Explore topic-wise InterviewSolutions in .

Sorry i didn't clarify. I am running as administrator. Ok. You will have to skip over Secunia but please make sure that Windows and Java are up-to-date.I was able to update all the other programs that came up from Secunia something is just messed up with acrobat reader.

Windows and Java are up to date.

I was able to remove all the other programs we used also.

One thing I'm noticing it it takes a lot longer for my computer to login to a account (admin or matthew) since I have loaded a 3rd party firewall (Online Armor). My computer makes a strange buzzing/ SCRAPING sound (sounds like the hard drive) when the firewall is turned on/ off. Is that normal? Should I remove it and load another? Quote

My computer makes a strange buzzing/ scraping sound (sounds like the hard drive) when the firewall is turned on/ off. Is that normal? Should I remove it and load another?

• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
• Open notepad and copy/paste the text in the quotebox below into it:
  Quote

  KillAll::
  
  RegLock::
  [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
  [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
  [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
  
  

• Save this as CFScript.txt, in the same location as ComboFix.exe
  
  
  
  
• Referring to the picture above, drag CFScript into ComboFix.exe
• When finished, it shall produce a log for you at C:\ComboFix.txt
  
• Post the ComboFix log in your next reply.
  

Will do.

Also another question do you know how to unlock a registry key so i can install the latest Acrobat reader/ I keep getting the error:
Error 1402.could not open key:
HKEY_local_Machine\software\microsoft\windows\currentversion\Run\optionalcomponents\MSFS.
Verify that you have sufficient access to that key of contact support personel
When i try to install the latest version of acrobat reader.

I tried going through the steps at http://johnsonyip.com/index.php?option=com_content&view=article&id=96&Itemid=198 but hit a wall around step 11 because i don't have a "other users or groups..." button.

I'd really need to have acrobat reader on my computer.

Good. Carry on with your cleanup as described in Reply # 25. Please let me know when you're done.

• Download TDSSKiller and save it to your Desktop.
  
• Extract its contents to your desktop.
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
• If an infected file is detected, the default action will be Cure, click on Continue.
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
• Click the Report button and copy/paste the contents of it into your next reply
  

• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
• Open notepad and copy/paste the text in the quotebox below into it:
  Quote

  KillAll::
  
  RegNull::
  [HKEY_USERS\S-1-5-21-3225168310-450358799-2518029026-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0619892F-D16A-973B-E705-9F49F072D162}*]
  "lahilkapdgongndefaipeipf"=hex:65,62,64,62,62,6d,62,66,70,63,67,6a,62,6e,67,6b,
  65,63,6f,6a,67,6f,65,6d,63,62,68,67,6d,6f,6a,68,6d,6e,67,6f,64,6a,6b,62,61,\
  "haihofnpmgmhjfmc"=hex:63,62,6e,66,68,69,6c,6e,68,67,68,6e,64,6d,6b,61,61,6c,
  6c,6f,61,6e,6c,66,6b,6b,6b,64,6d,62,70,66,6b,6b,6c,6f,6f,66,00,00
  "haihofnpbfmnlepb"=hex:6f,61,66,69,65,67,64,68,62,66,6c,6e,63,62,6c,6c,6b,6d,
  67,70,6d,65,64,6c,68,62,6c,67,61,61,00,66
  
  MBR::
  
  

• Save this as CFScript.txt, in the same location as ComboFix.exe
  
  
  
  
• Referring to the picture above, drag CFScript into ComboFix.exe
• When finished, it shall produce a log for you at C:\ComboFix.txt
  
• Please post the contents of the log in your next reply.

Downloaded comodo.

1) I did not see any options to uncheck:
-"Install Comodo SafeSurf..",
-Make Comodo my default search provider"
-"Make Comodo Search my homepage" and
-uncheck any HopSurf and/or Ask.com options if you choose this one

-Is that normal?


2) I DID see these options:
-Comodo GeekBuddy (I choose to uncheck)
-Firewall only, Firewall Optimum, or Firewall Max (I choose Optimum)
-Comodo SecureDNS SERVER (I selected it)

-Did I make the right calls, if not, how to fix?
Thanks!I installed spyware blaster but did not do spybot search and destroy. After reading this site, I am novice with PC, and saw if I need to do HIJACK this it would interfere, and I just didn't WANT to make things more complicated. OK?


Also, if in the near future I get a new PC, I TAKE it no MATTER what I should]
1) Get CCleaner
2) Get SAS
3) Get MBAM
4) Get Comodo and disable any Windows or Apple firewall
5) Get spyware blaster

First thing when I get the new PC, right?

Thanks again!Quote

Also, if in the near future I get a new PC, I take it no matter what I should]
1) Get CCleaner
2) Get SAS
3) Get MBAM
4) Get Comodo and disable any Windows or Apple firewall
5) Get spyware blaster

First thing when I get the new PC, right?

That's good. If there are no other issues, let's do some cleanup.

To uninstall ComboFix

• Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
  
• In the field, type in ComboFix /uninstall
  

• Then, press Enter, or click OK.
  
• This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
  

I ran combofix /uninstall, but it did not remove the folders etc that I think it created. It actually added one c:\combofix.

• Click the CleanUp button.
  
• Select Yes when the "Begin cleanup Process?" prompt appears.
  
• If you are PROMPTED to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes.

Do you have any idea where this sorta thing would have come from? This isn't the first time I've gotten it on my computer.Quote

I just noticed that I now have a shortcut to that Windows Vista Recovery thing on my desktop. Can i just delete it? or not just yet?

Do you have any idea where this sorta thing would have come from? This isn't the first time I've gotten it on my computer.

• Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
  
• In the field, type in ComboFix /uninstall
  

• Then, press Enter, or click OK.
  
• This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
  

Thanks for the fix Okay, the complete scan finished, however, there is no option to report incurable. Should I just save the report list and exit the program afterwards? Please try running the ESET scan again.Dr web Report list


Process in memory: C:\WINDOWS\system32\svchost.exe:744;;BackDoor.Tdss.565;Eradicated.;
f_0005c3;C:\Documents and Settings\My Computer\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache(2);Probably SCRIPT.Virus;Incurable.Moved.;
sma_common[1].js;C:\Documents and Settings\My Computer\Local Settings\Temporary Internet Files\Content.IE5\SLEFKDEB;Probably SCRIPT.Virus;Incurable.Moved.;
change.log.1;C:\System Volume Information\_restore{BABF27AF-98B1-46AD-8AEE-3507E0DEE2FA}\RP173;Modification of Trojan.DownLoad1.17823;Incurable.Moved.;
sma_common.js;I:\common\inc;Probably SCRIPT.Virus;;
sprt_common.js;I:\sprtcommon\inc;Probably SCRIPT.Virus;;
That looks good. If there are no other issues, let's cleanup. You may keep SAS and MBAM, if you wish. Update them and run them regularly.

Download OTL to your desktop.
To remove all of the tools we used and the files and folders they created do the following:
Double click OTL.exe.

• Click the CleanUp button.
  
• Select Yes when the "Begin cleanup Process?" prompt appears.
  
• If you are prompted to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes.

What are the programs that OTL is supposed to remove?
If they are not removed will it make my computer slow to start up?

It would appear that your computer is clean. Any other issues?Nicest words I have heard all week. Thank you so much.
Any recommendations in terms of how often to run the Avira AntiVirus, Malware and Spybot?Quote

Any recommendations in terms of how often to run the Avira AntiVirus, Malware and Spybot?

• Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
  
• In the field, type in ComboFix /uninstall
  

• Then, press Enter, or click OK.
  
• This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
  

Okay, i EASILY went to the Start>Run and did that.

I could NOT go to the ESET page on my desktop as whatever I have is obviously blocking me from that page. So I went to the ESET page from my laptop and put the .exe file on my SD card to then put it onto my desktop as I have done with other programs that I haven't been able to access from my desktop.

I cannot get ESET to run because it goes to update first and it says it can not get update is proxy configured? I do not know what to do now or how to get the ESET update from my laptop onto my desktop.


Ok. Let's try this one:

Run the BitDefender Online scanner

Agree to the license and then select SCAN. DO NOT CHANGE THE OPTIONS TO SHOW ALL FILES SCANNED. That will make your logs huge and we don't need to see clean files.

Once Bitdefender completes the scan:
Click-on the Detected Problems tab.
Then select Click here to export the scan report.

When the window comes up to save the report, change the Save as type: box to:
Text (Tab Delimited) (*.txt) and then in the File name box enter change to bdscan then click Save.

This will save a file named bdscan.txt. I would suggest saving it to the Desktop so you can easily find it. (take notice of where you save it so you can find it later).
This bdcan.txt file will actually contain HTML code that we can easily view later while reviewing your log. All we have to do is rename the file to bdscan.html.

If you do not follow these step, you will have an incorrect log or worse a log summary which is useless to us.

Post the bdscan.txt file as an Attachment.
I cannot get to that page from my desktop. I went to it on my laptop but there was no file, that I could find, to download to put on my SD card to then transfer onto my desktop. Whatever I have is blocking me from these sites.
Please try this:

Please download TDSSKiller from here and save it to your Desktop.

• Doubleclick TDSSKiller.exe to run the tool
  
• Click the Start Scan button (If prompted with a "hidden service warning" do go ahead and delete it.)
  
  
• After the scan has finished, click the Close button
  
• Click the Report button and copy/paste the contents of it into your next reply
  
• Note:It will also create a log in the C:\ directory.
  

My PC can not access the internet. DIRECTX 9 was uninstalled "per se" and can not reinstall it. I can not access CD drive. Would LIKE your recommendations

[recovering disk space - old attachment deleted by admin]Quote from: antalves on March 02, 2011, 04:38:29 AM

DirectX 9 was uninstalled "per se"

DirectX is a crucial system component. It cannot be uninstalled without reinstalling your operating system (!) or performing a system restore/system recovery.

OK SuperDave that has been done. What do you suggest next?
Anyway, I'm no longer receiving the message that I mentioned at the beginning of this post. I've had no further PROBLEMS connecting to the internet. The only thing that's still odd is not being able to click once/twice to access files/programs etc. through the shortcuts on my desktop. Sometimes clicking perhaps 8/9 times will work. Also right clicking and then "OPEN" always works. I've tried 2 different PS/2 mice and one USB and still same problem. One other thing that I wanted to point out is a few of the logs( don't remember which ones now) that we're related to the apps. that you had me download and I saved to my desktop, were completely blank( looked like a blank page.) The only reason that I mention this is; while I was surfing the web looking for answers about not being able to open the shortcuts I came across a site somewhere (don't know if I could ever find it again)that said something to the effect that if you are having problems opening shortcuts and some of the icons on your desktop are blank it's probably a worm. Now perhaps this is total nonsense and I sure trust your knowledge and expertise on malware much,much, more that this, but just thought that I'd mention it. Sure appreciate all your help. naturegurlPlease try deleting one of those shortcuts and create a new one and see if it works.I think my PC might have spyware on it. How do I tell for sure? And how do I remove it?Quote from: SuperDave on February 24, 2011, 07:53:09 PM

Please try deleting one of those shortcuts and create a new one and see if it works.

• Extract it to Desktop and double click SREngLdr.EXE to run it
  
• Select System Repair from the left pane.
  
• Click on File Association
  
• Select all entries that has an Error status click [Repair]
  
• Refer to this image for an example:

• In your case, it would be .EXE
  
• Close SREng now.

Ok. Let's try this:

Please download SREng

• Extract it to Desktop and double click SREngLdr.EXE to run it
  
• Select System Repair from the left pane.
  
• Click on File Association
  
• Select all entries that has an Error status click [Repair]
  
• Refer to this image for an example:

• In your case, it would be .EXE
  
• Close SREng now.

.

I'm going to check with a colleague about this problem. In the meantime, please try this:

Do you have your OS CD/DVD?

If so,

1/ Click the Start button.

2/ From the Start Menu, Click All programs followed by Accessories.

3/ In the Accessories menu, Right Click on the Command Prompt option.

4/ From the drop down menu that appears, Click on the Run as administrator option.

5/ If you have the User Account Control (UAC) enabled you will be asked for authorisation prior to the command prompt opening. You may simply need to press the Continue button if you are the administrator or insert the administrator password etc.

6/ In the Command Prompt window, type: sfc /scannow and then press Enter.

7/ A message will appear stating that the system scan will begin.

8/ Be patient because the scan may take some time.

