAQCVVJLCA7XBI68CAIQPHWBCAVHVA2LCAAZYKG4CALIXS57CAU1WMTW.htm 69 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G4TZZCPE\background_gradient[1] 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G4TZZCPE\AP52UP9CASK1MP5CAZXOGMTCA208R98CABNFT4VCAXC15GJCASP46Q8CA6OWXOECALJQPQDCAYL2JBDCAJGDPBRCAGYQBX2CA3C0BQWCAL8A2DXCALJOOP6CAAI8NTUCA11ZV7X 1304 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JKYYBN3C\AZYWAWVCAQ22X2CCAA5LA46CAZKSTPGCAHQ2C45CAMLA35LCAXFZP14CAX9VZ48CAW58MVPCAJI9N5CCA82W79LCAVSQSL8CAZZEDNQCAE4IRK8CAEOJIC9CAYQHES4CAHYFTFB 1860 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JKYYBN3C\json[4] 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JKYYBN3C\jstag[1] 1454 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JKYYBN3C\AG0B8UXCA1QVPPECAFLIT6BCA07V9SMCASJUQ3HCASFKCKQCA91G6ESCA0O0888CAWQAGV5CASO5ZXOCAY5K4TXCAQ89BN4CA6G7PJ6CAL3QLY4CACFO3HBCAPAPAGVCALVRPLC 753 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JKYYBN3C\x[1].gif 44 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JKYYBN3C\A5LHV3HCA0MC93CCA3VI7T6CADOJHXVCA3F78U0CA5HVKSZCAPC31YQCAS3QUXBCADRG79MCARTZC52CABLLAN2CAJBB8R6CAYY6R0ICAN7LWFBCAI2VHAOCA5XMZS3CAREQ7U8 4463 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JKYYBN3C\AYOJRTVCAWRLFMHCA5LJTAXCATY8TFTCAI12M35CAP7W2YXCA8VJWG5CAZV3894CAZIE29RCA0KDQ1OCAGUYNGHCA7M15KJCAHC0PP0CAOV1RP1CA17X046CASJST1NCA1LSQEV 165 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JKYYBN3C\A9XBN09CAZ974F1CAHAUICYCAPIXI0HCASD8B3ECAARUY2ECA45NXAHCAKIIPTTCAB00VN3CAXJAWQTCAQJFH0ACAZ6PA3ICA1OAMJZCAFW9OIHCA74EJS0CA3DHWMWCAFHWZK9 893 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JKYYBN3C\AC6FPMMCAQAHXHWCAMM17CPCA9QPZDWCA1JTR40CAE19LH2CAV4AQDWCA8DBPPICALI2UTYCAPW0NHZCATMZ2GFCAEGC0GGCAL8RLE0CAP7T41OCAJ7M6RACAK1DDO2CADRC4IX 1545 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JKYYBN3C\AC91PPKCATY6BXYCAKUD2VSCA3KS8TVCA0U8FG1CA0AVJ9GCAFG9PJ8CAPN75MGCAXZVGS8CA56L9D0CA95IB5MCA8PK7BLCASKRB04CAUMK8GDCACRY509CATG8ZT2CABB5E3H 764 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JKYYBN3C\5VRCACY90LYCAH41D56CAIS55CLCABB3U2ECA9KRT6JCA4L5BP1CAN060DHCAVAJ6ZOCAIBBUROCAWHZ0TUCA8RMATKCA1GDUYBCAEO02QICA1600BSCA0G86WACA1W7BNH.htm 507 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JKYYBN3C\M3JCAT28QHVCASGPKD8CAPDICJ1CAM5VO23CAQ0FUOSCAY17F70CAB80191CA51CJDMCAGVO9O1CAJTXANHCAKL0D1ACA6OMQ35CAXRJQQOCAA4LL2HCAR6GMFSCA09ZYEC.htm 507 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JKYYBN3C\AJ77ZJWCAZY85WNCA5T66VUCAKY56S3CACUCB5XCA81EVEFCA8JFOQ9CA39WGL0CAKTIJCJCAW46WGBCAIIWV9QCAOM6DFTCAIMBLDYCAYC1U30CAK2538XCA8HOAQSCAPLUJ9P 893 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JKYYBN3C\AKTRBQVCABJ0V1YCAMWEPL1CAOQRICNCA2BQVVUCAAIW3Q4CA2BGQ2WCAWQR5VRCAG6LJ0ZCAFGL95OCAC4CW5QCAGTGP38CA2KZ0SNCAZHGVK9CAY1ONG0CA1YQ0Q6CAURV0NY 4496 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JKYYBN3C\audience;sz=160x600;ord=ece1a9e3c2[1] 437 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JKYYBN3C\audience;sz=160x600;ord=f3d88bbefc[1] 437 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JKYYBN3C\user-match[1].htm 11 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JKYYBN3C\ajsCAJGD3GB.php 4290 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JKYYBN3C\ajsCAN7JXTQ.php 4238 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JKYYBN3C\ajsCA6TK4LC.php 4216 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LWFNATGS\httpErrorPagesScripts[1] 7579 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LWFNATGS\AN1KXVXCA814J2KCA5DTO83CAJ311BHCAPKYHV7CA3YFT4OCAT3AEDOCAFKEN0OCAXN5EUJCAGWLRMKCA7CDU3SCAXZ27KCCADTRFQFCA37DP1OCAASFL7KCAQIWOWWCAZWPON9 897 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LWFNATGS\vj[6] 2342 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LWFNATGS\146_185_250_210[1].htm 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LWFNATGS\AC5088LCABRNIOLCASU512DCAGKTLHSCACJ0JM1CA76OALICA0SHASUCA4XRYJCCAZLMRF7CA6PQJKTCA4S6P9YCASENNJNCAIF1G8JCARCQKCECASK7HZACA8CWGM0CA6BC27C 1861 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LWFNATGS\ajsCAYHBWSO.php 3890 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LWFNATGS\ros_partners_affiliate_896731[4].htm 1302 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LWFNATGS\A24C0KMCAP0YUY1CAMJT7I6CA04ZQFSCAZPG939CA69KXZECA7EOUDUCAR40AESCAS9ZUD8CA93RT4LCAW0HLKECAM8MWFICAW8DP5OCAEQJTVTCAP4CDWHCA9F6KCRCA4N38JD 764 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LWFNATGS\A4PN2LUCAT42X8GCA0YLAUWCAWHKXTTCAN34GFLCALFIGP0CAYXQPQPCA78F0J6CAB9AY60CAJOLDAYCAQ2UW1PCAJ9C17MCA69V6JGCAF4RKQYCAYNG6Y0CANS40KXCAN0QXT0 1860 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LWFNATGS\AEBQ3B0CAMDUNRVCAOF11XFCA8XCWA9CAE0VME3CADQ4ILRCAWTXJCECADBUXRJCAEQT1PSCAD31SQSCAU2K0OGCA1B9Y4YCAP8OLH4CA55HCBECAW5H0VLCAZJTUTVCA21LRJV 898 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LWFNATGS\ajsCASYXH96.php 4250 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LWFNATGS\AL7UTL4CA9DX5LICAR9RG60CARPZUM5CA877EDCCA4PJ0UOCAUHGCFTCA82HSYICAZG8WOJCANKMDCSCA8GYVQQCA3NAK8ECAMBSBVDCAOF097XCAV2FT0WCAGH7PCDCACWYSK3 923 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LWFNATGS\A3D9ZBECAOEPEXICAXAMC3ECAC675D8CAKNGYSHCAP1JZQWCA5HH0BQCAYN3KLFCA6SBYQCCA2WGQAFCAW7OWULCALJZDNHCAJPC17FCAWKGK79CAC3N4VKCAZDXUKICAD2H4PP 1861 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LWFNATGS\AVEDFUNCA6R97RMCAVWN98QCA37TSEMCAO1VJ1QCA5NP98PCA1S1I1KCA2OS8NSCA99OLC5CAWMWN36CAKZWJ07CAYXWSGXCAWW558ZCAG4HK76CALOJY1QCAI017B2CAVZR1DK 1861 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LWFNATGS\audience;sz=300x250;ord=7414e0edcc[1] 437 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NM1G696P\aT00NCxzPTMwMHgyNTAsbj1pZnJhbWUsYj0w[1].htm 545 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NM1G696P\usersync[6] 155 