9/ If any files require replacing SFC will replace them. You may be asked to insert your Vista DVD for this process to continue.

10/ If everything is okay you should, after the scan, see the following message Windows resource protection did not find any integrity violations.

11/ After the scan has completed, Close the command prompt window.

So now that this has been overcome, as well as no more corrupted search provider messages, no hanging downloads, no further internet connection problems, is there any other things that you would have me check. My PC now seems to be running great now and I'm wondering if you think my PC is clean? Thanks so much.

• Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
  
• In the field, type in ComboFix /uninstall
  

• Then, press Enter, or click OK.
  
• This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
  

Dave, when I ran the Secunia Software Inspector it said that I needed to update my Internet Explorer and I should go to windows update to get a bunch of missing patches. But when I go to windows update it TELLS me there are no updates for my computer. What should I do? Here is the info from the scan:

This installation of Microsoft Internet Explorer 8.x is insecure and potentially exposes your system to security threats!

Your system does not have all security related patches from Microsoft installed. Please see list below for details about the missing patches.

Update Instructions:
Download via Microsoft Windows Update.

Missing KB Articles:
KB982381
KB982381
KB982381
KB982381
KB982381
KB982381
KB982381
KB982381
KB982381
KB982381
KB982381
KB982381
KB982381
KB982381
KB982381
KB982381
KB980182
KB980182
KB980182
KB980182
KB980182
KB980182
KB980182
KB980182
KB980182
KB980182
KB980182
KB980182
KB980182
KB980182
KB980182
KB978207
KB978207
KB978207
KB978207
KB978207
KB978207
KB978207
KB978207
KB978207
KB978207
KB978207
KB978207
KB978207
KB978207
KB976325
KB976325
KB976325
KB976325
KB976325
KB976325
KB976325
KB976325
KB976325
KB976325
KB976325
KB976325
KB976325
KB976325
KB974455
KB974455
KB974455
KB974455
KB974455
KB974455
KB974455
KB974455
KB974455
KB974455
KB974455
KB974455
KB974455
KB974455
KB972260
KB972260
KB972260
KB972260
KB972260
KB972260
KB972260
KB972260
KB972260
KB972260
KB972260
KB972260
KB972260
KB972260
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB980195
KB982381
KB982381
KB982381
KB982381
KB982381
KB982381
KB982381
KB982381
KB982381
KB982381
KB982381
KB982381
KB982381
KB982381
KB982381
KB982381
KB982381
KB982381
KB980195
KB980195
KB980195
KB980182
KB980182
KB980182
KB980182
KB980182
KB980182
KB980182
KB980182
KB980182
KB980182
KB980182
KB980182
KB980182
KB980182
KB980182
KB980182
KB980182
KB978207
KB978207
KB978207
KB978207
KB978207
KB978207
KB978207
KB978207
KB978207
KB978207
KB978207
KB978207
KB978207
KB978207
KB978207
KB978207
KB976325
KB976325
KB976325
KB976325
KB976325
KB976325
KB976325
KB976325
KB976325
KB976325
KB976325
KB976325
KB976325
KB976325
KB976325
KB976325
KB974455
KB974455
KB974455
KB974455
KB974455
KB974455
KB974455
KB974455
KB974455
KB974455
KB974455
KB974455
KB974455
KB974455
KB974455
KB974455
KB972260
KB972260
KB972260
KB972260
KB972260
KB972260
KB972260
KB972260
KB972260
KB972260
KB972260
KB972260
KB972260
KB972260
KB972260
KB972260
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB969897
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2416400
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2360131
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461
KB2183461

I have ran the software inspector several times from both IE and firefox. I was able to update all the software except fro the IE patches listed above, and also it keeps saying I need to update my firefox from version 3.5.10 to the latest 3.5.16. I have downloaded the upgrade several times, and when I check from in firefox it says I am RUNNING version 3.5.16. I also checked for updates from within firefox and it said no updates were available. Quote

when I go to windows update it tells me there are no updates for my computer. What should I do?

This installation of Microsoft Internet Explorer 8.x is insecure and potentially exposes your system to security threats!

I have downloaded the upgrade several times, and when I check from in firefox it says I am running version 3.5.16. I also checked for updates from within firefox and it said no updates were available.

Are you still getting the google re-directs?

UPDATE Your Java (JRE)

Old versions of Java have vulnerabilities that malware can use to infect your system.

First Verify your Java Version

If there are any other version(s) installed then update now.

Get the new version (if needed)

If your version is out of date install the newest version of the Sun Java Runtime Environment.

Note: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Be sure to close ALL open web browsers before starting the installation.

Remove any old versions

1. Download JavaRa and unzip the file to your Desktop.
2. Open JavaRA.exe and choose Remove Older Versions
3. Once complete exit JavaRA.

Additional Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and reboot your computer.
*************************************************
I'd like to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
•Click the button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

• Click the Start button. Click RUN. For Vista: type in Run in the Start search, and click on Run in the results pane.
  
• In the field, type in ComboFix /uninstall
  

• Then, press Enter, or click OK.
  
• This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
  

I'm having trouble uninstalling ComboFix. I need to deactivate my antivirus

but my desktop(along with the taskbar and start button) is not showing up. It would usually show up in about three minutes, but recently its just stopped appearing.

Did this just start to happen recently or has it been doing it all along?

It has been happening all along.

• Please download Unhide by Grinler from here and save it to your desktop.
  
• Double click unhide.exe to run the tool.
  
• It will take some time to go through all your files, so please be patient.
• If this tool doesn´t fix the problem, please let me know.

nothing happens when I click on Run.

Ok. Please try uninstalling AVG using this REMOVAL tool.
AVG Antivirus Remover utilityI accidently closed ComboFix b/4 the log was finished so I re-ran it. Here is the log:

omboFix 11-05-25.03 - Rebecca Woods 05/26/2011 10:44:55.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2038.1361 [GMT -5:00]
Running from: c:\documents and settings\Rebecca Woods\Desktop\ComboFix.exe
AV: AVG Anti-Virus *Disabled/Outdated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
FW: Online Armor Firewall *Enabled* {B797DAA0-7E2E-4711-8BB3-D12744F1922A}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\documents and settings\Rebecca Woods\g2mdlhlpx.exe
c:\documents and settings\Rebecca Woods\GoToAssistDownloadHelper.exe
c:\windows\Downloaded Program Files\f3initialsetup1.0.1.1.inf
c:\windows\system32\rnaph.dll
.
.
((((((((((((((((((((((((( Files Created from 2011-04-26 to 2011-05-26 )))))))))))))))))))))))))))))))
.
.
2011-05-26 14:18 . 2011-05-09 18:466962000----a-w-c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{1C9BD671-6650-4FAA-B6C1-5CF771BBD1E3}\mpengine.dll
2011-05-25 22:39 . 2011-05-25 22:39--------d-----w-C:\Pro
2011-05-21 19:49 . 2011-05-21 19:49--------d-----w-C:\_OTL
2011-05-21 12:06 . 2011-05-21 12:06388096----a-r-c:\documents and settings\Rebecca Woods\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-05-19 01:55 . 2011-05-19 01:55--------d-----w-c:\documents and settings\Rebecca Woods\Application Data\Malwarebytes
2011-05-19 01:54 . 2010-12-20 23:0938224----a-w-c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-19 01:54 . 2011-05-19 01:54--------d-----w-c:\documents and settings\All Users\Application Data\Malwarebytes
2011-05-19 01:54 . 2010-12-20 23:0820952----a-w-c:\windows\system32\drivers\mbam.sys
2011-05-18 22:45 . 2011-05-18 22:45--------d-----w-c:\documents and settings\Rebecca Woods\Application Data\SUPERAntiSpyware.com
2011-05-18 22:45 . 2011-05-18 22:45--------d-----w-c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-05-18 22:12 . 2011-05-18 22:123063136----a-w-C:\ccsetup306.exe
2011-05-18 18:27 . 2011-05-18 19:16--------d-----w-c:\documents and settings\All Users\Application Data\OnlineArmor
2011-05-18 18:27 . 2011-05-18 18:27--------d-----w-c:\documents and settings\Rebecca Woods\Application Data\OnlineArmor
2011-05-18 18:26 . 2011-04-06 18:0239048----a-w-c:\windows\system32\drivers\oahlp32.sys
2011-05-18 18:26 . 2011-04-06 18:0129464----a-w-c:\windows\system32\drivers\OAnet.sys
2011-05-18 18:26 . 2011-04-06 18:0125192----a-w-c:\windows\system32\drivers\OAmon.sys
2011-05-18 18:26 . 2011-04-06 18:01205864----a-w-c:\windows\system32\drivers\OADriver.sys
2011-05-18 14:16 . 2011-05-18 18:11--------d-----w-c:\documents and settings\All Users\Application Data\iolo
2011-05-17 21:01 . 2011-05-17 21:01--------d--h--w-c:\windows\system32\GroupPolicy
2011-05-17 20:31 . 2010-10-19 20:51222080------w-c:\windows\system32\MpSigStub.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-14 10:07 . 2010-07-07 13:42472808----a-w-c:\windows\system32\deployJava1.dll
2011-04-14 07:40 . 2008-06-26 08:3073728----a-w-c:\windows\system32\javacpl.cpl
2011-03-07 05:33 . 2004-08-10 18:02692736---ha-w-c:\windows\system32\inetcomm.dll
2011-03-04 06:37 . 2004-08-10 17:51420864---ha-w-c:\windows\system32\vbscript.dll
2011-03-03 14:47 . 2010-01-06 16:51398760---ha-r-c:\windows\system32\cpnprt2.cid
2011-03-03 13:21 . 2004-08-10 17:511857920---ha-w-c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-05-25 2424192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-03 851968]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-06-06 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-06-06 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-06-06 138008]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-05-16 2183168]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-05-14 1191936]
"SigmatelSysTrayApp"="stsystra.exe" [2007-06-06 405504]
"KADxMain"="c:\windows\system32\KADxMain.exe" [2006-11-02 282624]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-28 17920]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-12-21 184320]
"eBook Library Launcher"="c:\program files\Sony\Reader\Data\bin\launcher\eBook Library Launcher.exe" [2009-10-20 902504]
"AmazonGSDownloaderTray"="c:\program files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe" [2009-10-23 326144]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-12-12 642856]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-14 206064]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-10-28 1352272]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-17 98304]
"@OnlineArmor GUI"="c:\program files\Online Armor\OAui.exe" [2011-04-06 2477032]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"StartUp This"="c:\program files\Laplink\PCmover\LaunchSt.exe" [2007-11-01 247088]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{4F07DA45-8170-4859-9B5F-037EF2970034}"= "c:\progra~1\ONLINE~2\oaevent.dll" [2011-04-06 354720]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21548352----a-w-c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-07-21 13:4510536----a-w-c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-10-28 10:1364592----a-w-c:\program files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Dell\\MediaDirect\\PCMService.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Laplink\\PCmover\\PCmover.exe"=
"c:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe"=
"c:\\Program Files\\Microsoft Office\\Live Meeting 8\\Console\\PWConsole.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\Bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\hpwucli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Smart Web Printing\\SmartWebPrintExe.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2009\\QBDBMgrN.exe"=
"c:\\Program Files\\real\\realplayer\\realplay.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10421:UDP"= 10421:UDP:SingleClick Discovery Protocol
"10426:UDP"= 10426:UDP:SingleClick ICC
"67:UDP"= 67:UDP:DHCP Discovery Service
.
R1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [5/18/2011 1:26 PM 205864]
R1 oahlpXX;Online Armor helper driver;c:\windows\system32\drivers\oahlp32.sys [5/18/2011 1:26 PM 39048]
R1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [5/18/2011 1:26 PM 25192]
R1 OAnet;OAnet;c:\windows\system32\drivers\OAnet.sys [5/18/2011 1:26 PM 29464]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 1:25 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 1:41 PM 67656]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [10/29/2009 1:27 PM 1074568]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [12/29/2010 10:30 AM 10448]
R2 SvcOnlineArmor;Online Armor;c:\program files\Online Armor\oasrv.exe [5/18/2011 1:26 PM 4326472]
S1 MpKslf74c7e6c;MpKslf74c7e6c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{1C9BD671-6650-4FAA-B6C1-5CF771BBD1E3}\MpKslf74c7e6c.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{1C9BD671-6650-4FAA-B6C1-5CF771BBD1E3}\MpKslf74c7e6c.sys [?]
S2 gupdate1ca25d2787f1ffc;Google Update Service (gupdate1ca25d2787f1ffc);c:\program files\Google\Update\GoogleUpdate.exe [8/25/2009 5:21 PM 133104]
S2 OAcat;Online Armor Helper Service;c:\program files\Online Armor\oacat.exe [5/18/2011 1:26 PM 381512]
S3 Amazon Download Agent;Amazon Download Agent;c:\program files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [2/12/2009 4:20 PM 401920]
S3 cpuz134;cpuz134;\??\c:\docume~1\REBECC~1\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys --> c:\docume~1\REBECC~1\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys [?]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [3/2/2010 3:46 PM 30192]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [8/25/2009 5:21 PM 133104]
S3 LLUSBFLT;LLUSBFLT;c:\windows\system32\drivers\llusbflt.sys [8/3/2005 3:59 PM 4736]
S3 PLUsbbc2;High-Speed USB Bridge Cable Driver;c:\windows\system32\drivers\usbbc2.sys [8/3/2005 3:59 PM 8960]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmtREG_MULTI_SZ hpqcxs08
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-26 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-06-26 22:20]
.
2011-05-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-25 22:21]
.
2011-05-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-25 22:21]
.
2011-05-26 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2010-11-11 17:26]
.
2011-05-26 c:\windows\Tasks\MpIdleTask.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2010-11-11 17:26]
.
2011-05-26 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-109568239-1760306711-3351161423-1009.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]
.
2011-05-13 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-109568239-1760306711-3351161423-1009.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=0080626
Trusted Zone: intuit.com\ttlc
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} -
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
HKLM-Run-hpqSRMon - (no file)
HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
AddRemove-MS Word to Excel Import, Export & Convert Software_is1 - c:\program files\MS Word to Excel Import
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-26 11:01
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(592)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\windows\System32\BCMLogon.dll
c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_e87e0bcd\MFC80.DLL
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_179798c8\MSVCR80.dll
.
- - - - - - - > 'explorer.exe'(1936)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-05-26 11:09:22
ComboFix-quarantined-files.txt 2011-05-26 16:09
.
Pre-Run: 107,397,668,864 bytes free
Post-Run: 107,265,122,304 bytes free
.
- - End Of File - - 61AA2560A97042CCF7147EE508A838D8
Re-running ComboFix to remove infections:

• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
• Open notepad and copy/paste the text in the quotebox below into it:
  Quote

  KillAll::
  
  DDS::
  Trusted Zone: intuit.com\ttlc
  
  SecCenter::
  17DDD097-36FF-435F-9E1B-52D74245D6BF
  
  

• Save this as CFScript.txt, in the same location as ComboFix.exe
  
  
  
  
• Referring to the picture above, drag CFScript into ComboFix.exe
• When finished, it shall produce a log for you at C:\ComboFix.txt
  
• Please post the contents of the log in your next reply.

• Double click Sysprot.exe to start the program.
• Click on the Log tab.
• In the Write to log box select the following items.
• Process << Selected
  
• Kernel MODULES << Selected
  
• SSDT << Selected
  
• Kernel Hooks << Selected
  
• IRP Hooks << NOT Selected
  
• Ports << NOT Selected
  
• Hidden Files << Selected
  
• At the bottom of the page
• Hidden Objects Only << Selected
  
• Click on the Create Log button on the bottom right.
• After a few seconds a new window should appear.
• Select Scan Root Drive. Click on the Start button.
• When it is complete a new window will appear to indicate that the scan is finished.
• The log will be saved automatically in the same folder Sysprot.exe was extracted to. Open the text file and copy/paste the log here.

Now my computer won't load past the desktop background.

BUMPHi susan. Something must have HAPPENED to DMJ. I'll try to get a message to him. Don't despair.Sorry, my ISP situation has been crazy.

ESET Online Scan

Please run a free online scan with the ESET Online Scanner

• Tick the box next to YES, I accept the TERMS of Use
  
• Click Start
  
• When asked, allow the ActiveX control to install
• Click Start
  
• Make sure that the options Remove found threats and the OPTION Scan unwanted applications is checked
  
• Click Scan (This scan can take several hours, so please be patient)
  
• Once the scan is completed, you may close the window
• Use NOTEPAD to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  
• Copy and PASTE that log as a reply to this topic

I managed to find the original LOG. This is much easier now, as I can access the web on this laptop now and windows has stopped crashing.

Quote

2011/01/12 20:52:46.0158TDSS rootkit removing tool 2.4.13.0 Jan 12 2011 09:51:11
2011/01/12 20:52:46.0158================================================================================
2011/01/12 20:52:46.0158SystemInfo:
2011/01/12 20:52:46.0158
2011/01/12 20:52:46.0168OS Version: 5.1.2600 ServicePack: 3.0
2011/01/12 20:52:46.0168Product type: Workstation
2011/01/12 20:52:46.0168ComputerName: GARRY-8F7D7E432
2011/01/12 20:52:46.0168UserName: Owner
2011/01/12 20:52:46.0168Windows directory: C:\WINDOWS
2011/01/12 20:52:46.0168System windows directory: C:\WINDOWS
2011/01/12 20:52:46.0168Processor architecture: Intel x86
2011/01/12 20:52:46.0168Number of processors: 1
2011/01/12 20:52:46.0168Page size: 0x1000
2011/01/12 20:52:46.0168Boot type: Normal boot
2011/01/12 20:52:46.0168================================================================================
2011/01/12 20:52:48.0531Initialize success
2011/01/12 20:52:53.0028================================================================================
2011/01/12 20:52:53.0028Scan started
2011/01/12 20:52:53.0028Mode: Manual;
2011/01/12 20:52:53.0028================================================================================
2011/01/12 20:52:53.0549ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/01/12 20:52:53.0649ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/01/12 20:52:53.0799aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/01/12 20:52:53.0889AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
2011/01/12 20:52:54.0380AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/01/12 20:52:54.0450atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/01/12 20:52:54.0560Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/01/12 20:52:54.0690audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/01/12 20:52:54.0830BCM43XX (30d20fc98bcfd52e1da778cf19b223d4) C:\WINDOWS\system32\DRIVERS\bcmwl5.sys
2011/01/12 20:52:54.0891bcm4sbxp (78123f44be9e4768852a3a017e02d637) C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys
2011/01/12 20:52:55.0151BCMModem (41347688046d49cde0f6d138a534f73d) C:\WINDOWS\system32\DRIVERS\BCMSM.sys
2011/01/12 20:52:55.0261Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/01/12 20:52:55.0371cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/01/12 20:52:55.0501Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/01/12 20:52:55.0622Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/01/12 20:52:55.0692Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/01/12 20:52:55.0792cercsr6 (84853b3fd012251690570e9e7e43343f) C:\WINDOWS\system32\drivers\cercsr6.sys
2011/01/12 20:52:56.0002CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
2011/01/12 20:52:56.0142Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
2011/01/12 20:52:56.0403Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/01/12 20:52:56.0543dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2011/01/12 20:52:56.0743dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2011/01/12 20:52:56.0813dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/01/12 20:52:56.0933DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/01/12 20:52:57.0074drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/01/12 20:52:57.0244Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/01/12 20:52:57.0344Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
2011/01/12 20:52:57.0474Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2011/01/12 20:52:57.0574Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/01/12 20:52:57.0655FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/01/12 20:52:57.0735Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/01/12 20:52:57.0805Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/01/12 20:52:57.0955Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/01/12 20:52:58.0095HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/01/12 20:52:58.0305HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/01/12 20:52:58.0526hwdatacard (53f1160666435151b6fcf89d015fe620) C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys
2011/01/12 20:52:58.0736i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/01/12 20:52:58.0916ialm (9a883c3c4d91292c0d09de7c728e781c) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
2011/01/12 20:52:59.0127Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/01/12 20:52:59.0287IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
2011/01/12 20:52:59.0357intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/01/12 20:52:59.0407Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/01/12 20:52:59.0517IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/01/12 20:52:59.0617IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/01/12 20:52:59.0748IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/01/12 20:52:59.0868IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/01/12 20:52:59.0958IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/01/12 20:53:00.0028isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/01/12 20:53:00.0128Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/01/12 20:53:00.0278kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/01/12 20:53:00.0889KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/01/12 20:53:01.0230mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/01/12 20:53:01.0740Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2011/01/12 20:53:02.0291Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/01/12 20:53:02.0762MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/01/12 20:53:03.0703MpFilter (c98301ad8173a2235a9ab828955c32bb) C:\WINDOWS\system32\DRIVERS\MpFilter.sys
2011/01/12 20:53:04.0865MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/01/12 20:53:05.0255MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/01/12 20:53:05.0666Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/01/12 20:53:05.0846MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/01/12 20:53:06.0007MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/01/12 20:53:06.0117MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/01/12 20:53:06.0217mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/01/12 20:53:06.0257Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2011/01/12 20:53:06.0377NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/01/12 20:53:06.0467NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/01/12 20:53:06.0577Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/01/12 20:53:06.0627NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/01/12 20:53:06.0718NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/01/12 20:53:06.0798NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/01/12 20:53:06.0868NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/01/12 20:53:07.0128Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/01/12 20:53:07.0278Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/01/12 20:53:07.0429Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/01/12 20:53:07.0499NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/01/12 20:53:07.0569NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/01/12 20:53:07.0659OMCI (cec7e2c6c1fa00c7ab2f5434f848ae51) C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS
2011/01/12 20:53:07.0759Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys
2011/01/12 20:53:07.0839PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/01/12 20:53:07.0929ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/01/12 20:53:08.0160PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/01/12 20:53:08.0680PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\drivers\PCIIde.sys
2011/01/12 20:53:08.0760Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
2011/01/12 20:53:09.0151PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/01/12 20:53:09.0281PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/01/12 20:53:09.0341Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/01/12 20:53:09.0472PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2011/01/12 20:53:09.0742RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/01/12 20:53:09.0862Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/01/12 20:53:09.0922RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/01/12 20:53:10.0002Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/01/12 20:53:10.0072Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/01/12 20:53:10.0183RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/01/12 20:53:10.0293RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/01/12 20:53:10.0393redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/01/12 20:53:10.0643SbieDrv (97f0e3f18ab10314318a2b9a3949b331) C:\Program Files\Sandboxie\SbieDrv.sys
2011/01/12 20:53:10.0904Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/01/12 20:53:11.0054Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys
2011/01/12 20:53:11.0264Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/01/12 20:53:11.0434splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/01/12 20:53:11.0575sptd (cdddec541bc3c96f91ecb48759673505) C:\WINDOWS\system32\Drivers\sptd.sys
2011/01/12 20:53:11.0575Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505
2011/01/12 20:53:11.0605sptd - detected Locked file (1)
2011/01/12 20:53:11.0675sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/01/12 20:53:11.0775Srv (0f6aefad3641a657e18081f52d0c15af) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/01/12 20:53:11.0925STAC97 (5813d453ef8ce49d607c255cf128aceb) C:\WINDOWS\system32\drivers\stac97.sys
2011/01/12 20:53:12.0095swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/01/12 20:53:12.0165swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/01/12 20:53:12.0406sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/01/12 20:53:12.0616SysProtDrv.sys (7d5b6655442dbcf5e3b86a134ab90584) C:\Documents and Settings\Owner\Desktop\SysProt\SysProt\SysProtDrv.sys
2011/01/12 20:53:12.0796Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/01/12 20:53:13.0057TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/01/12 20:53:13.0157TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/01/12 20:53:13.0267TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/01/12 20:53:13.0447TSWLAN (61b5cae97b96dee31d8b24fb800364b3) C:\WINDOWS\system32\drivers\TsWlan.sys
2011/01/12 20:53:13.0507Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/01/12 20:53:13.0668Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/01/12 20:53:13.0818usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/01/12 20:53:13.0888usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/01/12 20:53:13.0968usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/01/12 20:53:14.0078usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/01/12 20:53:14.0198usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/01/12 20:53:14.0288USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/01/12 20:53:14.0349usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/01/12 20:53:14.0529VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/01/12 20:53:14.0659VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/01/12 20:53:14.0909Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/01/12 20:53:15.0019wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/01/12 20:53:15.0280WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
2011/01/12 20:53:15.0420WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/01/12 20:53:15.0500WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/01/12 20:53:15.0640\HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0)
2011/01/12 20:53:15.0690================================================================================
2011/01/12 20:53:15.0690Scan finished
2011/01/12 20:53:15.0690================================================================================
2011/01/12 20:53:15.0731Detected object count: 2
2011/01/12 20:53:38.0213Locked file(sptd) - User select action: Skip
2011/01/12 20:53:38.0223\HardDisk0 - will be cured after reboot
2011/01/12 20:53:38.0223Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure
2011/01/12 20:53:54.0977Deinitialize success

• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

C:\WINDOWS\Temp\tpqf.tmp\setup.exeWin32/TrojanDownloader.Agent.QME trojancleaned by deleting - quarantined

So Windows Security Essentials has been detecting trojan viruses lately, which I have been removing/quarantining as appropriate and then following up with a MBAM scan and removing whatever is shown there. Last night, however, a virus Trojan:DOS/Alureon.A was detected and can't be deleted. I also noticed that a number of programs have been installed without my permission, namely SweetIM for Messenger 3.4, SweetIM Toobal for Internet Explorer 4.1, Whitesmoke (which seems to be a big problem), and Street-Ads Browser Enhancer, none of which I am able to uninstall. I also seem to have a Google redirect virus, but only when I am using Astrill (VPN) which I use as I am in China currently.

I have already run CCleaner, SUPERAntivirus and MBAM, but the link for HJT brings up nothing but random characters for me.

If necessary, I guess I would be willing to have a new hard drive installed (if this would remedy the problem) or reformat the current one, but I have no recovery disks. However, if it is possible to get rid of the problem without doing this, I would prefer to do it that way. However, to my (untrained) eye, it looks pretty severe, hence me looking here for help. Thanks in advance.



Here is the SUPERAntivirus LOG

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 06/05/2011 at 01:13 PM

Application Version : 4.53.1000

Core Rules Database Version : 7202
Trace Rules Database Version: 5014

Scan type : Complete Scan
Total Scan Time : 00:57:29

Memory items scanned : 378
Memory threats detected : 1
Registry items scanned : 7734
Registry threats detected : 56
File items scanned : 81773
File threats detected : 1133

Trojan.Downloader-SVCHost/Fake
C:\WINDOWS\WINUPDATERSTD\SVCHOST.EXE
C:\WINDOWS\WINUPDATERSTD\SVCHOST.EXE
[Speaker] C:\WINDOWS\WINUPDATERSTD\SVCHOST.EXE

Worm.SYSHost
[SysRestore] C:\WINDOWS\..\SBRB\SYSHOST.EXE
C:\WINDOWS\..\SBRB\SYSHOST.EXE

Rogue.Agent/Gen
HKLM\Software\Classes\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}
HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}
HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}
HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}#AppID
HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}\InprocServer32
HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}\InprocServer32#ThreadingModel
HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}\ProgID
HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}\Programmable
HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}\TypeLib
HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}\VersionIndependentProgID
HKCR\chkavwqhhst.chkavwqhhst.1.0
HKCR\chkavwqhhst.chkavwqhhst.1.0\CLSID
HKCR\chkavwqhhst.chkavwqhhst
HKCR\chkavwqhhst.chkavwqhhst\CLSID
HKCR\chkavwqhhst.chkavwqhhst\CurVer
HKCR\TypeLib\{18B5BB0D-DC38-4611-B16C-2A6A82FECAE5}
C:\WINDOWS\$XNTUNINSTALL643$\WKTLY.DLL
HKLM\Software\Classes\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}
HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}
HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}
HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}#AppID
HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}\InprocServer32
HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}\InprocServer32#ThreadingModel
HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}\ProgID
HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}\Programmable
HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}\TypeLib
HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}\VersionIndependentProgID
HKCR\adfavwqhpr.adfavwqhpr.1.0
HKCR\adfavwqhpr.adfavwqhpr.1.0\CLSID
HKCR\adfavwqhpr.adfavwqhpr
HKCR\adfavwqhpr.adfavwqhpr\CLSID
HKCR\adfavwqhpr.adfavwqhpr\CurVer
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}
HKU\S-1-5-21-3945443218-3704102702-969017525-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}

Trojan.Agent/Gen-Nullo[Short]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CD4CBA5A-14F6-88A6-0037-59505B26C86C}
HKCR\CLSID\{CD4CBA5A-14F6-88A6-0037-59505B26C86C}
HKCR\CLSID\{CD4CBA5A-14F6-88A6-0037-59505B26C86C}
HKCR\CLSID\{CD4CBA5A-14F6-88A6-0037-59505B26C86C}\InprocServer32
HKCR\CLSID\{CD4CBA5A-14F6-88A6-0037-59505B26C86C}\InprocServer32#ThreadingModel
HKCR\CLSID\{CD4CBA5A-14F6-88A6-0037-59505B26C86C}\ProgID
HKCR\Mqublrsv
HKCR\Mqublrsv\CLSID
C:\WINDOWS\SYSTEM32\LWWHZYYW.DLL
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CD4CBA5A-14F6-88A6-0037-59505B26C86C}
HKU\S-1-5-21-3945443218-3704102702-969017525-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CD4CBA5A-14F6-88A6-0037-59505B26C86C}
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CD4CBA5A-14F6-88A6-0037-59505B26C86C}
HKLM\System\ControlSet001\Services\otwxoqqw
HKLM\System\ControlSet001\Enum\Root\LEGACY_otwxoqqw
HKLM\System\ControlSet002\Services\otwxoqqw
HKLM\System\ControlSet002\Enum\Root\LEGACY_otwxoqqw
HKLM\System\CurrentControlSet\Services\otwxoqqw
HKLM\System\CurrentControlSet\Enum\Root\LEGACY_otwxoqqw