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NM1G696P\admeld_sync[9] 181 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NM1G696P\JYQCAUR2FZVCABJJQZSCABUFJYZCA6GWQT0CA4RA209CAKG06MMCANRNOTBCAS60VZ3CACJC305CAI9H3BUCA4VOWJGCA9Q4H63CAY48343CA4VSHRUCAZBYG0XCA6DGDT4.htm 444 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NM1G696P\AUE28IXCAQO46LFCAA5M4XTCAGAWFEBCA4UDTIKCAW485NQCAMGTYO0CA2PEV9KCAU5T3UXCA1T7TTYCAN9N30HCALZS3T4CAAEZLF4CALSFDO4CAZARMD9CA6QG3V7CAT2Q3WP 1303 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NM1G696P\AY280HOCA9QH8H8CA2NO2W2CAAJZ92UCA1FWMLCCATOLX0HCAI1OJ05CAOA5E7XCA0XKVCSCALB703QCA8O4IAICAZ53UJCCA2NHDAACARXT9BMCASJC0W2CAA5KDRECAZ6QYES 1860 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NM1G696P\ddcCAIP8QGA.htm 11257 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NM1G696P\A9MTHFXCAZX27QACAB4JREZCAP72202CAWCJVWWCATMP9DYCAPCNH6ACAY1EA6HCAFXX2EPCA4HYXUNCAA96HE8CARMKOMDCATVPQDSCA5JTYEKCABG45Q2CAUZQY39CAYNK9WS 891 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NM1G696P\ajsCAK815LY.php 3553 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NM1G696P\A0J4309CAI9322DCAOEZTGPCAXQOVQ3CATJYPT8CAII0DYLCAAR73W2CAN0PMQICAGA0D1DCAQ38EXFCA0TXM8DCADUHBJWCAN5O9VUCAF064YECAVJ1LKDCA8Y2WS4CAFYRGWU 1301 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NM1G696P\aT02MixzPTcyOHg5MCxuPWlmcmFtZSxiPTA=[3].htm 18 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NM1G696P\pixelCAA3U8I4.htm 343 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NM1G696P\ajsCAF5KOC2.php 3611 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NM1G696P\ajsCAGM1N6W.php 3883 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NM1G696P\ajsCAPGM5UD.php 3926 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P289T1B6\11198a[2].swf 4734 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P289T1B6\ACBZG7JCA2TNZ67CANLTINOCABVRNB4CAAHP41MCAVEBFK5CACDMR5LCA0YXJDXCAV55EHPCAM5KIW1CABEDTDOCA5T5JC5CABFTPB3CARAAQQHCAE7SMJBCA4UQJO8CAEA6800 1318 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P289T1B6\AQWI5XUCA4AU4YQCA4QUQBACARZPXFSCAGLNCWGCAQJ2ZWBCAXON42CCAN76902CAFC03QOCANCLZYVCAAYIEIOCADY5RKPCAT59HXDCASJF6O9CAIOXPCECAXMXSHBCABZOO4Q 660 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P289T1B6\ajsCA37NLVI.php 4219 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P289T1B6\AXRVB8SCAEOIT82CAT7421UCA18MOABCA38Z0E3CAI7TWFSCAIDTKQ4CA9TLZHNCAYA2FAACARQUX15CAORQL1OCAB5P6S0CALYCHGHCATGPPOXCAXS0NP5CAM3ZYJNCAROBEF0 760 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P289T1B6\EZ6CA4A5OY3CACMSFLTCA2KU3UACAQF0JUNCAEWT37KCA46R92LCAYAROEYCA8JITBFCA35VZPPCA231LGSCAGNSQ5CCAUDY29ICA8AM6S2CASKSS2ACATH7DFOCAUCUXBQ.htm 525 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P289T1B6\04KCA2ZQSJ5CAA2GHHPCA6GU4P3CAL6G0S8CAQ5CX4ZCA67WJ7VCA7VTNFJCAMKWAGDCAHS1HWZCAM7MO3CCATLPW2DCAOZKL8GCARLVOQVCAQP2GLLCA9EBP3VCABF3YUY.htm 1299 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P289T1B6\A32NHKFCA7L1P9QCAHB1TNCCA25SVX0CAUAM7LBCAIJGZM6CAR7VGSWCAOG1KT4CAKKJLRHCA6UJM7YCACNTV0CCA6CYVGACAZVKC30CAKL78HZCAY9Z9CACABQA29GCAUEKUPL 4475 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P289T1B6\AZ6SHP0CAJW5VC4CACGK3VECARZR5YYCAUT9OQICAOWGXBNCAO1MGUYCAL2MNVECAJHGJUHCATKF0XXCAFQ2D03CASK17COCA31L9TRCAY8J9YCCA1JVSFTCAVCM6WMCAOGG9SP 1622 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P6W8417U\3d4f128023178ebe4cc1d66bbbef81b9[1].swf 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P6W8417U\sports[1] 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\A1JXQGJCA1EEEU1CAL1L54YCAYSR9EPCAR83C73CA4CM75UCAMZOX82CALQEG28CA2JK0EDCASHM3A3CAAJAVWSCAOFM0D5CA583IF7CAMLVJ0FCARV7H31CA08560TCAF7IP1O 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\AGZ8F6ECAK9NONFCAGTE9D2CA1VBZJUCA4R2DV1CASEWPETCA7NLEB8CAZNREMSCAAV8ZYVCAW3DHI4CAB111JRCAETDT5KCAXY935BCAPU3UGLCA2K0DCJCAJETRXVCAEEC1P3 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\69c4a1bae31ca8b248b1356748367eb5[1].gif 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\AOJID34CALSTS3YCA9X73QUCAYI78HECAVFWYCLCA7YA26DCAI9LTZHCAJLX5XGCARQ97YZCAQQED8DCARD1QSMCA73J50ACAGWH9L0CA4B6THXCAW8R5PMCA2LC1XWCAU9BOKO 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\AICAXR2CAQZ0VETCAKT4SU3CAHFHSN9CA9KNTGKCARJHQ3ACAVEHNYRCAWHCNKCCAUBB7ICCARDD1RKCAAGT1E6CAGD3207CAY70ZHLCA0VQ5N4CA45SD6NCAYFD3C3CA9KF1WI 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\ad[1].gif 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\BGYCAIKQEQPCA3NGWXSCAPFROISCAS24633CATQI4VHCAMEJ1X9CAEB0KONCA4CHXEPCAN44510CARXFZ6PCA6JID28CAVF5ZMHCA2H6ODICA1NR9LICAMEKIDOCAE2YS6Z.htm 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\300x250[10].htm 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\TRVCA807UBECAI63XU2CAX3DTSZCAWCCQRECA32JGTECAET9V7JCACU5R72CALBK8HRCAWNCFCGCA0GKJDYCADCMJPLCAMPVFELCAMGQ8G6CAYAZ5ZNCAMMFB9MCA2DCCH4.htm 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\AB22EQ2CAYWHLIPCARB2Z0RCABVWIT0CAMDD3YJCAJDJ60OCA4M5VEQCAYLAJNCCA0LQH21CAG6U24TCA4JW3YTCA1TSP06CAT6E6B7CA052A6YCAI1ATBICAH28J7JCAITGWPM 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\AURV4GDCA0HQ0WTCAHL95N4CA02Z1AKCANE2IE0CA4DGVV9CAOKZ17GCAF9OM1ACA3YTVKBCAKI1EYVCADYYLXMCA9IF5NZCA5QF20TCANVOT0ACAQ1KTP1CAK29YUFCAY3RGBE 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\AKSO57QCAQZ83IKCAMRBJ0WCA452RI7CA3SFVZPCANWNDWRCAYIH63FCA4K8GM3CADRXSTRCAYOIAH9CAE6P4JTCAK5XEJZCAKBTDSECAM7MFEHCAI02B7GCAW7GIKMCA3KQSEE 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\11273a[1].swf 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\A54F3Z8CAKTRX2OCA0KX4YPCAI0A2JCCA6KUXLWCACUFKD7CAH77IF5CACE015DCA0EEQMXCAW2FLA8CA7N6SA3CAGW23LKCAYWBZ2QCAYVGL7DCAPOGVZRCAI0HBUGCAEBB1W0 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\ajsCAMQZHCQ.php 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\ajsCAZB5Y86.php 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\AYFQT60CAM2NP2UCA3R3U8XCAHIG9C0CA08SE0JCA7FJ98ZCAAFH2OSCAUJV59PCA3G0AY3CAKIJM56CA9W5WI0CAYUAPF3CAA9KQQECAJL7VBNCA0VCJW1CAGTHCIRCAI4YVH2 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\player[11].swf 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\AXT271DCA3J4K5TCAGBG57ICAB8FUY4CAASN8OMCACI7735CA5NSHKSCAS8Y50ACA721O23CAP1AQZJCAYSX2ZVCA48XOS3CAZXLNDDCAWLPAB8CAW38JSGCAWG06JACA32EAO4 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\AXU08N2CAGKBY92CAPF9IRPCARZQ8ATCA1O0ZQBCA1W3LK0CAZGXYA3CAHVVSKDCA63165OCAIAO5P4CA10IDBVCA488WGSCAYKPU3YCAAAN0B6CAIX7A74CA4E2X22CAMPR5PA 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\AOV12SCCA3LHB1NCA33QTT7CAI4HHM0CAELBF8SCASBBMBACA5AENRACA4LN3YICANNDR6WCABQI4R7CARYOHEBCA16PUCQCA636V4JCAQXMJJGCAT9X1HQCAD6MCV5CA7J7SV9 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\AOLUGLSCACB2U7ZCAIOAKLWCAP1DQINCA4X9A7UCAG0XC7FCALK02CXCASOHO4PCA7XQYVUCA2ZD37TCAFZRH3YCADOFSQ5CABK0JUVCAK813SJCAIEQ2EMCAMP7BQMCAWEON4B 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\ajsCAPYK3ZY.php 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\ajsCAR1W64L.php 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\ads[1].js 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\ads[2].js 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\AMPKJSBCAB56201CA88YLSMCA0F6J0ECAR7BI8RCARIL151CAAIK4Q5CAQA1T36CAAOXIVICAKV3UJTCAJZYXAHCAWLL2C1CAEZNCEICAPQGONOCAFPPNP0CAJQAPN3CA1H6876 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\ddcCAFO49XZ.htm 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\AXI2HVECAGHMHZMCARI0CS6CA3WJX7PCA2AWP75CA2XTNQUCAZB1QEKCA19XFQVCAL8PZHMCADY94ZJCAC2QIC0CAVUFCJUCAT0UQX5CAKT9R2OCAJ49MLQCACXPIA3CAVS70S4 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\AXINCSMCA0EJLV4CANIKHO2CAUQNW98CARN3HPBCAL49VI2CA8HHRTCCAXI1RIPCAEKUVBVCAP0RVX0CAJXFLH1CAMINYRRCAASK4T4CATBS7LDCARC500ZCAQHJU0HCALMUR7K 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\ANG5JLSCATXDLJNCAOZ0NHCCA49CUWCCAP1YFPHCARWE4SCCA8GWMCNCAR683E7CA9YWJD1CAP1OTHFCA0T7GJMCAG82OVPCAUKGX15CA7ZPCKVCAQMOC1WCAYTC1DQCAZH3Q0M 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\AKEH4VTCAOX8DWTCA89KG2KCAM26389CA2QBV1CCAU2SJ8OCAORC6UVCAXM5E19CA5VW1JPCA4BS723CAJ0PLLUCAINDL61CATMQ9L1CAA18A3VCAHXG7OBCA6TWD7NCA9PK1ND 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\freqCANP3KKY.htm 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\A4M371ECARI4740CA2BX271CAE3FKH6CAGSZKZBCAWF54DWCA7N0BN1CA2PRU1VCAS2XHMYCAPWOI3FCABW3V46CAUTOK79CAR96JPYCA3445W7CAORHX83CAVRIMWTCAHIW668 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJDJXED0\DP3CA8DXQIJCA9LXJ53CA4S8FSHCA2GY5MMCA40HU6XCA9FF40OCABQM1YVCAA8BR6GCAQRQ2G3CADNN4VNCAENI5XLCAIU34W9CA3MK6EXCA7T51Z4CAOX8YIUCA2E6Y3C.htm 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YEFBQ5SL\AK8CA0O29NJCAPUMSDXCAANOIM2CA2SUHR0CAO0IDP5CAN1PC44CAVWOHBOCALJBM98CA3OVJ9GCAC1QPEWCAHX19SECAQC1TSJCANEAFLRCA5TZ38ECAYZS3VWCAUJGVA1.htm 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YEFBQ5SL\AXFL09UCA245NHGCAS3K98WCASCHA3JCA35UWWVCATG8W8OCADZ4E0GCAUI7YL2CA7J3RUUCAL9UGCYCAX5GC7JCAPHU8RWCARKAEF0CAS0EF94CAA3QDO0CA4L2D91CAOO9Y3Q 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YEFBQ5SL\ASLKVUICA1OM6VBCANZ86WICA38ZRNICAUIHUEZCAG7XINDCA5I0E00CA1H5QHMCAEUBWZECASSFOE8CASZY1ATCA1IVW38CAIYC3P1CAFB3UGUCAL6BUF1CAPPAFP8CASBSHHW 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YEFBQ5SL\AAT03WUCAFQRQ7QCAP2105GCA77YJF4CA5M132XCA7TL4NVCAXTIN1QCAJWO0URCA0KUIJ7CA1ADHVTCABTLUOICAHBXNVACAA8WCKYCAMM6YEJCAM08RSECA3TOIEYCA9RG0NI 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YEFBQ5SL\AJ6BU3SCABNIYV6CAOHX8S3CAVICB4XCARZHSZGCARAXS75CA2O1UM1CAPZZA65CAVDG04PCAYZR5ZVCAMIERSJCAI1E32HCAKG5SOVCAU628YACAYE1ZIZCA78M8K0CAOVX7GQ 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YEFBQ5SL\AH18KRWCAA4E925CAJ9NEJFCAQYKUT9CA977RVZCANQ0KT8CAKR2563CADE5TQCCA2IFTUQCA3IMTGRCAAL5D1NCAJWMYF9CARRHQF1CA5O967KCAAZAKX3CAWFNA4ACALGPKLI 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YEFBQ5SL\A3CSL06CANL0V7FCA7HNP6ECADVYACXCAWXR2XECAN162HJCAXMQ7CACAUSVUJ0CALFWJUFCAEJTVR0CA8EORPCCA6245E1CA2V0842CAHIREDNCAJMM6FDCATIHBVSCA5EE14K 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YEFBQ5SL\ddcCAD6VLJ4.htm 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YEFBQ5SL\mickle_atf[5] 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YEFBQ5SL\AWNE9WNCA5MLUH0CAN4989BCA7X0BL4CAQADWE9CA9UEHGTCAQGYERECA2KPT2WCA1EDB53CA6H9R5QCARV60OMCA038CCKCA4BF1LECAISA1UXCA8VDY45CAAV8PLMCA8S6X5U 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YEFBQ5SL\A0TY97BCADAB90NCANSDSJ7CAV4LH24CAG1TIYFCA5SV50VCAO7QAAFCANP009HCAXJEEOTCA63UFV3CAJP02EQCAJL0R31CA3EYDX3CAZL0MK7CAVZ9P10CA4FHE6ACAUJ971U 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YEFBQ5SL\A0U4ZYFCAVTH5XJCANOKFD6CAHCQAP7CASYLI99CAWCL4H1CA2CQ4FBCAUMQZXTCAZEVCJ9CAMM8SWRCAJF3EF2CA4H85G5CAH0OQ7CCA71RDP9CAAE2GHQCAM8NG6FCABJ1WWH 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YEFBQ5SL\JDICA2K2VK4CALZCW35CA0NEYD3CAX9TIZDCAAIH22QCA7LT3O2CATHFZ1XCA8LJUT2CA8FSXYJCA9XS6Y9CAPQ5GJ5CA3A6VRWCACSC2POCA8J78DDCAYNCD8JCA71A0LV.htm 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YEFBQ5SL\AAW92WTCASTTE3CCA62L7NXCANQ5VFWCA9SUV4OCAZ0U29XCAYSB08SCAE994HMCABPZ4YTCABKGI1SCACZFZGOCA3WMBDPCAI66CQBCANPEWKFCAOY4B6ZCAZ343IQCAL0LROM 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YEFBQ5SL\AL3SWM1CAA3XGRYCAU6ECCCCAAOFHP5CAR9I3NACAHQZCXNCAEK4T1ACA4HMBV0CARLAF6ICA3TKTVXCAZXL41BCAR3MX3ZCA375I5SCA5JP00VCAN69RZ0CAM3CSUJCANAPX35 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YEFBQ5SL\A28UUZUCAJXUNZCCAVB3L6SCAIIA388CAZRDP8RCAWKUZIPCAWS8B0UCA40GB4OCA1BJOWVCACZL8UHCAJ4CSIHCA52QMT8CA2AVOHMCAVWR89HCAGJGBMDCA0G50VFCAO5SD16 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YEFBQ5SL\AEZP6J0CAGJZ5FACAGRIVI2CAC8C46WCA2VO7LNCAJ6DKDQCAN9N9FACAQBHNSPCARDBMRSCAFIY6H9CAEDYNZ5CA9R61HLCAB5T2KICA96UN0RCAMIO4M6CA5ZXFRJCA684TFN 