Malware.Trace
HKU\.DEFAULT\Software\5GUTNY6MFK
HKU\S-1-5-18\Software\5GUTNY6MFK

PUP.Whitesmoke
C:\Program Files\WHITESMOKE\buy.ico
C:\Program Files\WHITESMOKE\ComVistaElevator.dll
C:\Program Files\WHITESMOKE\FloatButtonWhiteApps.txt
C:\Program Files\WHITESMOKE\FuncServer_WDC_x64.exe
C:\Program Files\WHITESMOKE\HookDllOE.dll
C:\Program Files\WHITESMOKE\HookDllOE64.dll
C:\Program Files\WHITESMOKE\html\english\common\iepngfix\blank.gif
C:\Program Files\WHITESMOKE\html\english\common\iepngfix\checkerboard.gif
C:\Program Files\WHITESMOKE\html\english\common\iepngfix\helix.gif
C:\Program Files\WHITESMOKE\html\english\common\iepngfix\iepngfix.htc
C:\Program Files\WHITESMOKE\html\english\common\iepngfix\iepngfix.html
C:\Program Files\WHITESMOKE\html\english\common\iepngfix\opacity.png
C:\Program Files\WHITESMOKE\html\english\common\iepngfix
C:\Program Files\WHITESMOKE\html\english\common\js\common.js
C:\Program Files\WHITESMOKE\html\english\common\js\pngfix.js
C:\Program Files\WHITESMOKE\html\english\common\js\prototype.js
C:\Program Files\WHITESMOKE\html\english\common\js\xmlhttp.js
C:\Program Files\WHITESMOKE\html\english\common\js
C:\Program Files\WHITESMOKE\html\english\common
C:\Program Files\WHITESMOKE\html\english\dictClientDic\dictionary.html
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\ajax-loader.gif
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\corner_bottom_left.png
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\corner_bottom_right.png
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\corner_top_left.png
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\corner_top_right.png
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\down_arrow.png
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\input_bg.png
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\input_bg_old.png
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\leftSide.png
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\leftSide2.png
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\left_input.gif
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\loading_dictionary.gif
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\rightSide.png
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\right_input.gif
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\search_strip_bg3.gif
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Buttons\down_arrow.png
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Buttons\go_over.gif
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Buttons\go_press.gif
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Buttons\go_up.gif
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Buttons\humanTranslation_press.gif
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Buttons\humanTranslation_roll.gif
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Buttons\humanTranslation_up.gif
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Buttons\moreLang_press.gif
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Buttons\moreLang_roll.gif
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Buttons\moreLang_up.gif
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Buttons
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\spacer.gif
C:\Program Files\WHITESMOKE\html\english\dictClientDic\img
C:\Program Files\WHITESMOKE\html\english\dictClientDic\index.html
C:\Program Files\WHITESMOKE\html\english\dictClientDic\js\common.js
C:\Program Files\WHITESMOKE\html\english\dictClientDic\js\Contextmenu.js
C:\Program Files\WHITESMOKE\html\english\dictClientDic\js\dictInterface.js
C:\Program Files\WHITESMOKE\html\english\dictClientDic\js\jquery-1.4.2.min.js
C:\Program Files\WHITESMOKE\html\english\dictClientDic\js\jquery.combobox.js
C:\Program Files\WHITESMOKE\html\english\dictClientDic\js\jquery.js
C:\Program Files\WHITESMOKE\html\english\dictClientDic\js\prototype.js
C:\Program Files\WHITESMOKE\html\english\dictClientDic\js\transInterface.js
C:\Program Files\WHITESMOKE\html\english\dictClientDic\js\xmlhttp.js
C:\Program Files\WHITESMOKE\html\english\dictClientDic\js
C:\Program Files\WHITESMOKE\html\english\dictClientDic\style\combobox.css
C:\Program Files\WHITESMOKE\html\english\dictClientDic\style\Contextmenu.css
C:\Program Files\WHITESMOKE\html\english\dictClientDic\style\dictionary.css
C:\Program Files\WHITESMOKE\html\english\dictClientDic\style
C:\Program Files\WHITESMOKE\html\english\dictClientDic\translator.html
C:\Program Files\WHITESMOKE\html\english\dictClientDic
C:\Program Files\WHITESMOKE\html\english\floatingButton\blue-Q-rollover.gif
C:\Program Files\WHITESMOKE\html\english\floatingButton\blue-rollover.gif
C:\Program Files\WHITESMOKE\html\english\floatingButton\blue-X-rollover.gif
C:\Program Files\WHITESMOKE\html\english\floatingButton\blue.gif
C:\Program Files\WHITESMOKE\html\english\floatingButton\index.html
C:\Program Files\WHITESMOKE\html\english\floatingButton\red&blue.gif
C:\Program Files\WHITESMOKE\html\english\floatingButton\Thumbs.db
C:\Program Files\WHITESMOKE\html\english\floatingButton
C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\img\Background\howto_bg.gif
C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\img\Background
C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\img\spacer.gif
C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\img\Thumbs.db
C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\img
C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\index.html
C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\js\iepngfix\blank.gif
C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\js\iepngfix\checkerboard.gif
C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\js\iepngfix\helix.gif
C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\js\iepngfix\iepngfix.htc
C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\js\iepngfix\iepngfix.html
C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\js\iepngfix\opacity.png
C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\js\iepngfix
C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\js\index.js
C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\js
C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\style\style.css
C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\style
C:\Program Files\WHITESMOKE\html\english\floatingButton_howto
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\ajax-loader.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\base_fade_px.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\blue.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\blue_bg_.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\blue_dark_bg.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\blue_dark_bg_.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\blue_top_bg_.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\bottom_grey_strip.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\buttons_tray_px.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\buttons_tray_px.p_goldng
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\caption_bar_re_down.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\caption_bar_re_over.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\caption_bar_re_up.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\caption_bottom_px.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\caption_px.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\caption_strip_right_corner.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\cascade.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\collapse.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\context_bl2.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\context_br2.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\context_dot.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\context_menu_bg.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\context_submenu.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\context_submenu_dis.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\context_sub_menu_bg.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\context_tl2.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\context_tr2.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\Copy of notice_right_top_bg.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\down_arrow.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\dpreloader.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\edit_footer_left.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\edit_footer_px.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\edit_footer_right.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\edit_header_left.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\edit_header_px.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\edit_header_right.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\edit_sidefade.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\feather.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\green.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\inputline_fade_px.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\input_bg.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\leftBottom3.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\leftSide.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\leftSide2.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\leftSide3.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\left_input.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\logo.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\logo.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\logo2.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\main_background.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\main_background_11.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\main_background_old.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\notice_checkbox_checked.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\notice_checkbox_unchecked.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\red.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\red2.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\resize_gripper.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\result_area_top_bg.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\rightBottom.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\rightSide.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\rightSide2.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\rightSide2_11.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\right_input.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\spacer.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\spacer_.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\strike_blue.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\strike_green.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\strike_green2.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\strike_purple.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\strike_red.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\summaryline_apply_down.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\summaryline_apply_roll.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\summaryline_apply_up.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\summaryline_check_down.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\summaryline_check_roll.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\summaryline_check_up.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\summaryline_left_corner.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\summaryline_px.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\summaryline_right_corner.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\ticket.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\topButtonsLeft.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\topButtonsLeft_from_home.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\topButtonsLeft__.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\topButtonsRight.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\topRightBorder.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\top_grey_strip.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background\wslogo.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Background
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\blue.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\bottom_right_corner.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\buttons_tray_px.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\caption_bar_re_down.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\caption_bar_re_over.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\caption_bar_re_up.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\caption_bottom_px.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\caption_px.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\caption_strip_right_corner.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\get-full.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\get-full3.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\green.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\help_down.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\help_roll.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\help_up.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\left_input.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\logo.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\logo.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\logo2.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\main_background.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_dictionary_down.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_dictionary_on.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_dictionary_roll.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_dictionary_up.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_templates_down.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_templates_on.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_templates_roll.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_templates_up.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_toolkit_down.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_toolkit_on.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_toolkit_roll.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_toolkit_up.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_translator_down.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_translator_on.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_translator_roll.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_translator_up.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_tutorials_down.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_tutorials_on.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_tutorials_roll.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_tutorials_up.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_writer_down.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_writer_on.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_writer_roll.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_writer_up.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\red.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\red2.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\right_input.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\sitting_down.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\sitting_roll.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\sitting_up.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\smallclosebutton.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\store_down.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\store_roll.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\store_up.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\summaryline_apply_down.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\summaryline_apply_roll.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\summaryline_apply_up.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\summaryline_check_down.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\summaryline_check_roll.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\summaryline_check_up.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\summaryline_px.png
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\x.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\x.jpg
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\x_hover.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\x_hover_old.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\x_old.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\blue.png
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\bottom_right_corner.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\buttons_tray_px.png
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\caption_bar_close_down.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\caption_bar_close_over.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\caption_bar_close_up.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\caption_bar_max_down.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\caption_bar_max_over.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\caption_bar_max_up.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\caption_bar_re_down.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\caption_bar_re_over.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\caption_bar_re_up.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\caption_bottom_px.png
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\caption_px.png
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\caption_px_11.png
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\green.png
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\leftCaptionCorner.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\leftCaptionCorner2.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\left_input.png
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\logo.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\logo3.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\logologo2_11.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\logo_1.png
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\main_background.png
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_dictionary_down.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_dictionary_on.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_dictionary_roll.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_dictionary_up.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_templates_down.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_templates_on.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_templates_roll.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_templates_up.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_toolkit_down.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_toolkit_on.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_toolkit_roll.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_toolkit_up.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_translator_down.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_translator_on.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_translator_roll.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_translator_up.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_tutorials_down.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_tutorials_on.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_tutorials_roll.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_tutorials_up.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_writer_down.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_writer_on.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_writer_roll.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_writer_up.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\red.png
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\red2.png
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\rightCaptionCorner.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\rightCaptionCorner.png
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\rightCaptionCorner2.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\rightCaptionCorner3.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\rightCaptionCorner3_11.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\right_input.png
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\store_down.png
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\store_roll.png
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\store_up.png
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\summaryline_apply_down.png
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\summaryline_apply_roll.png
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\summaryline_apply_up.png
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\summaryline_check_down.png
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\summaryline_check_roll.png
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\summaryline_check_up.png
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\summaryline_px.png
C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar
C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\addto_disabled.png
C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\addto_hover.png
C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\addto_up.png
C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\definition_disabled.png
C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\definition_hover.png
C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\definition_up.png
C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\enrichment_disabled.png
C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\enrichment_hover.png
C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\enrichment_up.png
C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\explanation_disabled.png
C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\explanation_hover.png
C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\explanation_up.png
C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\grammarexpclosebutton.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\howto_disabled.png
C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\howto_hover.png
C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\howto_up.png
C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\search_disabled.png
C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\search_hover.png
C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\search_up.png
C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\thesaurus_disabled.png
C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\thesaurus_hover.png
C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\thesaurus_up.png
C:\Program Files\WHITESMOKE\html\english\gui\img\grammar
C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\closedy2.png
C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\content-review4.png
C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\dot.png
C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\down-content.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\down.png
C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\grade1.png