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YEFBQ5SL\AJDZOYBCACC20FECA76SNPVCAAF8SQPCAJ8YVYTCAR6OZ0FCASBSMHNCA6ZT0RWCANVG648CAP65N5SCAUJJRIDCAYD0LRZCAKDY8Q8CAG4D01KCAQ9OE30CAE02BMICAY4DHV2 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YEFBQ5SL\A9A7CC8CAQ6FZ4YCAX1ZNLQCAPI6SM7CASWODPACA2BC3FYCAXCXWBSCA7C8BI1CAM61VCOCAUPELAYCA1ZKLF9CAZKU619CAVWYTRTCAHKCNSKCAWMW34OCAZVRNDHCAF0OHDE 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YEFBQ5SL\ajsCAYIJS1J.php 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YEFBQ5SL\ajsCAZXRWXF.php 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YEFBQ5SL\UYCCA0KP45XCA9NGXZ7CA8UANZHCAR4DK5UCADXYKD8CAZF8GWOCA5TFMXXCAVBBREHCATIHZ08CAA2J0SQCAF5YIOICAZ4HDKKCAPXWLVNCADQ56SQCARYYSMDCA2WMLXK.htm 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YEFBQ5SL\playerCAAAQGSH.swf 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YEFBQ5SL\A11G6DICA1NCN3FCA7YNT4LCARLZJG3CA9FQNGFCACIX1JGCAGTC4UPCALVNE0ECAP6EEXRCAR4Y737CARRHC6TCAFC6PJZCACT8M07CAOF7WI4CAFYS0MKCAG6LXTZCA4Y615Y 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIXP7F5X\15ECAU34CN0CA41JJSQCA684FPXCADPWQ7HCA2PBNBRCAEK1DG0CATTLENJCAEZ2M4DCAFULJEICAPJDTMACA3XSGC3CA5CAE15CALNOIK5CABCNW76CAHU9DJJCAXH5V32.htm 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIXP7F5X\st%253Fad_type%253Diframe%2526ad_size%253D160x600%2526section%253D840826[1] 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIXP7F5X\APLD43FCA5GD7MUCA38DCQZCAVUXLMDCAHHU3S2CA27I3KTCAMDSA3YCAZZ00IJCAZZAXIQCAER3YRLCADUWO7ECALVTS3ECAAHYAAACAYUP890CA8RJ2H1CAW94VM3CARTXIR7 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIXP7F5X\ABTUKACCAFT56E5CADTRYB7CAE03GBZCAE0WPHPCA440KQ3CAW9K9CYCAG86P2QCANAK8X2CAH5OF9RCAXQ87FSCA5H8YSOCA5KLYXNCA4XHMP9CAEW41QZCA3CR1Y7CA6OT9HP 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIXP7F5X\AGGQV7YCA2G8EUXCAD2A0UQCAJRI6O0CAUYQPSDCA51HYH3CAK3W18PCAVCOBF9CAF25Q3DCA0O68WDCA52MVHTCAPXYQTKCAVM8YU5CAUF09R2CAE708VJCAM64CJGCAZ3CQSQ 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIXP7F5X\69c4a1bae31ca8b248b1356748367eb5[1].gif 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIXP7F5X\A13LDHQCA2UW6U1CAMU384WCA27J9O2CASDJK09CAPD2Z4ECAGLHP92CA9PT6K2CAQ02Y36CAB504IFCAV5A22MCADVV494CABNVKEMCAHQ1OEUCALTQTYVCAXV8AQYCAER0UX0 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIXP7F5X\AVT2MI1CA0C7Z8JCARF7R14CABZN0L0CA71RF4PCAVFOS4RCARJNOMTCAVK1EL3CA0GH0RBCALRO32VCASF1LVUCAK331KECAKMV72VCAGDHV41CA27V51ECA3S85EVCAZDZ29H 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIXP7F5X\ajsCAVHH36F.php 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIXP7F5X\AYBFMMYCA1H7MMWCAAID5VOCAJ8QS9ICAPUHGU5CAUDVZ1RCA6VQBBMCATBXE0ZCA149UZ3CA84K832CAV1X3WFCALG3QTTCAEUGX72CA8PZY7GCAG90P5HCAEA5E6ICAG9KCRY 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIXP7F5X\A9A3SELCAZKXC2ECAKH5L53CA226ZCUCALTSWTOCA3HYYFVCAJZWZ4JCAZYK1WFCA3PI2VZCAGY4FSDCALRKR1HCAQJ3BYVCAXWP7CVCA13D6EDCA4NNIYVCA27E8LCCATN43S2 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIXP7F5X\JS[3].htm 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIXP7F5X\ajsCA3BY6GK.php 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIXP7F5X\ads[1].js 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIXP7F5X\ddcCADY65SF.htm 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZCHYAB6W\AOUZZOMCAMEVF61CA06NJSECA51Q7GDCAARE86SCAIE14JPCA3WVT9ICAH3B80VCAE3DEYUCA2016BRCAP908B9CAHOSANKCAJDFUOICASH0MI0CA1BP25ECAV42YN0CA8LL36W 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZCHYAB6W\A41QBTVCA6KQC8RCA0YK5VVCAB4RBXRCADZ6TZGCAX0YDWKCA7U6KKCCAN9VD2QCAY7GICECACL69JHCAXPKR8PCA2DYS0VCAQZANZMCA4T10LCCA05PRV6CA0LKKNECAJDW4DU 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZCHYAB6W\1ASCA5QG7SCCALKBUTICAQ7VQX7CAT0HW96CA3YT1FYCABUE9G1CA1QHZHDCAK6ZTIQCA0C0CWGCA0X35LCCA3REFUDCA6RHQ9XCA835C4PCAWLT463CA3159TNCAAQMOC8.htm 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZCHYAB6W\ASCUGLPCAE2ZT2GCA72URMSCATV9YQCCADZUK2HCAYUWT5WCAE01EOQCA8Z8M7PCAKVAAQSCAIH8KROCA7RY9G4CA4B1M0WCA2RHLPZCAMYXVCPCAXCO9SBCAL0TCX0CAE2PNQK 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZCHYAB6W\A0I0YQJCA1I9IDNCAC0UV2CCAGNISXDCAIE3YRDCAOVCA58CAT0FZ9XCAGTPQSJCA17DTV8CABMODYVCAFU36GUCAO60D2HCAPFDF5KCAYPXOV1CAOSYQFQCAO8KM8MCAQJN4Q9 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZCHYAB6W\AEDT3NLCAUX9KHBCAZ8T7WBCA40WM1WCA060LK1CA4E1ALQCA1DI44ACA2O2DHSCA5S12QCCA47TN4YCAY7IGKGCAM9SAOSCAZSWOHXCAR17ZX3CAW25060CABH711QCA1OA3KF 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZCHYAB6W\A5BBIDFCANJEPLWCAE0A9FJCAHLWIC8CA7T95UACA583BWFCAZZ3P6HCA1FB40MCAXJRE0BCACEUAFYCA3A9J44CAI7DGQ4CAJYRFQ4CAT0B812CA5S949NCA8HWFDCCA0N1U5W 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZCHYAB6W\AGCX6M1CAKHRV4LCASHF8FACACEXF8UCALU3JA6CAB5DWDPCAHFBXGMCA32ZQFUCAOY8X9YCA25CZS2CAOWNQ01CA1MRSN7CAEY0I7LCAJFFHZ9CAJSFXIJCAOGQSK6CAM9Q57I 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZCHYAB6W\AGDVR3HCA6QJSR4CA5I5VW2CAVZ526YCA336BAUCA2TIAOOCAQAHWU2CAOMJUE0CAI6X1JJCAPUQO68CABR8M8LCAQXOWA6CA0TIOABCALENEFQCAOY5CB7CAFJNI7PCAY34JPN 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZCHYAB6W\AL3LD49CADL8LEUCAMXDW9DCAN8X28GCAH658U2CAFMB9I8CARYXQK7CA9FGQVTCAO2YU7GCAJSLNV2CA4ILHNQCAC39O3ICAKC8V0LCA9XL7FLCANI63DKCACXH6AVCAS9P2VP 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\J73V3LOI.txt 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\JG9ABKM0.txt 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\OB0IHYL3.txt 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\6U01ITFQ.txt 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\GMVHYQ5M.txt 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\Z61ASZHW.txt 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\LCFEOJFA.txt 0 bytes
    File C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\5DYYJUAS.txt 0 bytes

    ---- EOF - GMER 1.0.15 ----

     
  6. Larusso

    Larusso

    Joined:
    Aug 9, 2011
    Messages:
    808
    Hy there,

    You have a nasty infection, called ZeroAccess Rootkit, on your system. This is very hard to kill.

    Before moving on, I recommend to back up all important files, that you can not life without.



    Please download and scan with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

    http://www.bleepingcomputer.com/combofix/how-to-use-combofix

    Note: Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    You can use this thread as a guide.

    Please include the C:\ComboFix.txt in your next reply for further review.



    Please post in your next reply
    Combofix.txt
     
  7. vivalamusic

    vivalamusic Thread Starter

    Joined:
    Dec 31, 1969
    Messages:
    20
    Here is the Combofix text.

    c:\program files\LP
    c:\programdata\Son83Ntr.exe
    c:\users\Ashley\AppData\Roaming\firefox.exe
    c:\users\Ashley\AppData\Roaming\java.exe
    c:\users\Ashley\AppData\Roaming\ldr.ini
    c:\windows\$NtUninstallKB5054$
    c:\windows\$NtUninstallKB5054$\1120660564
    c:\windows\$NtUninstallKB5054$\4030260102\@
    c:\windows\$NtUninstallKB5054$\4030260102\bckfg.tmp
    c:\windows\$NtUninstallKB5054$\4030260102\cfg.ini
    c:\windows\$NtUninstallKB5054$\4030260102\Desktop.ini
    c:\windows\$NtUninstallKB5054$\4030260102\keywords
    c:\windows\$NtUninstallKB5054$\4030260102\kwrd.dll
    c:\windows\$NtUninstallKB5054$\4030260102\L\qnbwvoto
    c:\windows\$NtUninstallKB5054$\4030260102\lsflt7.ver
    c:\windows\$NtUninstallKB5054$\4030260102\U\[email protected]
    c:\windows\$NtUninstallKB5054$\4030260102\U\[email protected]
    c:\windows\$NtUninstallKB5054$\4030260102\U\[email protected]
    c:\windows\$NtUninstallKB5054$\4030260102\U\[email protected]
    c:\windows\$NtUninstallKB5054$\4030260102\U\[email protected]
    c:\windows\$NtUninstallKB5054$\4030260102\U\[email protected]
    c:\windows\Tasks\At1.job
    c:\windows\Temp\_ex-68.exe
    .
    Infected copy of c:\windows\system32\drivers\cdrom.sys was found and disinfected
    Restored copy from - c:\windows\System32\DriverStore\FileRepository\cdrom.inf_c949a5b6\cdrom.sys
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-10-28 to 2011-11-29 )))))))))))))))))))))))))))))))
    .
    .
    2011-11-29 11:48 . 2011-11-29 11:48 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-11-29 11:48 . 2011-11-29 19:55 -------- d-----w- c:\users\Ashley\AppData\Local\temp
    2011-11-29 05:19 . 2011-11-25 23:17 111616 ----a-w- c:\windows\system32\03D37iu.com
    2011-11-26 21:29 . 2011-11-26 21:29 -------- d-----w- c:\windows\system32\x64
    2011-11-26 21:15 . 2011-11-26 21:15 -------- d-----w- c:\users\Ashley\AppData\Local\ElevatedDiagnostics
    2011-11-26 19:14 . 2011-11-26 19:14 -------- d-----w- c:\users\Ashley\AppData\Roaming\SUPERAntiSpyware.com
    2011-11-26 19:04 . 2011-11-26 19:14 -------- d-----w- c:\program files\SUPERAntiSpyware
    2011-11-26 19:04 . 2011-11-26 19:04 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
    2011-11-26 19:00 . 2011-11-26 19:00 -------- d-----w- c:\users\Ashley\AppData\Roaming\Malwarebytes
    2011-11-26 19:00 . 2011-11-26 19:00 -------- d-----w- c:\programdata\Malwarebytes
    2011-11-26 19:00 . 2011-11-26 19:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-11-26 19:00 . 2011-08-31 22:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-11-26 04:36 . 2011-10-03 10:06 476904 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
    2011-11-24 18:41 . 2011-11-26 15:58 -------- d-----w- c:\program files\PC Tools Security
    2011-11-24 18:33 . 2011-11-25 04:33 -------- d-----w- c:\programdata\PC Tools
    2011-11-24 14:23 . 2011-11-24 14:23 -------- d-----w- c:\users\Ashley\AppData\Roaming\klIBtzPNyAu
    2011-11-24 14:23 . 2011-11-24 14:23 -------- d-----w- c:\users\Ashley\AppData\Roaming\QQJ7dEK8gZhXjV
    2011-11-24 14:18 . 2011-11-24 14:18 -------- d-----w- c:\users\Ashley\AppData\Roaming\FS2obd8fR9TqUrA
    2011-11-24 14:18 . 2011-11-24 14:18 -------- d-----w- c:\users\Ashley\AppData\Roaming\J8fRZ9hTXjCIzxu
    2011-11-24 14:06 . 2011-11-24 14:06 -------- d-----w- c:\users\Ashley\AppData\Roaming\pA1uvD2ob4m58R9
    2011-11-24 14:06 . 2011-11-24 14:06 -------- d-----w- c:\users\Ashley\AppData\Roaming\vK8gRZ9hYwUlBzN
    2011-11-24 14:05 . 2011-11-24 14:05 -------- d-----w- c:\users\Ashley\AppData\Roaming\nfRL9hTXqUeIrOy
    2011-11-24 14:03 . 2011-11-24 14:03 -------- d-----w- c:\users\Ashley\AppData\Roaming\VqhYkeBtz0c1D4m
    2011-11-24 14:03 . 2011-11-24 14:03 -------- d-----w- c:\users\Ashley\AppData\Roaming\S5sQJ7EK8R
    2011-11-23 22:27 . 2011-11-23 22:27 -------- d-----w- c:\users\Ashley\AppData\Roaming\XWWK77fEL9
    2011-11-23 22:27 . 2011-11-23 22:27 -------- d-----w- c:\users\Ashley\AppData\Roaming\jSSS2iibD3pG4QH
    2011-11-22 22:16 . 2011-11-29 11:32 -------- d-----w- c:\users\Ashley\AppData\Roaming\91B86
    2011-11-22 22:16 . 2011-11-22 22:16 101888 ----a-w- c:\users\Ashley\AppData\Roaming\Microsoft\4606\240E.tmp
    2011-11-22 22:16 . 2011-11-22 22:16 -------- d-----w- c:\users\Ashley\AppData\Roaming\T3GG44aQH
    2011-11-22 22:16 . 2011-11-22 22:16 -------- d-----w- c:\users\Ashley\AppData\Roaming\qrrrzOONtxAucSi
    2011-11-22 22:15 . 2011-11-29 11:32 -------- d-----w- c:\users\Ashley\AppData\Roaming\68991
    2011-11-22 22:15 . 2011-11-22 22:15 -------- d-----w- c:\users\Ashley\AppData\Roaming\RppnGG4aQH6sK7E
    2011-11-22 22:15 . 2011-11-22 22:15 -------- d-----w- c:\users\Ashley\AppData\Roaming\mFF44pmG5sQJd
    2011-11-22 22:15 . 2011-11-22 22:15 -------- d-----w- c:\users\Ashley\AppData\Roaming\dZ99hhYXwjUV
    2011-11-22 20:17 . 2011-10-18 06:28 6668624 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3510A141-4214-4D11-8627-A15AE38768B5}\mpengine.dll
    2011-11-20 03:43 . 2011-11-20 03:43 -------- d-----w- c:\program files\iPod
    2011-11-20 03:42 . 2011-11-20 03:44 -------- d-----w- c:\program files\iTunes
    2011-11-15 23:01 . 2011-11-15 23:01 -------- d-----w- c:\program files\Common Files\Skype
    2011-11-15 23:01 . 2011-11-15 23:03 -------- d-----r- c:\program files\Skype
    2011-11-14 14:27 . 2011-11-14 14:27 4335776 ----a-w- c:\program files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
    2011-11-12 18:56 . 2011-11-12 18:56 -------- d-----w- c:\programdata\AVS4YOU
    2011-11-12 18:56 . 2011-11-12 18:56 -------- d-----w- c:\users\Ashley\AppData\Roaming\AVS4YOU
    2011-11-12 18:53 . 2011-11-24 14:27 -------- d-----w- c:\program files\Common Files\AVSMedia
    2011-11-12 18:52 . 2011-06-23 18:25 24576 ----a-w- c:\windows\system32\msxml3a.dll
    2011-11-12 18:52 . 2011-11-24 14:27 -------- d-----w- c:\program files\AVS4YOU
    2011-11-12 18:35 . 2011-11-12 18:35 -------- d-----w- c:\programdata\muvee Technologies
    2011-11-12 18:35 . 2011-11-12 18:36 -------- d-----w- c:\users\Ashley\AppData\Roaming\muvee Technologies
    2011-11-12 18:27 . 2011-11-12 18:27 -------- d-----w- c:\windows\Sun
    2011-11-11 22:07 . 2011-11-11 22:07 -------- d-----w- c:\programdata\Wondershare
    2011-11-11 22:07 . 2011-11-11 22:07 -------- d-----w- c:\program files\Wondershare
    2011-11-08 20:00 . 2011-10-17 11:41 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
    2011-11-08 20:00 . 2011-09-20 21:02 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys
    2011-11-08 20:00 . 2011-09-30 15:57 707584 ----a-w- c:\program files\Common Files\System\wab32.dll
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-11-12 14:21 . 2011-09-11 14:08 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2011-10-03 10:06 . 2011-09-11 13:58 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2011-09-11 16:31 . 2008-08-06 22:29 353840 ----a-w- c:\windows\system32\msvcr71.dll
    2011-09-11 16:31 . 2008-08-06 22:27 505392 ----a-w- c:\windows\system32\msvcp71.dll
    2011-09-11 16:30 . 2008-10-23 10:43 1066544 ----a-w- c:\windows\system32\MFC71.dll
    2011-09-11 16:30 . 2008-10-23 10:43 1053232 ----a-w- c:\windows\system32\MFC71u.dll
    2011-09-06 13:30 . 2011-10-11 20:45 2043392 ----a-w- c:\windows\system32\win32k.sys
    2011-09-02 13:39 . 2011-10-11 20:44 1383424 ----a-w- c:\windows\system32\mshtml.tlb
    2011-11-09 19:59 . 2011-09-11 14:06 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
    "HPAdvisor"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2008-09-30 972080]
    "Aim"="c:\program files\AIM\aim.exe" [2011-05-03 4321112]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
    "Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-10-13 19979400]
    "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-11-07 4617600]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-17 1049896]
    "QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2008-09-24 468264]
    "UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
    "UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2008-10-07 210216]
    "UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-12-24 222504]
    "QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-08-01 202032]
    "UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
    "UpdatePDIRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
    "HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
    "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-05 421888]
    "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
    "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-11-13 421736]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-12 137752]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-12 171032]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-12 172568]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9f.exe" [2008-03-25 218496]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2010-5-28 276328]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1601730260-1379543078-2060792534-1000]
    "EnableNotificationsRef"=dword:00000001
    .
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
    S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2011-07-22 12880]
    S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2011-07-12 67664]
    S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2011-08-11 116608]
    S2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\SMINST\BLService.exe [2008-10-06 365952]
    S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
    S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-04-03 193840]
    S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-06-29 112128]
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    HPService REG_MULTI_SZ HPSLPSVC
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
    2008-06-09 17:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-11-29 c:\windows\Tasks\At10.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At11.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At12.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At13.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At14.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At15.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At16.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At17.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At18.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At19.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At2.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At20.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At21.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At22.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At23.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At24.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At25.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At26.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At27.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At28.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At29.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At3.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At30.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At31.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-28 c:\windows\Tasks\At32.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-28 c:\windows\Tasks\At33.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-28 c:\windows\Tasks\At34.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-28 c:\windows\Tasks\At35.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-28 c:\windows\Tasks\At36.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-28 c:\windows\Tasks\At37.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-28 c:\windows\Tasks\At38.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-28 c:\windows\Tasks\At39.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At4.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At40.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At41.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At42.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At43.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At44.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At45.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At46.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At47.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At48.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At49.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At5.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At6.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At7.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At8.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At9.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1601730260-1379543078-2060792534-1000Core.job
    - c:\users\Ashley\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-20 20:20]
    .
    2011-11-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1601730260-1379543078-2060792534-1000UA.job
    - c:\users\Ashley\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-20 20:20]
    .
    2011-11-11 c:\windows\Tasks\HPCeeScheduleForAshley.job
    - c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2008-10-23 18:34]
    .
    2011-11-29 c:\windows\Tasks\WebReg Officejet 6000 E609a Series.job
    - c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2010-05-28 04:25]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
    mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
    uInternet Settings,ProxyOverride = *.local
    uInternet Settings,ProxyServer = http=127.0.0.1:62970
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
    TCP: DhcpNameServer = 192.168.1.1
    FF - ProfilePath - c:\users\Ashley\AppData\Roaming\Mozilla\Firefox\Profiles\9j1v10w6.default\
    FF - prefs.js: network.proxy.http - 127.0.0.1
    FF - prefs.js: network.proxy.http_port - 62970
    FF - prefs.js: network.proxy.type - 1
    FF - user.js: network.protocol-handler.warn-external.dnupdate - false
    .
    - - - - ORPHANS REMOVED - - - -
    .
    HKLM-Run-w8fRZ9hTXjClBzN8234A - c:\windows\system32\AV Protection 2011v121.exe
    .
    .
    .
    **************************************************************************
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files:
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
    @DACL=(02 0000)
    @=""
    "Installed"="1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
    @DACL=(02 0000)
    @=""
    "Installed"="1"
    "NoChange"="1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
    @DACL=(02 0000)
    @=""
    "Installed"="1"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\WLANExt.exe
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\Common Files\LightScribe\LSSrvc.exe
    c:\program files\CyberLink\Shared files\RichVideo.exe
    c:\windows\system32\DRIVERS\xaudio.exe
    c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
    c:\windows\system32\03D37I~1.COM
    c:\windows\system32\03D37I~1.COM
    c:\windows\system32\03D37I~1.COM
    c:\windows\system32\igfxsrvc.exe
    c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
    c:\program files\iPod\bin\iPodService.exe
    c:\program files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
    c:\program files\Windows Media Player\wmpnscfg.exe
    c:\program files\Windows Media Player\wmpnetwk.exe
    c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
    c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
    c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
    c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
    c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
    c:\windows\system32\03D37I~1.COM
    c:\windows\system32\03D37I~1.COM
    c:\windows\system32\03D37I~1.COM
    c:\windows\system32\03D37I~1.COM
    c:\windows\system32\03D37I~1.COM
    .
    **************************************************************************
    .
    Completion time: 2011-11-29 14:58:41 - machine was rebooted
    ComboFix-quarantined-files.txt 2011-11-29 19:58
    .
    Pre-Run: 213,471,830,016 bytes free
    Post-Run: 215,841,837,056 bytes free
    .
    - - End Of File - - 3F28E318DCBA72F8F4BF4AE8C14823FE
     