C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\grade2.png
C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\grade3.png
C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\grade4.png
C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\grade5.png
C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\li-content.png
C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\opencq8.png
C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\report.png
C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\score1.png
C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\score2.png
C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\score3.png
C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\score4.png
C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\score5.png
C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\shadow.png
C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\shadow2.png
C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\shdow.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\shdow_good.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\review-section
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\button_no_down.png
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\button_no_up.png
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\button_yes_down.png
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\button_yes_up.png
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\caption_bar_close_over.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\ico_analyze.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\ico_complete.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\ico_connection.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\ico_expired.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\loading_window.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\loading_window.swf
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\myWelcome.png
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_bg.png
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_bg_bottom.png
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_bg_gold.png
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_bg_old.png
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_bg_top.png
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_captionbar_press.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_captionbar_up.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_getitnow_press.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_getitnow_up.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_ok_press.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_ok_press.png
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_ok_up.gif
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_ok_up.png
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_ok_up_11.png
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\welcomeClose_down.png
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\welcomeClose_over.png
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\welcomeClose_up.png
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\welcomeGo_down.png
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\welcomeGo_over.png
C:\Program Files\WHITESMOKE\html\english\gui\img\screens\welcomeGo_up.png
C:\Program Files\WHITESMOKE\html\english\gui\img\screens
C:\Program Files\WHITESMOKE\html\english\gui\img\spacer.gif
C:\Program Files\WHITESMOKE\html\english\gui\img
C:\Program Files\WHITESMOKE\html\english\gui\index.html
C:\Program Files\WHITESMOKE\html\english\gui\js\appInterface.js
C:\Program Files\WHITESMOKE\html\english\gui\js\builder.pack.js
C:\Program Files\WHITESMOKE\html\english\gui\js\common.js
C:\Program Files\WHITESMOKE\html\english\gui\js\Contextmenu.js
C:\Program Files\WHITESMOKE\html\english\gui\js\controls.pack.js
C:\Program Files\WHITESMOKE\html\english\gui\js\dictionaryContextMenu.class.js
C:\Program Files\WHITESMOKE\html\english\gui\js\dragdrop.pack.js
C:\Program Files\WHITESMOKE\html\english\gui\js\effects.pack.js
C:\Program Files\WHITESMOKE\html\english\gui\js\enrichmentContextMenu.class.js
C:\Program Files\WHITESMOKE\html\english\gui\js\enrichmentsContextMenu.class.js
C:\Program Files\WHITESMOKE\html\english\gui\js\final.js
C:\Program Files\WHITESMOKE\html\english\gui\js\gmonitor.js
C:\Program Files\WHITESMOKE\html\english\gui\js\grammarCache.class.js
C:\Program Files\WHITESMOKE\html\english\gui\js\grammarContextMenu.class.js
C:\Program Files\WHITESMOKE\html\english\gui\js\iepngfix\blank.gif
C:\Program Files\WHITESMOKE\html\english\gui\js\iepngfix\checkerboard.gif
C:\Program Files\WHITESMOKE\html\english\gui\js\iepngfix\helix.gif
C:\Program Files\WHITESMOKE\html\english\gui\js\iepngfix\iepngfix.htc
C:\Program Files\WHITESMOKE\html\english\gui\js\iepngfix\iepngfix.html
C:\Program Files\WHITESMOKE\html\english\gui\js\iepngfix\opacity.png
C:\Program Files\WHITESMOKE\html\english\gui\js\iepngfix
C:\Program Files\WHITESMOKE\html\english\gui\js\iframeTest.js
C:\Program Files\WHITESMOKE\html\english\gui\js\jqModal.js
C:\Program Files\WHITESMOKE\html\english\gui\js\jquery-1.2.6.pack.NotUSED.js
C:\Program Files\WHITESMOKE\html\english\gui\js\jquery-1.3.2.js
C:\Program Files\WHITESMOKE\html\english\gui\js\jquery-1.3.2.min.js
C:\Program Files\WHITESMOKE\html\english\gui\js\jquery.ba-throttle-debounce.js
C:\Program Files\WHITESMOKE\html\english\gui\js\jquery.jeegoocontext.min.js
C:\Program Files\WHITESMOKE\html\english\gui\js\monitor.js
C:\Program Files\WHITESMOKE\html\english\gui\js\NonPackedVersion\builder.js
C:\Program Files\WHITESMOKE\html\english\gui\js\NonPackedVersion\controls.js
C:\Program Files\WHITESMOKE\html\english\gui\js\NonPackedVersion\dragdrop.js
C:\Program Files\WHITESMOKE\html\english\gui\js\NonPackedVersion\effects.js
C:\Program Files\WHITESMOKE\html\english\gui\js\NonPackedVersion\prototype.js
C:\Program Files\WHITESMOKE\html\english\gui\js\NonPackedVersion\slider.js
C:\Program Files\WHITESMOKE\html\english\gui\js\NonPackedVersion\sound.js
C:\Program Files\WHITESMOKE\html\english\gui\js\NonPackedVersion
C:\Program Files\WHITESMOKE\html\english\gui\js\prototype.pack.js
C:\Program Files\WHITESMOKE\html\english\gui\js\scriptaculous.js
C:\Program Files\WHITESMOKE\html\english\gui\js\slider.pack.js
C:\Program Files\WHITESMOKE\html\english\gui\js\sound.pack.js
C:\Program Files\WHITESMOKE\html\english\gui\js\spellingContextMenu.class.js
C:\Program Files\WHITESMOKE\html\english\gui\js\summary.js
C:\Program Files\WHITESMOKE\html\english\gui\js\supersleight.js
C:\Program Files\WHITESMOKE\html\english\gui\js\switchcontent.js
C:\Program Files\WHITESMOKE\html\english\gui\js\tooltip.js
C:\Program Files\WHITESMOKE\html\english\gui\js\unittest.js
C:\Program Files\WHITESMOKE\html\english\gui\js\ws_content_manager.js
C:\Program Files\WHITESMOKE\html\english\gui\js\ws_functions.js
C:\Program Files\WHITESMOKE\html\english\gui\js\ws_links.js
C:\Program Files\WHITESMOKE\html\english\gui\js\x.gif
C:\Program Files\WHITESMOKE\html\english\gui\js\xmlhttp.js
C:\Program Files\WHITESMOKE\html\english\gui\js\ypSlideOutMenus.js
C:\Program Files\WHITESMOKE\html\english\gui\js\ypSlideOutMenusContext.js
C:\Program Files\WHITESMOKE\html\english\gui\js
C:\Program Files\WHITESMOKE\html\english\gui\style\combobox.css
C:\Program Files\WHITESMOKE\html\english\gui\style\Contextmenu.css
C:\Program Files\WHITESMOKE\html\english\gui\style\dictionary.css
C:\Program Files\WHITESMOKE\html\english\gui\style\enrichment.css
C:\Program Files\WHITESMOKE\html\english\gui\style\enrichments.css
C:\Program Files\WHITESMOKE\html\english\gui\style\grammar.css
C:\Program Files\WHITESMOKE\html\english\gui\style\iframeTest.css
C:\Program Files\WHITESMOKE\html\english\gui\style\indexnew.css
C:\Program Files\WHITESMOKE\html\english\gui\style\jeegoo.css
C:\Program Files\WHITESMOKE\html\english\gui\style\jqModal.css
C:\Program Files\WHITESMOKE\html\english\gui\style\screens.css
C:\Program Files\WHITESMOKE\html\english\gui\style\spelling.css
C:\Program Files\WHITESMOKE\html\english\gui\style
C:\Program Files\WHITESMOKE\html\english\gui
C:\Program Files\WHITESMOKE\html\english\registration\img\banner.gif
C:\Program Files\WHITESMOKE\html\english\registration\img\banner.png
C:\Program Files\WHITESMOKE\html\english\registration\img\captionbar\caption_bar_close_down.gif
C:\Program Files\WHITESMOKE\html\english\registration\img\captionbar\caption_bar_close_up.gif
C:\Program Files\WHITESMOKE\html\english\registration\img\captionbar\caption_bar_close_up_over.gif
C:\Program Files\WHITESMOKE\html\english\registration\img\captionbar
C:\Program Files\WHITESMOKE\html\english\registration\img\continue_button_click.gif
C:\Program Files\WHITESMOKE\html\english\registration\img\continue_button_over.gif
C:\Program Files\WHITESMOKE\html\english\registration\img\continue_button_up.gif
C:\Program Files\WHITESMOKE\html\english\registration\img\down.gif
C:\Program Files\WHITESMOKE\html\english\registration\img\down.png
C:\Program Files\WHITESMOKE\html\english\registration\img\f2.gif
C:\Program Files\WHITESMOKE\html\english\registration\img
C:\Program Files\WHITESMOKE\html\english\registration\index.html
C:\Program Files\WHITESMOKE\html\english\registration\js\regInterface.js
C:\Program Files\WHITESMOKE\html\english\registration\js
C:\Program Files\WHITESMOKE\html\english\registration\style\registration.css
C:\Program Files\WHITESMOKE\html\english\registration\style
C:\Program Files\WHITESMOKE\html\english\registration
C:\Program Files\WHITESMOKE\html\english\settings\css\index.css
C:\Program Files\WHITESMOKE\html\english\settings\css
C:\Program Files\WHITESMOKE\html\english\settings\img\Background\logo.png
C:\Program Files\WHITESMOKE\html\english\settings\img\Background\main_bg.png
C:\Program Files\WHITESMOKE\html\english\settings\img\Background
C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\cancel_disabled.png
C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\cancel_down.png
C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\cancel_over.png
C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\cancel_up.png
C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\save_disabled.png
C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\save_down.png
C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\save_over.png
C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\save_up.png
C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_connection_disabled.png
C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_connection_off.png
C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_connection_on.png
C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_content_disabled.png
C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_content_off.png
C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_content_on.png
C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_general_disabled.png
C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_general_off.png
C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_general_on.png
C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_info_disabled.png
C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_info_off.png
C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_info_on.png
C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_shortcut_disabled.png
C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_shortcut_off.png
C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_shortcut_on.png
C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons
C:\Program Files\WHITESMOKE\html\english\settings\img\captionbar\caption_bar_close_down.gif
C:\Program Files\WHITESMOKE\html\english\settings\img\captionbar\caption_bar_close_over.gif
C:\Program Files\WHITESMOKE\html\english\settings\img\captionbar\caption_bar_close_up.gif
C:\Program Files\WHITESMOKE\html\english\settings\img\captionbar
C:\Program Files\WHITESMOKE\html\english\settings\img
C:\Program Files\WHITESMOKE\html\english\settings\index.html
C:\Program Files\WHITESMOKE\html\english\settings\js\iepngfix\blank.gif
C:\Program Files\WHITESMOKE\html\english\settings\js\iepngfix\checkerboard.gif
C:\Program Files\WHITESMOKE\html\english\settings\js\iepngfix\helix.gif
C:\Program Files\WHITESMOKE\html\english\settings\js\iepngfix\iepngfix.htc
C:\Program Files\WHITESMOKE\html\english\settings\js\iepngfix\iepngfix.html
C:\Program Files\WHITESMOKE\html\english\settings\js\iepngfix\opacity.png
C:\Program Files\WHITESMOKE\html\english\settings\js\iepngfix
C:\Program Files\WHITESMOKE\html\english\settings\js\settingsInterface.js
C:\Program Files\WHITESMOKE\html\english\settings\js
C:\Program Files\WHITESMOKE\html\english\settings
C:\Program Files\WHITESMOKE\html\english\templates\dtree.css
C:\Program Files\WHITESMOKE\html\english\templates\dtree.js
C:\Program Files\WHITESMOKE\html\english\templates\General\Apologies\ApologyInnappropriateBehavior.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Apologies\ApologyUnjustBehavior.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Apologies
C:\Program Files\WHITESMOKE\html\english\templates\General\Community Work\ResignationFromVoluntaryPosition.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Community Work
C:\Program Files\WHITESMOKE\html\english\templates\General\Condolences\LetterOfCondolence.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Condolences
C:\Program Files\WHITESMOKE\html\english\templates\General\Cover Letters\CoverLetter.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Cover Letters\GrantCoverSheet.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Cover Letters
C:\Program Files\WHITESMOKE\html\english\templates\General\Family\FamilyNewsUpdate.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Family
C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\AgreementToCompromiseDebt.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\BankError.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\DebtValidation.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\InvestigationOfBillingInquiry.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\LetterOfCreditGeneral.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\LetterOfCreditIrrevocable.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\LetterOfCreditRevolving.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\LetterOfDispute.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\RemovalOfInadequateInformation.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\ReplyToApplicationForCredit.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\RequestForIncreaseOfCreditLimit.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\ReturningUnsignedCheck.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\UnauthorizedCreditInquiry.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Finance
C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\AChristmasWish.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\ArrivalOfChristmas.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\BlessingsAtChristmas.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\ChristmasGreetings.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\ChristmasGreetingsMessage.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\ChristmasGreetingsToASpouse.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\ChristmasGreetingsToWorkers.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\ChristmasWishes.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\HappyChristmasGreeting.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\InTheStillOfTheNightChristmasGreeting.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\JoyousOccasion.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\LovePeaceAndJoy.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\MerryChristmasAndHappyNewYear.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\MerryChristmasToFamily.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas
C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Graduation\CongratulationsOnYourGraduation.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Graduation\CongratulationsToTheGraduate.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Graduation\YouHaveGraduated.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Graduation
C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Manual\EmployeePerformanceReviewAndPlanningSessions.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Manual\EmploymentApplications.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Manual\HealthRelatedIssues.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Manual\NewEmployeeOrientation.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Manual\TerminationOfEmployment.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Manual\TuitionReimbursementPolicy.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Manual
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Reference Letters\EmploymentReferenceLetter.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Reference Letters\JobReferenceLetter.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Reference Letters\LetterOfReference.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Reference Letters\ReferenceLetterByAcquaintance.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Reference Letters\RequestForEmployeeReferenceLetter.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Reference Letters\VerificationOfEmploymentLetter.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Reference Letters
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employment Requests\Letter Requesting Pay Raise.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employment Requests\Refusal of Resquest For Raise.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employment Requests\Request for Leave of Absence.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employment Requests\Request for Letter of Reference.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employment Requests\Request for Meeting Regarding Pay Raise.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employment Requests\Request for Paid or Unpaid Leave.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employment Requests\Request For Salary Increase.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employment Requests\Request to Schedule an Interview.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employment Requests
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Dismissal and Rejection\Acknowledgment of Job Application.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Dismissal and Rejection\Confirmation of Job Dismissal.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Dismissal and Rejection\Final Warning Before Dismissal.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Dismissal and Rejection\Job Rejection Letter.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Dismissal and Rejection\Job Rejection Letter2.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Dismissal and Rejection\Rejection of Job Offer.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Dismissal and Rejection
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Employment Letters\Employment Letter.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Employment Letters\Introduction of New Employee.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Employment Letters\Letter for Assistant Professor.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Employment Letters\LetterForTenureTrackAssociateProfessor.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Employment Letters\Offer of Employment.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Employment Letters\Request for Employment Test.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Employment Letters
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Job Acceptance\Accept or Decline Job Offer.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Job Acceptance\Job Acceptance Letter 2.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Job Acceptance\Job Acceptance Letter.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Job Acceptance\Job Offer Acceptance.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Job Acceptance
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Thank You Letters\Thank You Letter After Interview.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Thank You Letters\Thank You to Applicant for Testing.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Thank You Letters
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Resignation Letters\Acceptance of Employee's Resignation.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Resignation Letters\Employee Termination Notice.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Resignation Letters\Job Resignation Letter.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Resignation Letters
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Personnel Office\Notice of Decision to Reprimand.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Personnel Office
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Job Search Cover Letters\Cover Letter Auditor Development Program.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Job Search Cover Letters\Job Application Letter.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Job Search Cover Letters\Job Search Cover Letter - Disabled Citizens.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Job Search Cover Letters\Job Search Cover Letter - Software Employment.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Job Search Cover Letters\Law Internship Cover Letter.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Job Search Cover Letters\Resume Cover Letter.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Job Search Cover Letters\Resume Cover Letter2.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Job Search Cover Letters
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Letters of Recommendation\Letter of Recommendation.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Letters of Recommendation
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Accounting Resume.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Administrative Resume.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Banking Resume.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Customer Service Resume.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Database and Application Developer Resume.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\End User Trainer and Instructional Designer Resume.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Engineering Resume.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Freelance Marcom Resume.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\General CV Format.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Graphic Designer Resume.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Healthcare Resume.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Internship Resume.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Java Developer Resume.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Management Resume 2.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Management Resume.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Marketing Administrator Resume.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Marketing Director Resume.html
C:\Program Files\WHITESMOKE\html\english\templates\General\HumanIt seems my post was too long, here's the rest of it:


C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Marketing Manager Resume.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Medical Essay Residency Experience.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Medical Resume - Physician.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Medical Resume Partnership in General Practice.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\PowerPoint Designer Resume.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Product Delivery Engineer Resume.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Sales Representative Resume.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Software QA Engineer Resume.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Technical Publication Manager Resume.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Technical Writer.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Web Developer Resume.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Web Maintainer Resume.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters
C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources
C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Advertising\Advertising Commitment Form.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Advertising\Art Advertising Flyer.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Advertising\Request for Advertising Rate.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Advertising\Subscriber Letter News Service.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Advertising
C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Legal\Assignment of Literary Property.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Legal
C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Promotions\Comments to Author Regarding Book.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Promotions\Introduction of Novel.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Promotions\Letter of Interest to Magazine.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Promotions\Letter of Recommendation.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Promotions\Magazine Review.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Promotions\Promotional Letter Antique Shop.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Promotions
C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Resumes\Actor Resume.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Resumes
C:\Program Files\WHITESMOKE\html\english\templates\General\Literary
C:\Program Files\WHITESMOKE\html\english\templates\General\Personal Matters\Career Change.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Personal Matters\Letter to a Friend Regarding Change of Job.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Personal Matters\Sale of Automobile or Other Motor Vehicle.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Personal Matters\Upset Regarding Loss of Job.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Personal Matters
C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Admissions Essays\Admissions Essay for Entrance to Theater Institute.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Admissions Essays\Essay - Describe Events.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Admissions Essays\Graduate School Literary Essay.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Admissions Essays
C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Careers\Career Letter for Accounting Position.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Careers\Career Letter in Journalism.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Careers
C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Personal Correspondence\Compliment Student on Graduation.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Personal Correspondence\Congratulations to High School Graduate.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Personal Correspondence\Personal Letter of Recommendation.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Personal Correspondence\Request for Financial Assistance from Parents.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Personal Correspondence
C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Resumes\Resume for After-School Job.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Resumes\Student Resume Automotive Service Industry.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Resumes\Student Resume Forestry.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Resumes\Student Resume Wildlife.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Resumes\Student Resume.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Resumes
C:\Program Files\WHITESMOKE\html\english\templates\General\Students\University Correspondence\Appreciation of Scholarship.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Students\University Correspondence\Request for Reference.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Students\University Correspondence\Request for University Application Material.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Students\University Correspondence
C:\Program Files\WHITESMOKE\html\english\templates\General\Students
C:\Program Files\WHITESMOKE\html\english\templates\General\Thank You\Letter Thanking Coworker for Support.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Thank You\Message of Thanks.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Thank You\Thank You Staff for Emotional Support.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Thank You
C:\Program Files\WHITESMOKE\html\english\templates\General\Well Wishes\Letter of Congratulations.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Well Wishes\Welcome New Tenants.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Well Wishes\Wishes for Speedy Recovery.html
C:\Program Files\WHITESMOKE\html\english\templates\General\Well Wishes
C:\Program Files\WHITESMOKE\html\english\templates\General
C:\Program Files\WHITESMOKE\html\english\templates\images\jspDrag.gif
C:\Program Files\WHITESMOKE\html\english\templates\images\jspVerticalBar.gif
C:\Program Files\WHITESMOKE\html\english\templates\images
C:\Program Files\WHITESMOKE\html\english\templates\img\apply_over.png
C:\Program Files\WHITESMOKE\html\english\templates\img\apply_press.png
C:\Program Files\WHITESMOKE\html\english\templates\img\apply_up.png
C:\Program Files\WHITESMOKE\html\english\templates\img\atart_arrow.jpg
C:\Program Files\WHITESMOKE\html\english\templates\img\base.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\borders.png
C:\Program Files\WHITESMOKE\html\english\templates\img\borders2.png
C:\Program Files\WHITESMOKE\html\english\templates\img\borders3.png
C:\Program Files\WHITESMOKE\html\english\templates\img\borders_good.png
C:\Program Files\WHITESMOKE\html\english\templates\img\bullet.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\cd.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\close.png
C:\Program Files\WHITESMOKE\html\english\templates\img\close2.png
C:\Program Files\WHITESMOKE\html\english\templates\img\dirClose.png
C:\Program Files\WHITESMOKE\html\english\templates\img\dirOpen.png
C:\Program Files\WHITESMOKE\html\english\templates\img\empty - Copy.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\empty.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\empty2.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\folder.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\folderopen.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\globe.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\img\base.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\img\cd.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\img\empty.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\img\folder.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\img\folderopen.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\img\globe.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\img\imgfolder.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\img\join.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\img\joinbottom.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\img\line.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\img\minus.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\img\minusbottom.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\img\musicfolder.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\img\nolines_minus.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\img\nolines_plus.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\img\page.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\img\plus.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\img\plusbottom.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\img\question.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\img\trash.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\img
C:\Program Files\WHITESMOKE\html\english\templates\img\imgfolder.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\join.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\joinbottom.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\jspDrag.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\jspVerticalBar.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\line.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\minus.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\minusbottom.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\musicfolder.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\myEmpty.png
C:\Program Files\WHITESMOKE\html\english\templates\img\neg_bullet.png
C:\Program Files\WHITESMOKE\html\english\templates\img\nolines_minus.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\nolines_plus.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\open.png
C:\Program Files\WHITESMOKE\html\english\templates\img\open2 - Copy.png
C:\Program Files\WHITESMOKE\html\english\templates\img\open2.png
C:\Program Files\WHITESMOKE\html\english\templates\img\p7t_minus.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\p7t_plus.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\page.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\plus.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\plusbottom.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\plus_bullet.png
C:\Program Files\WHITESMOKE\html\english\templates\img\question.gif
C:\Program Files\WHITESMOKE\html\english\templates\img\top_close.png
C:\Program Files\WHITESMOKE\html\english\templates\img\top_open.png
C:\Program Files\WHITESMOKE\html\english\templates\img\trash.gif
C:\Program Files\WHITESMOKE\html\english\templates\img
C:\Program Files\WHITESMOKE\html\english\templates\index.html
C:\Program Files\WHITESMOKE\html\english\templates\js\jquery-1.4.2.min.js
C:\Program Files\WHITESMOKE\html\english\templates\js\jquery.jscrollpane.min.js
C:\Program Files\WHITESMOKE\html\english\templates\js\jquery.mousewheel.js
C:\Program Files\WHITESMOKE\html\english\templates\js\switchcontent.js
C:\Program Files\WHITESMOKE\html\english\templates\js\templatesInterface.js
C:\Program Files\WHITESMOKE\html\english\templates\js
C:\Program Files\WHITESMOKE\html\english\templates\menu.htm
C:\Program Files\WHITESMOKE\html\english\templates\objects\ebook_js.js
C:\Program Files\WHITESMOKE\html\english\templates\objects\flashobject.js
C:\Program Files\WHITESMOKE\html\english\templates\objects\mcl.css
C:\Program Files\WHITESMOKE\html\english\templates\objects\navigation.js
C:\Program Files\WHITESMOKE\html\english\templates\objects\p7tm\p7tmbasic.css
C:\Program Files\WHITESMOKE\html\english\templates\objects\p7tm\p7tmscripts.js
C:\Program Files\WHITESMOKE\html\english\templates\objects\p7tm\p7t_minus.gif
C:\Program Files\WHITESMOKE\html\english\templates\objects\p7tm\p7t_plus.gif
C:\Program Files\WHITESMOKE\html\english\templates\objects\p7tm
C:\Program Files\WHITESMOKE\html\english\templates\objects\parseURL.js
C:\Program Files\WHITESMOKE\html\english\templates\objects\utils.js
C:\Program Files\WHITESMOKE\html\english\templates\objects\wm_cookies.js
C:\Program Files\WHITESMOKE\html\english\templates\objects
C:\Program Files\WHITESMOKE\html\english\templates\start.html
C:\Program Files\WHITESMOKE\html\english\templates\style\jquery.jscrollpane.css
C:\Program Files\WHITESMOKE\html\english\templates\style\style.css
C:\Program Files\WHITESMOKE\html\english\templates\style\templates.css
C:\Program Files\WHITESMOKE\html\english\templates\style
C:\Program Files\WHITESMOKE\html\english\templates
C:\Program Files\WHITESMOKE\html\english\userGuide\css\jquery.jscrollpane.css
C:\Program Files\WHITESMOKE\html\english\userGuide\css\style - Copy.css
C:\Program Files\WHITESMOKE\html\english\userGuide\css\style.css
C:\Program Files\WHITESMOKE\html\english\userGuide\css
C:\Program Files\WHITESMOKE\html\english\userGuide\faq.html
C:\Program Files\WHITESMOKE\html\english\userGuide\images\arr.png
C:\Program Files\WHITESMOKE\html\english\userGuide\images\arr2.gif
C:\Program Files\WHITESMOKE\html\english\userGuide\images\bg - Copy.png
C:\Program Files\WHITESMOKE\html\english\userGuide\images\bg-good.png
C:\Program Files\WHITESMOKE\html\english\userGuide\images\bg.png
C:\Program Files\WHITESMOKE\html\english\userGuide\images\boxBlackFix.png
C:\Program Files\WHITESMOKE\html\english\userGuide\images\buttons.png
C:\Program Files\WHITESMOKE\html\english\userGuide\images\ConfiguringWhiteSmoke.png
C:\Program Files\WHITESMOKE\html\english\userGuide\images\correctionssuggestions.png
C:\Program Files\WHITESMOKE\html\english\userGuide\images\dictionaryTab.png
C:\Program Files\WHITESMOKE\html\english\userGuide\images\faq.png
C:\Program Files\WHITESMOKE\html\english\userGuide\images\i.gif
C:\Program Files\WHITESMOKE\html\english\userGuide\images\I.png
C:\Program Files\WHITESMOKE\html\english\userGuide\images\jspDrag.gif
C:\Program Files\WHITESMOKE\html\english\userGuide\images\jspVerticalBar.gif
C:\Program Files\WHITESMOKE\html\english\userGuide\images\nav.jpg
C:\Program Files\WHITESMOKE\html\english\userGuide\images\otk.png
C:\Program Files\WHITESMOKE\html\english\userGuide\images\t.gif
C:\Program Files\WHITESMOKE\html\english\userGuide\images\TheRight-clickMenu.png
C:\Program Files\WHITESMOKE\html\english\userGuide\images\TheTemplatesTab.png
C:\Program Files\WHITESMOKE\html\english\userGuide\images\translatorTab.png
C:\Program Files\WHITESMOKE\html\english\userGuide\images\WhiteSmokeEmailCheck.png
C:\Program Files\WHITESMOKE\html\english\userGuide\images\WhiteSmokeOverview.png
C:\Program Files\WHITESMOKE\html\english\userGuide\images\WriterTab.png
C:\Program Files\WHITESMOKE\html\english\userGuide\images
C:\Program Files\WHITESMOKE\html\english\userGuide\js\jquery-1.4.2.min.js
C:\Program Files\WHITESMOKE\html\english\userGuide\js\jquery.jscrollpane.min.js
C:\Program Files\WHITESMOKE\html\english\userGuide\js\jquery.min.js
C:\Program Files\WHITESMOKE\html\english\userGuide\js\jquery.mousewheel.js
C:\Program Files\WHITESMOKE\html\english\userGuide\js\userGuide.js
C:\Program Files\WHITESMOKE\html\english\userGuide\js
C:\Program Files\WHITESMOKE\html\english\userGuide\troubleshooting.html
C:\Program Files\WHITESMOKE\html\english\userGuide\userGuide.html
C:\Program Files\WHITESMOKE\html\english\userGuide
C:\Program Files\WHITESMOKE\html\english
C:\Program Files\WHITESMOKE\html
C:\Program Files\WHITESMOKE\Microsoft.VC80.CRT.manifest
C:\Program Files\WHITESMOKE\msvcp80.dll
C:\Program Files\WHITESMOKE\msvcr80.dll
C:\Program Files\WHITESMOKE\NotifierWhiteApps.txt
C:\Program Files\WHITESMOKE\osmax.ocx
C:\Program Files\WHITESMOKE\osmax64.ocx
C:\Program Files\WHITESMOKE\secman.dll
C:\Program Files\WHITESMOKE\secman64.dll
C:\Program Files\WHITESMOKE\settings.ini
C:\Program Files\WHITESMOKE\TCCons.dll
C:\Program Files\WHITESMOKE\TCCons_x64.dll
C:\Program Files\WHITESMOKE\Uninst.exe
C:\Program Files\WHITESMOKE\WCapture.dll
C:\Program Files\WHITESMOKE\WCaptureX.dll
C:\Program Files\WHITESMOKE\WCaptureX_x64.dll
C:\Program Files\WHITESMOKE\WCapture_x64.dll
C:\Program Files\WHITESMOKE\WCustom.dll
C:\Program Files\WHITESMOKE\WCustom_x64.dll
C:\Program Files\WHITESMOKE\WhiteSmokeRegistration.exe
C:\Program Files\WHITESMOKE\WHook.dll
C:\Program Files\WHITESMOKE\WHook_x64.dll
C:\Program Files\WHITESMOKE\Writer.ico
C:\Program Files\WHITESMOKE\WSDictHookDll.dll
C:\Program Files\WHITESMOKE\WSEngine.dll
C:\Program Files\WHITESMOKE\WSEnrichment.exe
C:\Program Files\WHITESMOKE\WSLogger.exe
C:\Program Files\WHITESMOKE\WSMouseHook.dll
C:\Program Files\WHITESMOKE\WSTray64.exe
C:\Program Files\WHITESMOKE

Trojan.Dropper/SVCHost-Fake
C:\SBRB\SVCHOST.EXE

Adware.Tracking Cookie
.eyewonder.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.eyewonder.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.revsci.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
ad.yieldmanager.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
in.getclicky.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.kontera.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.atdmt.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.imrworldwide.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.imrworldwide.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.mediaplex.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.invitemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.serving-sys.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.serving-sys.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.bs.serving-sys.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.content.yieldmanager.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.riverisland.122.2o7.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.mediav.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.adbrite.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.apmebf.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.fastclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.adxpose.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.collective-media.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.collective-media.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.zedo.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
user.lucidmedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ads.pointroll.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.pointroll.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.mmstat.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.msnportal.112.2o7.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.advertising.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.kantarmedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.kantarmedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.www.burstnet.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.burstnet.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.burstnet.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.advertising.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.yieldmanager.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.doubleclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insightexpressai.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insightexpressai.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insightexpressai.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.fastclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.invitemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
fidelity.rotator.hadj7.adjuggler.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.invitemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.googleads.g.doubleclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.adbrite.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ads.pointroll.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.mediafire.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.interclick.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.interclick.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.mediafire.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.interclick.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.a1.interclick.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.collective-media.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.smartadserver.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.smartadserver.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.smartadserver.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.smartadserver.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
ext-us.bestofmedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.xiti.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.revsci.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.at.atwola.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.tacoda.at.atwola.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.tacoda.at.atwola.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.tacoda.at.atwola.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.at.atwola.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.tacoda.at.atwola.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.tacoda.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.specificmedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.legolas-media.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.legolas-media.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.legolas-media.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ice.112.2o7.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ru4.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ru4.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.adbrite.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.invitemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.mediafire.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ru4.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.clicksor.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.clicksor.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.clicksor.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
dc.tremormedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.myroitracking.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.clicksor.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.clicksor.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.lucidmedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.mediaplex.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.invitemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.invitemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.invitemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.invitemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.fuckyeahchesthair.tumblr.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
trekmedia.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.*adult URL* [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.*adult URL* [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.*adult URL* [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.*adult URL* [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.*adult URL* [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.*adult URL* [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.*adult URL* [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.*adult URL* [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.fuckyeahchesthair.tumblr.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.atdmt.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.atdmt.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.2o7.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.media6degrees.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.eyewonder.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.eyewonder.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.a1.interclick.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.a1.interclick.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.a1.interclick.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.a1.interclick.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.a1.interclick.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.pointroll.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ads.pointroll.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ads.pointroll.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ads.pointroll.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ads.pointroll.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ads.pointroll.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ads.pointroll.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.dmtracker.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.cracked.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.cracked.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
www.cracked.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
www.burstbeacon.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.burstbeacon.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
www.burstnet.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
www.cracked.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.cracked.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.cracked.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.advertising.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.cracked.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.collective-media.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.revsci.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.revsci.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.revsci.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.revsci.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.2o7.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.tribalfusion.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.tribalfusion.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.tribalfusion.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.tribalfusion.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.tribalfusion.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.mediabrandsww.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ero-advertising.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.liveperson.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
server.iad.liveperson.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.adtech.de [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.tradedoubler.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.tradedoubler.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.tradedoubler.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.overture.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.adbrite.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.adbrite.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
delivery.trafficjunky.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
fidelity.rotator.hadj7.adjuggler.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
www.sublimemedia.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.tribalfusion.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.zedo.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.zedo.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
www.jscount.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
www.jscount.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
*Blocked Russian URL* [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
*Blocked Russian URL* [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.statcounter.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.adbrite.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
eas.apm.emediate.eu [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
eas.apm.emediate.eu [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
publishers.w00tmedia.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.revsci.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.pro-market.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.nike.112.2o7.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.invitemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.media6degrees.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.content.yieldmanager.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.atdmt.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.serving-sys.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.serving-sys.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.questionmarket.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.questionmarket.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
fr.sitestat.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
fr.sitestat.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
ad.yieldmanager.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
ad.yieldmanager.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
ad.yieldmanager.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
ad.yieldmanager.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.fastclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.fastclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.fastclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
bmuk.burstnet.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
bmuk.burstnet.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.adviva.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.specificclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.specificclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.specificclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.specificclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.specificclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.specificclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
stat.onestat.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
stat.onestat.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.zedo.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.zedo.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.zedo.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.zedo.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.advertising.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.advertising.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.advertising.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.advertising.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.mediafire.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.mediafire.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.mediafire.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
www.sublimemedia.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.casalemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.casalemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.casalemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.media6degrees.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.media6degrees.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.media6degrees.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.media6degrees.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.casalemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.casalemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.casalemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.casalemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.casalemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.casalemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
ad.yieldmanager.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
ad.yieldmanager.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
ad.yieldmanager.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
ad.yieldmanager.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
C:\Users\1\AppData\Roaming\Microsoft\Windows\Cookies\Low\[emailprotected][2].txt
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies\[emailprotected][1].txt





And the MBAM log

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 6773

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

6/5/2011 1:33:43 PM
mbam-log-2011-06-05 (13-33-43).txt

Scan type: Quick scan
Objects scanned: 149488
Time elapsed: 2 minute(s), 42 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 11
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 3

Memory Processes Infected:
c:\Windows\winupdaterstd\svchost.exe (Backdoor.Agent) -> 3220 -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Context\Context-Ads (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF} (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\chkavwqhhst.chkavwqhhst.1.0 (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\chkavwqhhst.chkavwqhhst (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4} (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\adfavwqhpr.adfavwqhpr.1.0 (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\adfavwqhpr.adfavwqhpr (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4} (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4} (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4} (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$XNTUninstall643$ (Adware.AdRotator) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Speaker (Backdoor.Agent) -> Value: Speaker -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bipro (Trojan.Agent.Gen) -> Value: bipro -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)
HELLO and welcome to Computer HOPE Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
******************************************************
Is this a business computer?
I am required to give you this information.
One or more of the identified infections is a backdoor trojan.

This allows hackers to remotely control your computer, steal critical system information and Download and Execute files

Read this article: Danger: Remote Access Trojans.

If your computer was used for online banking, has credit card information or other sensitive data on it, all passwords should be changed immediately to include those used for banking, email, eBay and forums. You should consider them to be compromised. They should be changed by using a different computer and not the infected one! If not, an attacker may get the new passwords and transaction information. Banking and credit card institutions should be notified of the possible security breach.

I would counsel you to disconnect this PC from the Internet immediately.

Though the Trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

When Should I Format, How Should I Reinstall?

We can attempt to clean this machine but i can't guarantee that it will be 100% secure afterwards.

Should you have any questions, please feel FREE to ask.

Please let us know what you have decided to do in your next post
It isn't a business computer. I would like to try and repair for now, I think. Since I am currently abroad and can't really reformat myself. I will definitely consider reformatting when I return home, but until then I need to use my computer. I wouldn't need to use it for banking or anything serious, just for university work mainly. For future reference, installing a new hard drive would FIX the problem, right?Quote

For future reference, installing a new hard drive would fix the problem, right?

Ok. I'm satisfied. How's your computer running? Any other issues?No - other than facebook sometimes (rare) logging me out on its own, but I guess that's a facebook issue.Ok. Let's do some cleanup.

To remove all of the tools we used and the files and folders they created do the following:
Double click OTL.exe.

• Click the CleanUp button.
  
• Select Yes when the "Begin cleanup Process?" prompt appears.
  
• If you are prompted to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes.

I would like to sincerely thank you in helping me deal with this infection!

It says "no action taken". Please run it again and clean the infections. Let's do some cleanup.

Download OTL to your desktop.

To REMOVE all of the tools we used and the files and folders they created do the following:
Double click OTL.exe.

• Click the CleanUp button.
  
• Select Yes when the "Begin cleanup Process?" prompt appears.
  
• If you are prompted to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes.

This appears to be a problem with your accounts and not malware. One more scan, if you don't mind.

I'd like to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
•Click the button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

I still can't browse the internet. Maybe the the virus change some settings and they were not restored when the virus was removed.

• Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
  
• In the field, type in ComboFix /uninstall
  

• Then, press Enter, or click OK.
  
• This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
  

• Click the CleanUp button.
  
• Select Yes when the "Begin cleanup Process?" prompt appears.
  
• If you are prompted to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes.

Could you please try to run ESET again?Would it be OK for me to stop the process wuauclt.exe when it runs, as this seems to be the process that brings the computer almost to a halt - or would that do more harm than good?

ESET ran and said there were no threats.ESET log:

ESETSmartInsta[emailprotected] as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6427
# api_version=3.0.2
# EOSSerial=43fa88dd6e114e4a953ecf35227219d2
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-04-16 09:11:44
# local_time=2011-04-16 10:11:44 (+0000, GMT Daylight Time)
# country="United Kingdom"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 6058035 6058035 0 0
# compatibility_mode=3584 16777175 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 2352769 2352769 0 0
# compatibility_mode=9217 16777214 100 70 4357047 25685842 0 0
# scanned=152208
# found=0
# cleaned=0
# scan_time=6543Good. How's your computer running?A spurious process is still running each day. It appears to be wuauclt.exe.Quote

A spurious process is still running each day. It appears to be wuauclt.exe.

In fact, it does seem to have gone quite a long way to fixing it, as SVCHOST now runs quickly and hardly slows the PC down while it's running. There is still one outstanding problem, which gives a 'Generic host process for Win 32 Services - high memory usage' message, which I think is the wuauclt.exe - but this seems to only occur only once every few days. So I think there were 2 problems, one of which has now been fixed and the other of which only happens every so often, rather than every day. I think we might be able to put up with this, unless you have a simple solution to it. If you think we have gone as far as is sensible with this, I would like to thank you for your efforts in dealing with this. Your involvement is appreciated.

• Click the Start button. Click Run. For Vista: type in Run in the Start SEARCH, and click on Run in the results pane.
  
• In the field, type in ComboFix /uninstall
  

• Then, press Enter, or click OK.
  
• This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
  

• Click the CleanUp button.
  
• Select Yes when the "Begin cleanup Process?" prompt appears.
  
• If you are prompted to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes.

thanks. I think I am almost back up and running. Now that I've "freshened up" my laptop with a full format, I may go off and do the same THING to my old XP desktop that has a very full hard drive.

With spyware PROGRAMS like you listed, do I have them all on and active? do they run in the background or do I need to get back into the habit of just running them weekly?
I have Windows Defender on and running. Is there a way to settle User Account CONTROL down so it isn't popping up every time I make a change?Quote

With spyware programs like you listed, do I have them all on and active? do they run in the background or do I need to get back into the habit of just running them weekly?

Is there a way to settle User Account Control down so it isn't popping up every time I make a change?

Quote

Is it a serious problem that I get this warning on alot of sites I have to log into?

• Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
  
• In the field, type in ComboFix /uninstall
  

• Then, press Enter, or click OK.
  
• This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
  

That looks good. If there are no other issues, it's time for some cleanup.

To uninstall ComboFix

• Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
  
• In the field, type in ComboFix /uninstall
  

• Then, press Enter, or click OK.
  
• This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
  

• Click the CleanUp button.
  
• Select Yes when the "Begin cleanup Process?" prompt appears.
  
• If you are prompted to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes.

So I take it I should UNCHECK "Remove Found Threats" and just scan and post log?no found threats...can't find log ?

Now what?Quote from: bluecountry on June 27, 2011, 12:14:38 AM

no found threats...can't find log ?

Now what?

Is there anything I can do, run, to double check and make sure it checks out?
Thanks Dave.

• Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
  
• In the field, type in ComboFix /uninstall
  

• Then, press Enter, or click OK.
  
• This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
  

There is no final scan we can do, just to be sure, before book closing?

tried combofix uninstall, said windows could not find it. I think I might have already deleted, anyway to confirm?

• Click the CleanUp button.
  
• Select Yes when the "Begin cleanup Process?" prompt appears.
  
• If you are prompted to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes.

Microsoft C++ Runtime Library
Runtime Error!

Program: C:\Program files\ internet explorer\iexplore.exe

R6025
-pure virtual function cell

was in firefox with secunia and tried it three times, all of which caused the browser to crash.

I then tried it with IE, and it caused this message to be displayed continously until I ctrl-alt-dlt it to shut off.

So it otherwise should be all set and good?

Okay, just finished the ESET scan. I accidentally hit Finish before exporting, but fortunately found the log in the Program Files location you mentioned, so thanks for that.

I'm suddenly getting a lot of "Potentially Unwanted Program Blocked" messages from McAfee regarding "TOOL-NirCmd" from OTL, should I allow that program?

Following is the log, and again, thank you.

ESET Log:

[emailprotected] as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=7158f6dc72e4014abce3de1c6ba92476
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-07-12 10:44:01
# local_time=2011-07-12 03:44:01 (-0800, Pacific Daylight Time)
# country="United States"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 268006 268006 0 0
# compatibility_mode=5121 16777213 100 75 939170 10873495 0 0
# compatibility_mode=5892 16776573 100 100 0 147108361 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=164046
# found=0
# cleaned=0
# scan_time=9807
Quote

I'm suddenly getting a lot of "Potentially Unwanted Program Blocked" messages from McAfee regarding "Tool-NirCmd" from OTL, should I allow that program?

• Click the CleanUp button.
  
• Select Yes when the "Begin cleanup Process?" prompt appears.
  
• If you are prompted to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes.

I forgot to mention that the Security check indicates that you have Panda Antivirus Pro 2012 and Norton 360 running at the same time on your computer. One of these AV's will have to be disabled/uninstalled.
*********************************************
Re-running ComboFix to remove infections:

• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not INTERFERE with the running of ComboFix.
• Open notepad and copy/paste the text in the quotebox below into it:
  Quote

  KillAll::
  
  File::
  C:\found.005
  C:\found.004
  C:\found.003
  C:\found.002
  C:\found.001
  
  DirLook::
  C:\40d9b26e2a8b3f767a
  C:\ef60c58cdd1f56bf95401cfaf20940ef
  
  Firefox::
  Trusted Zone: internet
  Trusted Zone: mcafee.com
  
  

• Save this as CFScript.txt, in the same location as ComboFix.exe
  
  
  
  
• Referring to the picture above, drag CFScript into ComboFix.exe
• When finished, it shall produce a log for you at C:\ComboFix.txt
  
• Please post the contents of the log in your next reply.

Sorry it took so long to get back to you I've had more problems with my laptop

I checked the files with jotti and found out that I only have 1 of the files......c:\windows\system32\igxpun.exe