  8. Larusso

    Larusso

    Joined:
    Aug 9, 2011
    Messages:
    808
    Hy there,

    this is not the complete log

    Please,
    • double-click on a Logfile to open it.
    • Right click with your mouse or touchpad.
    • Chose Select All from the shortcut menu.
    • Right click again, then chose Copy from the shortcut menu.
    • Go the window where you are typing your new topic. Select an area after the text.
    • Right click and select Paste from the shortcut menu.
     
  9. vivalamusic

    vivalamusic Thread Starter

    Joined:
    Dec 31, 1969
    Messages:
    20
    Sorry, okay here you go.

    ComboFix 11-11-28.02 - Ashley 11/29/2011 6:35.1.2 - x86
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3002.2309 [GMT -5:00]
    Running from: c:\users\Ashley\Desktop\ComboFix.exe
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\program files\LP
    c:\programdata\Son83Ntr.exe
    c:\users\Ashley\AppData\Roaming\firefox.exe
    c:\users\Ashley\AppData\Roaming\java.exe
    c:\users\Ashley\AppData\Roaming\ldr.ini
    c:\windows\$NtUninstallKB5054$
    c:\windows\$NtUninstallKB5054$\1120660564
    c:\windows\$NtUninstallKB5054$\4030260102\@
    c:\windows\$NtUninstallKB5054$\4030260102\bckfg.tmp
    c:\windows\$NtUninstallKB5054$\4030260102\cfg.ini
    c:\windows\$NtUninstallKB5054$\4030260102\Desktop.ini
    c:\windows\$NtUninstallKB5054$\4030260102\keywords
    c:\windows\$NtUninstallKB5054$\4030260102\kwrd.dll
    c:\windows\$NtUninstallKB5054$\4030260102\L\qnbwvoto
    c:\windows\$NtUninstallKB5054$\4030260102\lsflt7.ver
    c:\windows\$NtUninstallKB5054$\4030260102\U\[email protected]
    c:\windows\$NtUninstallKB5054$\4030260102\U\[email protected]
    c:\windows\$NtUninstallKB5054$\4030260102\U\[email protected]
    c:\windows\$NtUninstallKB5054$\4030260102\U\[email protected]
    c:\windows\$NtUninstallKB5054$\4030260102\U\[email protected]
    c:\windows\$NtUninstallKB5054$\4030260102\U\[email protected]
    c:\windows\Tasks\At1.job
    c:\windows\Temp\_ex-68.exe
    .
    Infected copy of c:\windows\system32\drivers\cdrom.sys was found and disinfected
    Restored copy from - c:\windows\System32\DriverStore\FileRepository\cdrom.inf_c949a5b6\cdrom.sys
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-10-28 to 2011-11-29 )))))))))))))))))))))))))))))))
    .
    .
    2011-11-29 11:48 . 2011-11-29 11:48 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-11-29 11:48 . 2011-11-29 19:55 -------- d-----w- c:\users\Ashley\AppData\Local\temp
    2011-11-29 05:19 . 2011-11-25 23:17 111616 ----a-w- c:\windows\system32\03D37iu.com
    2011-11-26 21:29 . 2011-11-26 21:29 -------- d-----w- c:\windows\system32\x64
    2011-11-26 21:15 . 2011-11-26 21:15 -------- d-----w- c:\users\Ashley\AppData\Local\ElevatedDiagnostics
    2011-11-26 19:14 . 2011-11-26 19:14 -------- d-----w- c:\users\Ashley\AppData\Roaming\SUPERAntiSpyware.com
    2011-11-26 19:04 . 2011-11-26 19:14 -------- d-----w- c:\program files\SUPERAntiSpyware
    2011-11-26 19:04 . 2011-11-26 19:04 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
    2011-11-26 19:00 . 2011-11-26 19:00 -------- d-----w- c:\users\Ashley\AppData\Roaming\Malwarebytes
    2011-11-26 19:00 . 2011-11-26 19:00 -------- d-----w- c:\programdata\Malwarebytes
    2011-11-26 19:00 . 2011-11-26 19:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-11-26 19:00 . 2011-08-31 22:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-11-26 04:36 . 2011-10-03 10:06 476904 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
    2011-11-24 18:41 . 2011-11-26 15:58 -------- d-----w- c:\program files\PC Tools Security
    2011-11-24 18:33 . 2011-11-25 04:33 -------- d-----w- c:\programdata\PC Tools
    2011-11-24 14:23 . 2011-11-24 14:23 -------- d-----w- c:\users\Ashley\AppData\Roaming\klIBtzPNyAu
    2011-11-24 14:23 . 2011-11-24 14:23 -------- d-----w- c:\users\Ashley\AppData\Roaming\QQJ7dEK8gZhXjV
    2011-11-24 14:18 . 2011-11-24 14:18 -------- d-----w- c:\users\Ashley\AppData\Roaming\FS2obd8fR9TqUrA
    2011-11-24 14:18 . 2011-11-24 14:18 -------- d-----w- c:\users\Ashley\AppData\Roaming\J8fRZ9hTXjCIzxu
    2011-11-24 14:06 . 2011-11-24 14:06 -------- d-----w- c:\users\Ashley\AppData\Roaming\pA1uvD2ob4m58R9
    2011-11-24 14:06 . 2011-11-24 14:06 -------- d-----w- c:\users\Ashley\AppData\Roaming\vK8gRZ9hYwUlBzN
    2011-11-24 14:05 . 2011-11-24 14:05 -------- d-----w- c:\users\Ashley\AppData\Roaming\nfRL9hTXqUeIrOy
    2011-11-24 14:03 . 2011-11-24 14:03 -------- d-----w- c:\users\Ashley\AppData\Roaming\VqhYkeBtz0c1D4m
    2011-11-24 14:03 . 2011-11-24 14:03 -------- d-----w- c:\users\Ashley\AppData\Roaming\S5sQJ7EK8R
    2011-11-23 22:27 . 2011-11-23 22:27 -------- d-----w- c:\users\Ashley\AppData\Roaming\XWWK77fEL9
    2011-11-23 22:27 . 2011-11-23 22:27 -------- d-----w- c:\users\Ashley\AppData\Roaming\jSSS2iibD3pG4QH
    2011-11-22 22:16 . 2011-11-29 11:32 -------- d-----w- c:\users\Ashley\AppData\Roaming\91B86
    2011-11-22 22:16 . 2011-11-22 22:16 101888 ----a-w- c:\users\Ashley\AppData\Roaming\Microsoft\4606\240E.tmp
    2011-11-22 22:16 . 2011-11-22 22:16 -------- d-----w- c:\users\Ashley\AppData\Roaming\T3GG44aQH
    2011-11-22 22:16 . 2011-11-22 22:16 -------- d-----w- c:\users\Ashley\AppData\Roaming\qrrrzOONtxAucSi
    2011-11-22 22:15 . 2011-11-29 11:32 -------- d-----w- c:\users\Ashley\AppData\Roaming\68991
    2011-11-22 22:15 . 2011-11-22 22:15 -------- d-----w- c:\users\Ashley\AppData\Roaming\RppnGG4aQH6sK7E
    2011-11-22 22:15 . 2011-11-22 22:15 -------- d-----w- c:\users\Ashley\AppData\Roaming\mFF44pmG5sQJd
    2011-11-22 22:15 . 2011-11-22 22:15 -------- d-----w- c:\users\Ashley\AppData\Roaming\dZ99hhYXwjUV
    2011-11-22 20:17 . 2011-10-18 06:28 6668624 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3510A141-4214-4D11-8627-A15AE38768B5}\mpengine.dll
    2011-11-20 03:43 . 2011-11-20 03:43 -------- d-----w- c:\program files\iPod
    2011-11-20 03:42 . 2011-11-20 03:44 -------- d-----w- c:\program files\iTunes
    2011-11-15 23:01 . 2011-11-15 23:01 -------- d-----w- c:\program files\Common Files\Skype
    2011-11-15 23:01 . 2011-11-15 23:03 -------- d-----r- c:\program files\Skype
    2011-11-14 14:27 . 2011-11-14 14:27 4335776 ----a-w- c:\program files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
    2011-11-12 18:56 . 2011-11-12 18:56 -------- d-----w- c:\programdata\AVS4YOU
    2011-11-12 18:56 . 2011-11-12 18:56 -------- d-----w- c:\users\Ashley\AppData\Roaming\AVS4YOU
    2011-11-12 18:53 . 2011-11-24 14:27 -------- d-----w- c:\program files\Common Files\AVSMedia
    2011-11-12 18:52 . 2011-06-23 18:25 24576 ----a-w- c:\windows\system32\msxml3a.dll
    2011-11-12 18:52 . 2011-11-24 14:27 -------- d-----w- c:\program files\AVS4YOU
    2011-11-12 18:35 . 2011-11-12 18:35 -------- d-----w- c:\programdata\muvee Technologies
    2011-11-12 18:35 . 2011-11-12 18:36 -------- d-----w- c:\users\Ashley\AppData\Roaming\muvee Technologies
    2011-11-12 18:27 . 2011-11-12 18:27 -------- d-----w- c:\windows\Sun
    2011-11-11 22:07 . 2011-11-11 22:07 -------- d-----w- c:\programdata\Wondershare
    2011-11-11 22:07 . 2011-11-11 22:07 -------- d-----w- c:\program files\Wondershare
    2011-11-08 20:00 . 2011-10-17 11:41 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
    2011-11-08 20:00 . 2011-09-20 21:02 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys
    2011-11-08 20:00 . 2011-09-30 15:57 707584 ----a-w- c:\program files\Common Files\System\wab32.dll
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-11-12 14:21 . 2011-09-11 14:08 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2011-10-03 10:06 . 2011-09-11 13:58 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2011-09-11 16:31 . 2008-08-06 22:29 353840 ----a-w- c:\windows\system32\msvcr71.dll
    2011-09-11 16:31 . 2008-08-06 22:27 505392 ----a-w- c:\windows\system32\msvcp71.dll
    2011-09-11 16:30 . 2008-10-23 10:43 1066544 ----a-w- c:\windows\system32\MFC71.dll
    2011-09-11 16:30 . 2008-10-23 10:43 1053232 ----a-w- c:\windows\system32\MFC71u.dll
    2011-09-06 13:30 . 2011-10-11 20:45 2043392 ----a-w- c:\windows\system32\win32k.sys
    2011-09-02 13:39 . 2011-10-11 20:44 1383424 ----a-w- c:\windows\system32\mshtml.tlb
    2011-11-09 19:59 . 2011-09-11 14:06 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
    "HPAdvisor"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2008-09-30 972080]
    "Aim"="c:\program files\AIM\aim.exe" [2011-05-03 4321112]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
    "Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-10-13 19979400]
    "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-11-07 4617600]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-17 1049896]
    "QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2008-09-24 468264]
    "UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
    "UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2008-10-07 210216]
    "UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-12-24 222504]
    "QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-08-01 202032]
    "UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
    "UpdatePDIRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
    "HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
    "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-05 421888]
    "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
    "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-11-13 421736]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-12 137752]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-12 171032]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-12 172568]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9f.exe" [2008-03-25 218496]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2010-5-28 276328]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1601730260-1379543078-2060792534-1000]
    "EnableNotificationsRef"=dword:00000001
    .
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
    S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2011-07-22 12880]
    S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2011-07-12 67664]
    S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2011-08-11 116608]
    S2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\SMINST\BLService.exe [2008-10-06 365952]
    S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
    S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-04-03 193840]
    S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-06-29 112128]
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    HPService REG_MULTI_SZ HPSLPSVC
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
    2008-06-09 17:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-11-29 c:\windows\Tasks\At10.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At11.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At12.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At13.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At14.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At15.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At16.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At17.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At18.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At19.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At2.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At20.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At21.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At22.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At23.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At24.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At25.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At26.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At27.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At28.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At29.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At3.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At30.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At31.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-28 c:\windows\Tasks\At32.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-28 c:\windows\Tasks\At33.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-28 c:\windows\Tasks\At34.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-28 c:\windows\Tasks\At35.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-28 c:\windows\Tasks\At36.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-28 c:\windows\Tasks\At37.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-28 c:\windows\Tasks\At38.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-28 c:\windows\Tasks\At39.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At4.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At40.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At41.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At42.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At43.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At44.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At45.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At46.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At47.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At48.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At49.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At5.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At6.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At7.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\At8.job
    - c:\windows\system32\03D37iu.com [2011-11-29 23:17]
    .
    2011-11-29 c:\windows\Tasks\At9.job
    - c:\windows\system32\03D37iu.com_ [2011-11-25 23:17]
    .
    2011-11-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1601730260-1379543078-2060792534-1000Core.job
    - c:\users\Ashley\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-20 20:20]
    .
    2011-11-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1601730260-1379543078-2060792534-1000UA.job
    - c:\users\Ashley\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-20 20:20]
    .
    2011-11-11 c:\windows\Tasks\HPCeeScheduleForAshley.job
    - c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2008-10-23 18:34]
    .
    2011-11-29 c:\windows\Tasks\WebReg Officejet 6000 E609a Series.job
    - c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2010-05-28 04:25]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
    mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
    uInternet Settings,ProxyOverride = *.local
    uInternet Settings,ProxyServer = http=127.0.0.1:62970
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
    TCP: DhcpNameServer = 192.168.1.1
    FF - ProfilePath - c:\users\Ashley\AppData\Roaming\Mozilla\Firefox\Profiles\9j1v10w6.default\
    FF - prefs.js: network.proxy.http - 127.0.0.1
    FF - prefs.js: network.proxy.http_port - 62970
    FF - prefs.js: network.proxy.type - 1
    FF - user.js: network.protocol-handler.warn-external.dnupdate - false
    .
    - - - - ORPHANS REMOVED - - - -
    .
    HKLM-Run-w8fRZ9hTXjClBzN8234A - c:\windows\system32\AV Protection 2011v121.exe
    .
    .
    .
    **************************************************************************
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files:
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
    @DACL=(02 0000)
    @=""
    "Installed"="1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
    @DACL=(02 0000)
    @=""
    "Installed"="1"
    "NoChange"="1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
    @DACL=(02 0000)
    @=""
    "Installed"="1"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\WLANExt.exe
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\Common Files\LightScribe\LSSrvc.exe
    c:\program files\CyberLink\Shared files\RichVideo.exe
    c:\windows\system32\DRIVERS\xaudio.exe
    c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
    c:\windows\system32\03D37I~1.COM
    c:\windows\system32\03D37I~1.COM
    c:\windows\system32\03D37I~1.COM
    c:\windows\system32\igfxsrvc.exe
    c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
    c:\program files\iPod\bin\iPodService.exe
    c:\program files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
    c:\program files\Windows Media Player\wmpnscfg.exe
    c:\program files\Windows Media Player\wmpnetwk.exe
    c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
    c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
    c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
    c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
    c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
    c:\windows\system32\03D37I~1.COM
    c:\windows\system32\03D37I~1.COM
    c:\windows\system32\03D37I~1.COM
    c:\windows\system32\03D37I~1.COM
    c:\windows\system32\03D37I~1.COM
    .
    **************************************************************************
    .
    Completion time: 2011-11-29 14:58:41 - machine was rebooted
    ComboFix-quarantined-files.txt 2011-11-29 19:58
    .
    Pre-Run: 213,471,830,016 bytes free
    Post-Run: 215,841,837,056 bytes free
    .
    - - End Of File - - 3F28E318DCBA72F8F4BF4AE8C14823FE
     
  10. Larusso

    Larusso

    Joined:
    Aug 9, 2011
    Messages:
    808
    Now worries :)

    While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes interfere our fixes
    Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.
    • Open Spybot Search & Destroy.
    • In the Mode menu click "Advanced mode" if not already selected.
    • Choose "Yes" at the Warning prompt.
    • Expand the "Tools" menu.
    • Click "Resident".
    • Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
    • In the File menu click "Exit" to exit Spybot Search & Destroy.



    Open notepad and copy/paste the text in the Code-box below into it:

    Code:
    Collect::
    c:\windows\system32\03D37iu.com
    
    DirLook::
    c:\windows\system32\x64
    
    Folder::
    c:\users\Ashley\AppData\Roaming\klIBtzPNyAu
    c:\users\Ashley\AppData\Roaming\QQJ7dEK8gZhXjV
    c:\users\Ashley\AppData\Roaming\FS2obd8fR9TqUrA
    c:\users\Ashley\AppData\Roaming\J8fRZ9hTXjCIzxu
    c:\users\Ashley\AppData\Roaming\pA1uvD2ob4m58R9
    c:\users\Ashley\AppData\Roaming\vK8gRZ9hYwUlBzN
    c:\users\Ashley\AppData\Roaming\nfRL9hTXqUeIrOy
    c:\users\Ashley\AppData\Roaming\VqhYkeBtz0c1D4m
    c:\users\Ashley\AppData\Roaming\S5sQJ7EK8R
    c:\users\Ashley\AppData\Roaming\XWWK77fEL9
    c:\users\Ashley\AppData\Roaming\jSSS2iibD3pG4QH
    c:\users\Ashley\AppData\Roaming\91B86
    c:\users\Ashley\AppData\Roaming\Microsoft\4606
    c:\users\Ashley\AppData\Roaming\T3GG44aQH
    c:\users\Ashley\AppData\Roaming\qrrrzOONtxAucSi
    c:\users\Ashley\AppData\Roaming\68991
    c:\users\Ashley\AppData\Roaming\RppnGG4aQH6sK7E
    c:\users\Ashley\AppData\Roaming\mFF44pmG5sQJd
    c:\users\Ashley\AppData\Roaming\dZ99hhYXwjUV
    
    AtJob::
    
    
    
    
    • Save this as CFScript.txt, in the same location as ComboFix.exe.
    • Close any open browsers.
    • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    [​IMG]

    Refering to the picture above, drag CFScript into ComboFix.exe.
    When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.


    **Note**

    When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
    • Ensure you are connected to the internet and click OK on the message box.



    Please post in your next reply
    Combofix.txt
    How is your system behaving now ?
     
  11. vivalamusic

    vivalamusic Thread Starter

    Joined:
    Dec 31, 1969
    Messages:
    20
    It says, "You are missing administrator rights to perform this action. If you need to do this, please run this application elevated as an administrator." How do I do this?

    Thank you.
     
  12. Larusso

    Larusso

    Joined:
    Aug 9, 2011
    Messages:
    808
    When you are trying to disable teatimer ?
     
  13. vivalamusic

    vivalamusic Thread Starter

    Joined:
    Dec 31, 1969
    Messages:
    20
    Yes. My account on this laptop is already Administrator though.
     
  14. Larusso

    Larusso

    Joined:
    Aug 9, 2011
    Messages:
    808
    Yes, sometimes the User Account Control can interfere us.

    As we can try to run Spybot as Admin.... I will prefer to run this batch file

    Download ResetTeaTimer.bat and safe it on your Desktop.
    Rightclick the .bat file and choose "Run as Administrator".

    After this, reboot and move on with Combofix :)
     
  15. vivalamusic

    vivalamusic Thread Starter

    Joined:
    Dec 31, 1969
    Messages:
    20
    Never mind, didn't need to become Administrator, found out that all I needed to do was to toggle it.
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/1028520

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice