GeekPolice
Welcome to GeekPolice.net!

From "wow" to "whoa" - we're teaching practical technology and helping others with tech support. Join our family here!

You are viewing the forum as a "Guest" which doesn't give you member privileges to ask questions or post comments.

Take 30 seconds to register or log in below and unlock the limitations of this website to discover new computer knowledge!

32win/nuqel.e & bankerfox.a

View previous topic View next topic Go down

32win/nuqel.e & bankerfox.a

Post by louise townsend on Tue Jan 05, 2010 8:34 am

Hello
I have searched and searched for a fix for this virus and it seems this is the place every-one says to come. I can see that others have the same problem as me. I am running your basic AVG but have been away for 2 weeks, when I opened internet explorer I guess I let it in before it had a chance to update.
So far I have run MS Malicious Software removal tool and an updated AVG in safe mode from a thumb drive. I can not run anything in normal mode - AVG scan displays infected file. Unable to get on line. I have taken it offline for security sake but a page that looks like explorer pops up with a porn home page, viagra sales...
Will I follow the directions for this virus posted on this site previously? If so, I have no control over the internet - where in the thread do I start?
Thanks
Lou
PS this is my first forum and if you hadn't picked up on it... a nube so go easy! Smile

louise townsend
Novice
Novice

Status :
Online
Offline

Posts : 10
Joined : 2010-01-05
Gender : Female
OS : xp professional
Points : 25368
# Likes : 0

View user profile

Back to top Go down

Re: 32win/nuqel.e & bankerfox.a

Post by louise townsend on Tue Jan 05, 2010 8:59 am

I noticed that you guys are all asleep over there. So I tried Internet, Internet Options, Connections tab, LAN settings, and unchecking the box but the apply button is shaded out / cant select. Also the internet selects platinumsoft2010.microsoft.co/block.php?r+59.21.
I also dl Cheetah-Anti-Rogue via thumbdrive and the file cmd.exe is infected. Do you want to activate your antivirus software now?
If I select yes to: Do you want to block bankerfox.a it takes me to Powefull PC Protection Antivirus Pro... at the same web address as the platinumsoft... where to?

louise townsend
Novice
Novice

Status :
Online
Offline

Posts : 10
Joined : 2010-01-05
Gender : Female
OS : xp professional
Points : 25368
# Likes : 0

View user profile

Back to top Go down

Re: 32win/nuqel.e & bankerfox.a

Post by louise townsend on Tue Jan 05, 2010 10:16 am

Reading through the other threads - seems you can understand this. Smile

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:10:08 PM, on 1/5/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16945)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcrobatInfo.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O1 - Hosts: HP HP0018FE95772A
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [FileBackup] C:\Program Files\Opti\OTB\OTB.exe
O4 - HKLM\..\Run: [PCLEPCI] C:\PROGRA~1\Pinnacle\PPE\PPE.EXE
O4 - HKLM\..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [tqvpjwjf] C:\Documents and Settings\Towny\Local Settings\Application Data\xitxwu\ehcdsysguard.exe
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [tqvpjwjf] C:\Documents and Settings\Towny\Local Settings\Application Data\xitxwu\ehcdsysguard.exe
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [You must be registered and logged in to see this link.]
O17 - HKLM\System\CCS\Services\Tcpip\..\{A0F1C92D-32A9-44B1-9E59-3E722AF7B4DC}: NameServer = 192.168.0.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe
O23 - Service: ASKUpgrade - Unknown owner - C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 9081 bytes

louise townsend
Novice
Novice

Status :
Online
Offline

Posts : 10
Joined : 2010-01-05
Gender : Female
OS : xp professional
Points : 25368
# Likes : 0

View user profile

Back to top Go down

Re: 32win/nuqel.e & bankerfox.a

Post by Belahzur on Tue Jan 05, 2010 2:58 pm

Hello.

  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555
    O1 - Hosts: HP HP0018FE95772A
    O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
    O4 - HKLM\..\Run: [tqvpjwjf] C:\Documents and Settings\Towny\Local Settings\Application Data\xitxwu\ehcdsysguard.exe
    O4 - HKCU\..\Run: [tqvpjwjf] C:\Documents and Settings\Towny\Local Settings\Application Data\xitxwu\ehcdsysguard.exe
    O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe
    O23 - Service: ASKUpgrade - Unknown owner - C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe


  • Press "Fix Checked"
  • Close Hijack This.

Remove the Proxy setting in Internet Explorer and/or in FireFox.

    In Internet Explorer
  1. Tools Menu -> Internet Options -> Connections Tab ->Lan Settings > uncheck "use a proxy server" or reconfigure the Proxy server again in case you have set it previously.

    In Firefox
  1. Tools Menu -> Options... -> Advanced Tab -> Network Tab -> "Settings" under Connection > Choose "No Proxy"
  2. Click the apply button and restart that computer in normal mode.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre
Points : 245029
# Likes : 1

View user profile

Back to top Go down

Re: 32win/nuqel.e & bankerfox.a

Post by louise townsend on Tue Jan 05, 2010 11:26 pm

Love your work!!! Love your work!!! Love your work!!!
Out of interest... why couldn't AVG pick these threats up? Should I be looking for better av software. I've used Nortons and PC-cillin a while back but they just bogged things down - had a friend suggest avgfree and haven't had any reason to doubt it's worth until now.
And - why firefox? Must admit to my ignorance... didn't even know there was anything other than windows explorer. Sad tearing
By the way did I mention you're awesome! I'll be spreading your praise.
Thanks.
Lou

Malwarebytes' Anti-Malware 1.43
Database version: 3498
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.11

1/6/2010 7:06:14 AM
mbam-log-2010-01-06 (07-06-14).txt

Scan type: Quick Scan
Objects scanned: 154586
Time elapsed: 22 minute(s), 44 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 5
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 8
Files Infected: 31

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2d2bee6e-3c9a-4d58-b9ec-458edb28d0f6} (Rogue.DriveCleaner) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe (Backdoor.Bifrose) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\AvScan (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\RegistrySmart (Rogue.RegistrySmart) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\Towny\Application Data\RegistrySmart (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
C:\Documents and Settings\Towny\Application Data\RegistrySmart\Log (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\Application Data\twain_32 (Trojan.Zbot) -> Quarantined and deleted successfully.
C:\Program Files\System32 (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\System32\drivers (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\System32\drivers\im (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\Video AX Object (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\twain_32 (Backdoor.Bot) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\Towny\Local Settings\Temp\2745.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
C:\Documents and Settings\Towny\Application Data\RegistrySmart\Errors.stg (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
C:\Documents and Settings\Towny\Application Data\RegistrySmart\Results.stg (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
C:\Documents and Settings\Towny\Application Data\RegistrySmart\Log\2007 Jul 22 - 01_18_29 PM_609.log (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
C:\Documents and Settings\Towny\Application Data\RegistrySmart\Log\2007 Jul 22 - 01_18_36 PM_593.log (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
C:\Documents and Settings\Towny\Application Data\RegistrySmart\Log\2007 Jul 22 - 06_28_55 PM_781.log (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\Application Data\twain_32\user.ds (Trojan.Zbot) -> Quarantined and deleted successfully.
C:\Program Files\System32\PccWSC32.cpl (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\System32\drivers\Install.exe (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\System32\drivers\tdiins.exe (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\System32\drivers\tmcomm.sys (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\System32\drivers\TMFilter.sys (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\System32\drivers\TmMbd.inf (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\System32\drivers\tmpreflt.sys (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\System32\drivers\TmTdi.inf (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\System32\drivers\tmtdi.sys (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\System32\drivers\tmxpflt.sys (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\System32\drivers\TM_CFW.sys (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\System32\drivers\TM_MBD_c.sys (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\System32\drivers\VsapiNT.sys (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\System32\drivers\im\ncfg.exe (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\System32\drivers\im\tm_cfw.cat (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\System32\drivers\im\TM_CFW.inf (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\System32\drivers\im\TM_CFW.sys (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\System32\drivers\im\TM_CFWMP.inf (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\twain_32\local.ds (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\twain_32\user.ds (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Towny\Application Data\wiaserva.log (Malware.Trace) -> Quarantined and deleted successfully.
C:\Program Files\setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.job (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
C:\Documents and Settings\Towny\Local Settings\Temp\_ir_sf_temp_0\irsetup.exe (Trojan.Agent) -> Quarantined and deleted successfully.

louise townsend
Novice
Novice

Status :
Online
Offline

Posts : 10
Joined : 2010-01-05
Gender : Female
OS : xp professional
Points : 25368
# Likes : 0

View user profile

Back to top Go down

Re: 32win/nuqel.e & bankerfox.a

Post by Belahzur on Wed Jan 06, 2010 12:14 am

Hello.

  • Download combofix from here
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]

    1. If you are using Firefox, make sure that your download settings are as follows:

    * Tools->Options->Main tab
    * Set to "Always ask me where to Save the files".

    2. During the download, rename Combofix to Combo-Fix as follows:





    3. It is important you rename Combofix during the download, but not after.
    4. Please do not rename Combofix to other names, but only to the one indicated.
    5. Close any open browsers.
    6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

  • We need to disable your local AV (Anti-virus) before running Combofix.
  • See [You must be registered and logged in to see this link.] for how to disable your AV.
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre
Points : 245029
# Likes : 1

View user profile

Back to top Go down

Re: 32win/nuqel.e & bankerfox.a

Post by louise townsend on Wed Jan 06, 2010 3:40 am

Thanx again. I'm guessing you would have gone for the night, catch you tomorrow.
Lou.

ComboFix 10-01-04.01 - Towny 01/06/2010 11:25:08.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.381 [GMT 8:00]
Running from: c:\documents and settings\Towny\Desktop\Combo-Fix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Towny\Local Settings\Application Data\xitxwu
c:\documents and settings\Towny\Local Settings\Application Data\xitxwu\ehcdsysguard.exe

.
((((((((((((((((((((((((( Files Created from 2009-12-06 to 2010-01-06 )))))))))))))))))))))))))))))))
.

2010-01-05 23:59 . 2010-01-05 05:27 3776280 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\setup.exe
2010-01-05 23:59 . 2010-01-05 05:27 4043032 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgui.exe
2010-01-05 23:59 . 2010-01-05 05:27 2033432 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtray.exe
2010-01-05 23:59 . 2010-01-05 05:27 3967256 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll
2010-01-05 23:59 . 2010-01-05 05:27 2352920 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgresf.dll
2010-01-05 23:59 . 2010-01-05 05:27 916248 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcfgx.dll
2010-01-05 22:27 . 2010-01-05 22:27 -------- d-----w- c:\documents and settings\Towny\Application Data\Malwarebytes
2010-01-05 22:27 . 2009-12-30 06:55 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-05 22:27 . 2010-01-05 22:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-05 22:27 . 2009-12-30 06:54 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-05 22:27 . 2010-01-05 22:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-05 22:20 . 2010-01-05 22:20 0 ----a-w- c:\windows\nsreg.dat
2010-01-05 22:20 . 2010-01-05 22:20 -------- d-----w- c:\documents and settings\Towny\Local Settings\Application Data\Mozilla
2010-01-05 05:27 . 2010-01-05 05:27 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-01-05 05:27 . 2010-01-05 05:27 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2010-01-05 05:27 . 2010-01-05 05:27 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-01-05 05:27 . 2010-01-05 05:27 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-01-05 05:27 . 2010-01-05 23:59 -------- d-----w- c:\windows\system32\drivers\Avg
2010-01-05 05:27 . 2010-01-05 05:27 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-12-20 04:38 . 2009-12-20 04:38 -------- d-----w- c:\documents and settings\Towny\Application Data\Big Fish Games
2009-12-17 08:44 . 2009-12-17 08:45 -------- d-----w- c:\program files\Common Files\DivX Shared

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-05 22:16 . 2008-04-28 09:54 -------- d-----w- c:\documents and settings\Towny\Application Data\U3
2010-01-05 10:09 . 2007-07-19 04:28 -------- d-----w- c:\program files\Trend Micro
2010-01-05 05:27 . 2009-11-18 02:18 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2009-12-27 10:44 . 2009-02-13 14:19 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-12-24 17:13 . 2009-09-17 12:15 -------- d-----w- c:\documents and settings\Towny\Application Data\vlc
2009-12-24 02:14 . 2007-04-26 06:18 -------- d-----w- c:\documents and settings\Towny\Application Data\LimeWire
2009-12-22 17:51 . 2007-04-13 01:41 -------- d-----w- c:\documents and settings\Towny\Application Data\Azureus
2009-12-17 08:45 . 2007-07-25 04:26 -------- d-----w- c:\program files\DivX
2009-11-18 07:20 . 2009-11-18 06:59 -------- d-----w- c:\program files\AskBarDis
2009-11-18 07:13 . 2009-11-18 07:13 15884 ----a-w- c:\documents and settings\Towny\Application Data\Azureus\plugins\azitunes\libProcessAccess.dll
2009-11-18 07:13 . 2009-11-18 07:13 102400 ----a-w- c:\documents and settings\Towny\Application Data\Azureus\plugins\azitunes\jacob-1.14.3-x86.dll
2009-11-18 07:13 . 2009-11-18 07:13 4141117 ----a-w- c:\documents and settings\Towny\Application Data\Azureus\plugins\vuzexcode\mediainfo.exe
2009-11-18 07:13 . 2009-11-18 07:13 6516755 ----a-w- c:\documents and settings\Towny\Application Data\Azureus\plugins\vuzexcode\ffmpeg.exe
2009-11-18 07:04 . 2007-04-13 01:40 -------- d-----w- c:\program files\Azureus
2009-11-18 06:59 . 2009-11-18 06:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Azureus
2009-11-18 04:16 . 2007-04-26 06:18 -------- d-----w- c:\program files\LimeWire
2009-11-18 03:06 . 2009-11-18 03:06 -------- d-----w- c:\program files\DVD Decrypter
2009-11-18 03:06 . 2009-11-16 06:03 -------- d-----w- c:\program files\coolpro2
2009-11-18 03:01 . 2009-11-16 05:34 120 ----a-w- c:\windows\Lcecumecahale.dat
2009-11-18 02:18 . 2008-07-18 13:02 -------- d-----w- c:\program files\AVG
2009-11-18 00:57 . 2009-11-16 05:34 0 ----a-w- c:\windows\Ydahegohewa.bin
2009-11-16 06:04 . 2009-11-16 06:04 -------- d-----w- c:\documents and settings\Towny\Application Data\Syntrillium
2009-11-14 00:47 . 2009-11-14 00:47 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-11-14 00:47 . 2009-11-14 00:47 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-11-14 00:47 . 2009-11-14 00:47 856064 ----a-w- c:\windows\system32\divx_xx07.dll
2009-11-14 00:47 . 2009-11-14 00:47 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-11-14 00:47 . 2009-11-14 00:47 843776 ----a-w- c:\windows\system32\divx_xx16.dll
2009-11-14 00:47 . 2009-11-14 00:47 839680 ----a-w- c:\windows\system32\divx_xx11.dll
2009-11-14 00:47 . 2009-11-14 00:47 696320 ----a-w- c:\windows\system32\DivX.dll
2009-11-11 07:29 . 2009-11-11 07:29 30704 ---ha-w- c:\windows\system32\mlfcache.dat
2009-10-29 07:46 . 2001-08-23 12:00 832512 ----a-w- c:\windows\system32\wininet.dll
2009-10-29 07:46 . 2007-04-12 10:44 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:46 . 2001-08-23 12:00 17408 ------w- c:\windows\system32\corpol.dll
2009-10-21 05:38 . 2007-04-12 10:44 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-21 05:38 . 2007-04-12 10:44 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-20 16:20 . 2007-04-12 10:44 265728 ------w- c:\windows\system32\drivers\http.sys
2009-10-13 10:30 . 2001-08-23 12:00 270336 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2001-08-23 12:00 149504 ----a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2001-08-23 12:00 79872 ----a-w- c:\windows\system32\raschap.dll
2006-08-28 08:55 . 2006-08-28 08:55 36155 -c--a-w- c:\program files\db_pcc.dat
2006-08-25 03:33 . 2006-08-25 03:33 3870719 ----a-w- c:\program files\pcc.exe
2006-08-25 03:33 . 2006-08-25 03:33 3584 ----a-w- c:\program files\1033.mst
2006-08-25 03:33 . 2006-08-25 03:33 2487652 -c--a-w- c:\program files\tmpcc.msi
2006-08-25 02:57 . 2006-08-25 02:57 218 ----a-w- c:\program files\setup.ini
2006-08-21 08:21 . 2006-08-21 08:21 126228 -c--a-w- c:\program files\license.rtf
2006-08-18 06:08 . 2006-08-18 06:08 7952384 -c--a-w- c:\program files\TMASOEDL.msi
2006-08-18 06:08 . 2006-08-18 06:08 7378944 -c--a-w- c:\program files\TMASOLDL.msi
2006-01-13 03:33 . 2006-01-13 03:33 64 -c--a-w- c:\program files\Tmsrl.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2009-04-02 333192]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-10 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-11 7630848]
"FileBackup"="c:\program files\Opti\OTB\OTB.exe" [2007-01-10 1060864]
"PCLEPCI"="c:\progra~1\Pinnacle\PPE\PPE.EXE" [2004-08-30 36864]
"NSLauncher"="c:\program files\Nokia\Nokia Software Launcher\NSLauncher.exe" [2006-11-27 2658304]
"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-22 483328]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-04 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-01-05 2033432]

c:\documents and settings\Towny\Start Menu\Programs\Startup\
Picture Motion Browser Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2007-6-6 368640]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [2008-7-24 25214]
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-7-26 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-01-05 05:27 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk
backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Towny^Start Menu^Programs^Startup^Picture Motion Browser Media Check Tool.lnk]
path=c:\documents and settings\Towny\Start Menu\Programs\Startup\Picture Motion Browser Media Check Tool.lnk
backup=c:\windows\pss\Picture Motion Browser Media Check Tool.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2006-06-12 21:20 127036 ----a-w- c:\windows\system32\DLA\DLACTRLW.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\emMON]
2006-05-30 13:24 61440 ----a-w- c:\windows\emMON.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2006-02-18 18:41 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-09-21 08:36 305440 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JMB36X Configure]
2006-06-02 08:45 385024 ------r- c:\windows\system32\JMRaidTool.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2006-08-11 13:43 7630848 ----a-w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2006-08-11 13:43 86016 ----a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2006-08-11 13:43 1519616 ----a-w- c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck]
2003-11-10 09:06 406016 ------w- c:\windows\system32\PSDrvCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-04 17:54 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]
2006-04-10 01:19 729088 ----a-w- c:\program files\Analog Devices\SoundMAX\SMax4.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
2006-05-01 10:07 843776 ----a-r- c:\program files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-03-13 19:43 83608 ----a-w- c:\program files\Java\jre1.6.0_01\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"c:\\Program Files\\Asus\\AsusUpdate\\Update.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [1/5/2010 1:27 PM 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [1/5/2010 1:27 PM 360584]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [1/5/2010 1:27 PM 285392]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;c:\windows\system32\drivers\atl01_xp.sys [4/12/2007 7:14 PM 34944]
R3 BENDER;Pinnacle DV/AV Capture;c:\windows\system32\drivers\bender.sys [11/21/2006 1:34 PM 200320]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [5/19/2008 9:43 PM 138112]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [5/19/2008 9:43 PM 8320]
S4 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [11/18/2009 2:59 PM 464264]
S4 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [11/18/2009 2:59 PM 234888]
.
Contents of the 'Scheduled Tasks' folder

2009-12-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 04:34]

2010-01-05 c:\windows\Tasks\SDMsgUpdate (TE).job
- e:\applic~1\SMARTD~1\Messages\SDNotify.exe [2008-02-22 23:53]

2010-01-05 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-09 14:18]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride =
uSearchAssistant = [You must be registered and logged in to see this link.]
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: {A0F1C92D-32A9-44B1-9E59-3E722AF7B4DC} = 192.168.0.1
FF - ProfilePath - c:\documents and settings\Towny\Application Data\Mozilla\Firefox\Profiles\hjxwd3om.default\
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - hȋdden: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

HKU-Default-Run-Picasa Media Detector - c:\program files\Picasa2\PicasaMediaDetector.exe
SafeBoot-AVG Anti-Spyware Driver
SafeBoot-AVG Anti-Spyware Guard
MSConfigStartUp-AVG7_CC - c:\progra~1\Grisoft\AVG7\avgcc.exe
MSConfigStartUp-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe
MSConfigStartUp-NeroFilterCheck - c:\windows\system32\NeroCheck.exe
MSConfigStartUp-Picasa Media Detector - c:\program files\Picasa2\PicasaMediaDetector.exe
AddRemove-KLiteCodecPack_is1 - c:\program files\K-Lite Codec Pack\unins000.exe
AddRemove-NickChase Detective Story 1.00 - e:\big fish games\NickChase Detective Story\Uninstall.exe
AddRemove-{26D67270-A86F-11DA-6784-0373BC4418BE} - e:\towny\Towny resume\Uninst_CS CareerWorks for Defence Community Organisation.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2010-01-06 11:32
Windows 5.1.2600 Service Pack 3 NTFS

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************
.
Completion time: 2010-01-06 11:34:17
ComboFix-quarantined-files.txt 2010-01-06 03:34

Pre-Run: 95,151,366,144 bytes free
Post-Run: 96,990,867,456 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - EBC240B286C47F07662B91F139E3A1CB

louise townsend
Novice
Novice

Status :
Online
Offline

Posts : 10
Joined : 2010-01-05
Gender : Female
OS : xp professional
Points : 25368
# Likes : 0

View user profile

Back to top Go down

Re: 32win/nuqel.e & bankerfox.a

Post by Belahzur on Wed Jan 06, 2010 5:59 pm

Hello.

  • Open HijackThis.
  • When Hijack This opens, click "Open the Misc Tools section"
  • Then select "Open Uninstall Manager"
  • Click on "Save List..." (generates uninstall_list.txt)
  • Click Save, copy and paste the results in your next post.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre
Points : 245029
# Likes : 1

View user profile

Back to top Go down

Re: 32win/nuqel.e & bankerfox.a

Post by louise townsend on Wed Jan 06, 2010 10:32 pm

Good morning!

3 Days - Zoo Mystery 1.00
Adobe Acrobat 7.1.0 Professional
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Photoshop 6.0
Adobe Photoshop Album 2.0
Adobe Reader 7.1.0
Adobe SVG Viewer
Adventure Chronicles The Search for Lost Treasure
Adventures of Robinson Crusoe
Alchemists Apprentice 1.00
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Art Detective
ASUS Enhanced Display Driver
AsusUpdate
Attansic Giga Ethernet Utility
Attansic L1 Gigabit Ethernet Driver
AVG Free 9.0
Azureus
Big Fish Games Client
Bonjour
Cate West The Velvet Keys 1.00
CDBurnerXP
Chocolate Shop Frenzy
City Style 1.00
Cooking Academy 2 World Cuisine
Cooking Dash 2- DinerTown Studios .
County Fair
Critical Update for Windows Media Player 11 (KB959772)
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Plus Web Player
DVD Decrypter (Remove Only)
DVD Shrink 3.2
Enchanted Fairy Friends Secret of the Fairy Queen
erLT
Farm Frenzy 3 .
Farm Mania
Flux Family Secrets - The Ripple Effect 1.00
G.H.O.S.T Chronicles - Phantom of the Renaissance Faire
Google Earth
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
Governor of Poker
GPS Image Tracker
hȋdden in Time - Mirror Mirror 1.00
hȋdden Mysteries Buckingham Palace
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.0 (KB932471)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
HP Customer Participation Program 7.0
HP Document Viewer 7.0
HP Imaging Device Functions 7.0
HP Photosmart Essential
HP Photosmart Premier Software 6.5
HP Photosmart, Officejet and Deskjet 7.0.A
HP Solution Center 7.0
HP Update
I Spy-Fun House .
iTunes
Java(TM) SE Runtime Environment 6 Update 1
Jetsetter
JRAID
Keys To Manhattan .
Lame ACM MP3 Codec
LimeWire 5.3.6
Magic ISO Maker v5.4 (build 0239)
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft National Language Support Downlevel APIs
Microsoft Office XP Professional
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Midnight Mysteries - The Edgar Allan Poe Conspiracy
Mozilla Firefox (3.5.6)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB933579)
Mystery Age The Imperial Staff 1.00
Mystery Case Files - Huntsville 1.00
Nokia Connectivity Cable Driver
Nokia Flashing Cable Driver
Nokia Lifeblog 2.1
Nokia Map Loader
Nokia MTP driver
Nokia PC Connectivity Solution
Nokia PC Suite
Nokia Software Launcher
Nokia Software Updater
NVIDIA Drivers
OCR Software by I.R.I.S 7.0
OTB
PC Probe II
Pinnacle device drivers
Pinnacle Instant DVD Recorder
Pinnacle MediaServer
Pinnacle PCI Performance Enhancer
Princess Isabella A Witch's Curse 1.00
QuickTime
Ranch Rush
Real Crimes - The Unicorn Killer
Samantha Swift and the hȋdden Roses of Athena
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
SmartSound Quicktracks Plugin
Sonic UDF Reader
Sony Image Data Suite
Sony Picture Utility
Sony USB Driver
SoundMAX
SPIF225 USB to SATA Bridge 98 Driver Installer
Steve the Sheriff The Case of the Missing Thing 1.00
Studio 10
Treasures Of The Ancient Cavern .
Trial of the Gods Ariadne's Fate 1.00
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VC80CRTRedist - 8.0.50727.4053
Ventrilo Client
VLC media player 1.0.1
Vuze Toolbar
Wild Tribe
Windows Driver Package - Nokia Modem (06/12/2006 6.81.0.21)
Windows Imaging Component
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 11
Windows Media Player 11
Windows Presentation Foundation
Windows XP Service Pack 3
Winemaker Extraordinaire 1.00
WinRAR archiver
WinZip 11.1
Yard Sale hȋdden Treasures - Lucky Junction

louise townsend
Novice
Novice

Status :
Online
Offline

Posts : 10
Joined : 2010-01-05
Gender : Female
OS : xp professional
Points : 25368
# Likes : 0

View user profile

Back to top Go down

Re: 32win/nuqel.e & bankerfox.a

Post by louise townsend on Wed Jan 06, 2010 10:40 pm

Also, I forgot to mention, the pc didn't shut down last night and it is running very slow since yesterday.
The little light (not the power light) the what I call the hd light (the flashing one) flashes quickly and constantly now even when all apps were closed for shut down. Is this bad?
Lou.

louise townsend
Novice
Novice

Status :
Online
Offline

Posts : 10
Joined : 2010-01-05
Gender : Female
OS : xp professional
Points : 25368
# Likes : 0

View user profile

Back to top Go down

Re: 32win/nuqel.e & bankerfox.a

Post by Belahzur on Wed Jan 06, 2010 11:17 pm

Hello.
Not too sure just yet.

I see that you are running Limewire.
P2P(Peer to peer) applications are designed to help you easily share and distribute files between you and a group of people. But they can also be used to distribute malware, and thus are not considered safe.
The removal of these programs is optional, but highly recommended.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

    Azureus
    Java(TM) SE Runtime Environment 6 Update 1
    LimeWire 5.3.6
    Vuze Toolbar

Next,

  1. Close any open browsers.
  2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  3. Open notepad and copy/paste the text in the quotebox below into it:

    File::
    c:\windows\Ydahegohewa.bin

    Folder::
    c:\documents and settings\Towny\Application Data\LimeWire
    c:\documents and settings\Towny\Application Data\Azureus
    c:\program files\AskBarDis
    c:\program files\Azureus
    c:\documents and settings\All Users\Application Data\Azureus
    c:\program files\LimeWire

    Driver::
    ASKService
    ASKUpgrade
  4. Save this as CFScript.txt, in the same location as ComboFix.exe



  5. Referring to the picture above, drag CFScript into ComboFix.exe
  6. When finished, it shall produce a log for you at C:\ComboFix.txt
  7. Please post the contents of the log in your next reply.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre
Points : 245029
# Likes : 1

View user profile

Back to top Go down

Re: 32win/nuqel.e & bankerfox.a

Post by louise townsend on Thu Jan 07, 2010 12:15 am

OMG - whatta read! PART 1 of 2.

Would not uninstall Azureus "couldn't load main class"
*(if it makes any difference - Azureus was overwritten by Vuse update (not uninstalled att)).

Thanks again.

ComboFix 10-01-04.01 - Towny 01/07/2010 7:59.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.562 [GMT 8:00]
Running from: c:\documents and settings\Towny\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Towny\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::
"c:\windows\Ydahegohewa.bin"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Azureus
c:\documents and settings\All Users\Application Data\Azureus\azCID.txt
c:\documents and settings\Towny\Application Data\Azureus
c:\documents and settings\Towny\Application Data\Azureus\.certs
c:\documents and settings\Towny\Application Data\Azureus\.keystore
c:\documents and settings\Towny\Application Data\Azureus\.lock
c:\documents and settings\Towny\Application Data\Azureus\active\1C7A066FADEC32CD8B05CE70F8495DB8C3CA46E3.dat
c:\documents and settings\Towny\Application Data\Azureus\active\1C7A066FADEC32CD8B05CE70F8495DB8C3CA46E3.dat.bak
c:\documents and settings\Towny\Application Data\Azureus\active\73507624B40CE2B7289D96BF1F5409A04BE92559.dat
c:\documents and settings\Towny\Application Data\Azureus\active\73507624B40CE2B7289D96BF1F5409A04BE92559.dat.bak
c:\documents and settings\Towny\Application Data\Azureus\active\cache.dat
c:\documents and settings\Towny\Application Data\Azureus\active\E78F092567744C32F10806A619228E2EBEC68D46.dat
c:\documents and settings\Towny\Application Data\Azureus\active\E78F092567744C32F10806A619228E2EBEC68D46.dat.bak
c:\documents and settings\Towny\Application Data\Azureus\azureus.config
c:\documents and settings\Towny\Application Data\Azureus\azureus.config.bak
c:\documents and settings\Towny\Application Data\Azureus\azureus.statistics
c:\documents and settings\Towny\Application Data\Azureus\azureus.statistics.bak
c:\documents and settings\Towny\Application Data\Azureus\banips.config
c:\documents and settings\Towny\Application Data\Azureus\banips.config.bak
c:\documents and settings\Towny\Application Data\Azureus\devices.config
c:\documents and settings\Towny\Application Data\Azureus\devices.config.bak
c:\documents and settings\Towny\Application Data\Azureus\dht\addresses.dat
c:\documents and settings\Towny\Application Data\Azureus\dht\block.dat
c:\documents and settings\Towny\Application Data\Azureus\dht\contacts.dat
c:\documents and settings\Towny\Application Data\Azureus\dht\diverse.dat
c:\documents and settings\Towny\Application Data\Azureus\dht\general.dat
c:\documents and settings\Towny\Application Data\Azureus\dht\version.dat
c:\documents and settings\Towny\Application Data\Azureus\downloads.config
c:\documents and settings\Towny\Application Data\Azureus\downloads.config.bak
c:\documents and settings\Towny\Application Data\Azureus\ipfilter.cache
c:\documents and settings\Towny\Application Data\Azureus\logs\alerts_1.log
c:\documents and settings\Towny\Application Data\Azureus\logs\AutoSpeed_1.log
c:\documents and settings\Towny\Application Data\Azureus\logs\AutoSpeedSearchHistory_1.log
c:\documents and settings\Towny\Application Data\Azureus\logs\clientid_1.log
c:\documents and settings\Towny\Application Data\Azureus\logs\debug_1.log
c:\documents and settings\Towny\Application Data\Azureus\logs\debug_2.log
c:\documents and settings\Towny\Application Data\Azureus\logs\Friends_1.log
c:\documents and settings\Towny\Application Data\Azureus\logs\NetStatus_1.log
c:\documents and settings\Towny\Application Data\Azureus\logs\save\1261493029593_alerts_1.log
c:\documents and settings\Towny\Application Data\Azureus\logs\save\1261493029593_AutoSpeed_1.log
c:\documents and settings\Towny\Application Data\Azureus\logs\save\1261493029593_AutoSpeedSearchHistory_1.log
c:\documents and settings\Towny\Application Data\Azureus\logs\save\1261493029593_clientid_1.log
c:\documents and settings\Towny\Application Data\Azureus\logs\save\1261493029593_debug_1.log
c:\documents and settings\Towny\Application Data\Azureus\logs\save\1261493029593_debug_2.log
c:\documents and settings\Towny\Application Data\Azureus\logs\save\1261493029593_Friends_1.log
c:\documents and settings\Towny\Application Data\Azureus\logs\save\1261493029593_NetStatus_1.log
c:\documents and settings\Towny\Application Data\Azureus\logs\save\1261493029593_seltrace_1.log
c:\documents and settings\Towny\Application Data\Azureus\logs\save\1261493029593_seltrace_2.log
c:\documents and settings\Towny\Application Data\Azureus\logs\save\1261493029593_SpeedMan_1.log
c:\documents and settings\Towny\Application Data\Azureus\logs\save\1261493029593_SpeedMan_2.log
c:\documents and settings\Towny\Application Data\Azureus\logs\save\1261493029593_thread_1.log
c:\documents and settings\Towny\Application Data\Azureus\logs\save\1261493029593_thread_2.log
c:\documents and settings\Towny\Application Data\Azureus\logs\seltrace_1.log
c:\documents and settings\Towny\Application Data\Azureus\logs\seltrace_2.log
c:\documents and settings\Towny\Application Data\Azureus\logs\SpeedMan_1.log
c:\documents and settings\Towny\Application Data\Azureus\logs\SpeedMan_2.log
c:\documents and settings\Towny\Application Data\Azureus\logs\thread_1.log
c:\documents and settings\Towny\Application Data\Azureus\logs\thread_2.log
c:\documents and settings\Towny\Application Data\Azureus\metasearch.config
c:\documents and settings\Towny\Application Data\Azureus\metasearch.config.bak
c:\documents and settings\Towny\Application Data\Azureus\net\pm_1221.dat
c:\documents and settings\Towny\Application Data\Azureus\plugins\azemp\azemp_2.2.2.jar
c:\documents and settings\Towny\Application Data\Azureus\plugins\azemp\azemp_2.2.2.zip
c:\documents and settings\Towny\Application Data\Azureus\plugins\azemp\cp1250-a.raw
c:\documents and settings\Towny\Application Data\Azureus\plugins\azemp\cp1250-b.raw
c:\documents and settings\Towny\Application Data\Azureus\plugins\azemp\font.desc
c:\documents and settings\Towny\Application Data\Azureus\plugins\azemp\osd-mplayer-a.raw
c:\documents and settings\Towny\Application Data\Azureus\plugins\azemp\osd-mplayer-b.raw
c:\documents and settings\Towny\Application Data\Azureus\plugins\azemp\plugin.properties
c:\documents and settings\Towny\Application Data\Azureus\plugins\azemp\plugin.properties_2.2.2
c:\documents and settings\Towny\Application Data\Azureus\plugins\azitunes\azitunes_0.2.3.jar
c:\documents and settings\Towny\Application Data\Azureus\plugins\azitunes\azitunes_0.2.3.zip
c:\documents and settings\Towny\Application Data\Azureus\plugins\azitunes\jacob-1.14.3-x86.dll
c:\documents and settings\Towny\Application Data\Azureus\plugins\azitunes\jacob_1.14.3.jar
c:\documents and settings\Towny\Application Data\Azureus\plugins\azitunes\libProcessAccess.dll
c:\documents and settings\Towny\Application Data\Azureus\plugins\azitunes\libProcessAccess_0.1.2.jar
c:\documents and settings\Towny\Application Data\Azureus\plugins\azitunes\plugin.properties
c:\documents and settings\Towny\Application Data\Azureus\plugins\azupnpav\azupnpav_0.2.2.jar
c:\documents and settings\Towny\Application Data\Azureus\plugins\azupnpav\azupnpav_0.2.2.zip
c:\documents and settings\Towny\Application Data\Azureus\plugins\azupnpav\azupnpav_0.2.23.jar
c:\documents and settings\Towny\Application Data\Azureus\plugins\azupnpav\azupnpav_0.2.23.zip
c:\documents and settings\Towny\Application Data\Azureus\plugins\azupnpav\cd.dat
c:\documents and settings\Towny\Application Data\Azureus\plugins\azupnpav\plugin.properties
c:\documents and settings\Towny\Application Data\Azureus\plugins\azupnpav\plugin.properties_0.2.2
c:\documents and settings\Towny\Application Data\Azureus\plugins\azupnpav\plugin.properties_0.2.23
c:\documents and settings\Towny\Application Data\Azureus\plugins\SafePeer\azureus.sig
c:\documents and settings\Towny\Application Data\Azureus\plugins\SafePeer\blocklist.cache
c:\documents and settings\Towny\Application Data\Azureus\plugins\SafePeer\blocklist.properties
c:\documents and settings\Towny\Application Data\Azureus\plugins\SafePeer\blocklist.properties_2.5.2
c:\documents and settings\Towny\Application Data\Azureus\plugins\SafePeer\blocklist.properties_2.5.3
c:\documents and settings\Towny\Application Data\Azureus\plugins\SafePeer\history.txt
c:\documents and settings\Towny\Application Data\Azureus\plugins\SafePeer\history.txt.bak
c:\documents and settings\Towny\Application Data\Azureus\plugins\SafePeer\License.txt
c:\documents and settings\Towny\Application Data\Azureus\plugins\SafePeer\License.txt.bak
c:\documents and settings\Towny\Application Data\Azureus\plugins\SafePeer\plugin.properties
c:\documents and settings\Towny\Application Data\Azureus\plugins\SafePeer\plugin.properties_2.5.2
c:\documents and settings\Towny\Application Data\Azureus\plugins\SafePeer\plugin.properties_2.5.3
c:\documents and settings\Towny\Application Data\Azureus\plugins\SafePeer\Readme.txt
c:\documents and settings\Towny\Application Data\Azureus\plugins\SafePeer\Readme.txt.bak
c:\documents and settings\Towny\Application Data\Azureus\plugins\SafePeer\safepeer.log
c:\documents and settings\Towny\Application Data\Azureus\plugins\SafePeer\safepeer.properties
c:\documents and settings\Towny\Application Data\Azureus\plugins\SafePeer\safepeer.properties_2.5.2
c:\documents and settings\Towny\Application Data\Azureus\plugins\SafePeer\safepeer.properties_2.5.3
c:\documents and settings\Towny\Application Data\Azureus\plugins\SafePeer\safepeer_2.5.1.jar
c:\documents and settings\Towny\Application Data\Azureus\plugins\SafePeer\safepeer_2.5.2.jar
c:\documents and settings\Towny\Application Data\Azureus\plugins\SafePeer\safepeer_2.5.2.zip
c:\documents and settings\Towny\Application Data\Azureus\plugins\SafePeer\safepeer_2.5.3.jar
c:\documents and settings\Towny\Application Data\Azureus\plugins\SafePeer\safepeer_2.5.3.zip
c:\documents and settings\Towny\Application Data\Azureus\plugins\vuzexcode\ffmpeg.exe
c:\documents and settings\Towny\Application Data\Azureus\plugins\vuzexcode\mediainfo.exe
c:\documents and settings\Towny\Application Data\Azureus\plugins\vuzexcode\plugin.properties
c:\documents and settings\Towny\Application Data\Azureus\plugins\vuzexcode\profiles\AppleTV.properties
c:\documents and settings\Towny\Application Data\Azureus\plugins\vuzexcode\profiles\Browser.properties
c:\documents and settings\Towny\Application Data\Azureus\plugins\vuzexcode\profiles\Generic_directTV.properties
c:\documents and settings\Towny\Application Data\Azureus\plugins\vuzexcode\profiles\Generic_mp4.properties
c:\documents and settings\Towny\Application Data\Azureus\plugins\vuzexcode\profiles\iPhone.properties
c:\documents and settings\Towny\Application Data\Azureus\plugins\vuzexcode\profiles\iPodClassic.properties
c:\documents and settings\Towny\Application Data\Azureus\plugins\vuzexcode\profiles\iPodNano.properties
c:\documents and settings\Towny\Application Data\Azureus\plugins\vuzexcode\profiles\iPodTouch.properties
c:\documents and settings\Towny\Application Data\Azureus\plugins\vuzexcode\profiles\PS3_HD.properties
c:\documents and settings\Towny\Application Data\Azureus\plugins\vuzexcode\profiles\PS3_SD.properties
c:\documents and settings\Towny\Application Data\Azureus\plugins\vuzexcode\profiles\PSP.properties
c:\documents and settings\Towny\Application Data\Azureus\plugins\vuzexcode\profiles\TiVo_HD.properties
c:\documents and settings\Towny\Application Data\Azureus\plugins\vuzexcode\profiles\Wii.properties
c:\documents and settings\Towny\Application Data\Azureus\plugins\vuzexcode\profiles\XBox_HD.properties
c:\documents and settings\Towny\Application Data\Azureus\plugins\vuzexcode\profiles\XBox_SD.properties
c:\documents and settings\Towny\Application Data\Azureus\plugins\vuzexcode\profiles\Zen.properties
c:\documents and settings\Towny\Application Data\Azureus\plugins\vuzexcode\vuzexcode_0.2.8.jar
c:\documents and settings\Towny\Application Data\Azureus\plugins\vuzexcode\vuzexcode_0.2.8.zip
c:\documents and settings\Towny\Application Data\Azureus\rcm.config
c:\documents and settings\Towny\Application Data\Azureus\rcm.config.bak
c:\documents and settings\Towny\Application Data\Azureus\sharing.config
c:\documents and settings\Towny\Application Data\Azureus\sharing.config.bak
c:\documents and settings\Towny\Application Data\Azureus\sidebarauto.config
c:\documents and settings\Towny\Application Data\Azureus\sidebarauto.config.bak
c:\documents and settings\Towny\Application Data\Azureus\subs\01FE0E4954FEEB299706.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\047969C2F30A401262F9.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\09A4EF071DB008D2F8DB.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\09B584381E122A0F9A8F.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\0B7AA1B1A96905388E00.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\0F2846CEA5CFFEE04E29.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\1292AF01EC576BC6B209.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\1424E91C3337FB72373A.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\16570E18BD2B5479BE66.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\20263AFF6B7479169648.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\21B6F154E1FA75E4DF0A.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\23C07FC046663EDB38E5.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\31B26AF592440DE3EB91.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\37B0411837DBD983FF24.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\3899974FA488B341844A.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\3DA32D36FB2EAA61106C.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\41B5BA8E964DADE2D58B.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\47CAC7EA4C11BAF87F29.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\487D201BA9D96A33DAB1.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\50C6028F71A708A70CEA.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\514B94DD522A2A5A3462.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\52C6D09A02BBB590C252.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\536F4CB239A27D371E82.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\54004C0B7ADCCE4069C9.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\549E73A5B45ABBE2B60E.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\557F00D9BA0B79559626.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\572259D3167BC2DFAD50.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\581765478D3517627C73.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\6332C699CA9E7FFEC63B.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\65CE3C46ACE1B29F7AF8.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\65D2721439934A5DC926.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\65DB7E1891D1816AB49B.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\6603A19CE0691C5F71BA.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\68461FFBE2AB011691AE.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\6B00C07C4D06687C66F4.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\6E8CF270CFD0BCDFE4A8.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\6EA3623ED0726F247A23.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\70582786F919A304079D.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\7076DB20A5F225DDB82C.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\70946FB9C49E2C811776.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\714CE71F074F375DE31E.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\7368EFA7B76C69D296AB.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\7472680B49ACBCFA19D9.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\75A8FCC5A894611AF348.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\7F49C09FFF137B0D2D98.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\829E59C40EFFE22EB406.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\848F0D2CA967AFD3F16A.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\8584DE313AF7FB03AB97.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\85B2E81E81067B022766.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\87E23B1872099785E348.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\8F567242077F9EC89CF9.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\8FEB6184D38DCE9C474F.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\92C595C3322967E8A3C0.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\AA4D459932A1C1DAD3EC.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\AC981663926ADC5268C1.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\B18DA3D9C4156FF5F2CE.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\B602FD0BF99908E447BD.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\BC4AF4CA693A0BE5F255.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\BC88508E04122E44AD51.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\BD71F2C2611E3AD7BF33.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\BE2110E05CD785E97BDD.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\BE620A5393F33B19B4C5.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\C132A5BDEB91A75822C7.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\C29BFC7BA28F09FDDCD6.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\C4A95A4889EDE5D23C97.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\C9EBC80E3E1D103634DB.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\D44784B7433BB66BE6CB.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\DBC22BE372D698FD868D.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\E473C933C6D7F615F4FB.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\E474D862A6CACCE41D82.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\E6A810C0D7599C2A37F4.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\E9194125F2C2BB52A290.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\E95A61B082892F6426E2.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\EC1EA4CD184D3EC77C1F.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\EE991DE064EFFA84D348.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\F07279E115F3777EF5CF.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\F94F6371F4A3DDF480B1.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\FA6A5CC4E12EC182B552.vuze
c:\documents and settings\Towny\Application Data\Azureus\subs\FC7E01024AA5C26512E6.vuze
c:\documents and settings\Towny\Application Data\Azureus\subscriptions.config
c:\documents and settings\Towny\Application Data\Azureus\subscriptions.config.bak
c:\documents and settings\Towny\Application Data\Azureus\tables.config
c:\documents and settings\Towny\Application Data\Azureus\tables.config.bak
c:\documents and settings\Towny\Application Data\Azureus\tmp\AZU28749.tmp
c:\documents and settings\Towny\Application Data\Azureus\tmp\AZU28776.tmp
c:\documents and settings\Towny\Application Data\Azureus\tmp\AZU28777.tmp
c:\documents and settings\Towny\Application Data\Azureus\tmp\AZU28778.tmp
c:\documents and settings\Towny\Application Data\Azureus\update.log
c:\documents and settings\Towny\Application Data\Azureus\update.properties
c:\documents and settings\Towny\Application Data\Azureus\upnp_trace1.log
c:\documents and settings\Towny\Application Data\Azureus\upnp_trace2.log
c:\documents and settings\Towny\Application Data\Azureus\VuzeActivities.config
c:\documents and settings\Towny\Application Data\Azureus\VuzeActivities.config.bak
c:\documents and settings\Towny\Application Data\LimeWire
c:\documents and settings\Towny\Application Data\LimeWire\.NetworkShare\LimeWireWin4.16.6.exe
c:\documents and settings\Towny\Application Data\LimeWire\412splashfree.png
c:\documents and settings\Towny\Application Data\LimeWire\active.mojito
c:\documents and settings\Towny\Application Data\LimeWire\browser\xul-v2.0b2.4-do-not-remove
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\AccessibleMarshal.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\chrome\branding.jar
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\chrome\branding.manifest
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\chrome\classic.jar
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\chrome\classic.manifest
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\chrome\comm.jar
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\chrome\comm.manifest
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\chrome\en-US.jar
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\chrome\en-US.manifest
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\chrome\limewire.jar
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\chrome\limewire.manifest
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\chrome\pippki.jar
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\chrome\pippki.manifest
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\chrome\toolkit.jar
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\chrome\toolkit.manifest
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\accessibility-msaa.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\accessibility.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\alerts.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\appshell.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\appshell_modal.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\appshell_modal.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\appstartup.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\auth.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\autocomplete.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\autoconfig.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\autoconfig.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\caps.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\chardet.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\chrome.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\commandhandler.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\commandlines.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\composer.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\content_base.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\content_html.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\content_htmldoc.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\content_xmldoc.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\content_xslt.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\content_xtf.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\contentprefs.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\cookie.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\directory.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\docshell_base.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\dom.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\dom_base.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\dom_canvas.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\dom_core.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\dom_css.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\dom_events.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\dom_html.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\dom_json.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\dom_loadsave.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\dom_offline.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\dom_range.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\dom_sidebar.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\dom_storage.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\dom_stylesheets.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\dom_svg.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\dom_traversal.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\dom_views.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\dom_xbl.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\dom_xpath.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\dom_xul.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\downloads.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\editor.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\embed_base.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\extensions.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\exthandler.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\exthelper.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\fastfind.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\FeedProcessor.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\feeds.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\find.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\gfx.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\htmlparser.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\imgicon.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\imglib2.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\inspector.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\intl.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\jar.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\jsconsole-clhandler.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\jsdservice.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\layout_base.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\layout_printing.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\layout_xul.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\layout_xul_tree.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\locale.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\loginmgr.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\lwbrk.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\mimetype.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\mozbrwsr.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\mozfind.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\necko.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\necko_about.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\necko_cache.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\necko_cookie.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\necko_dns.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\necko_file.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\necko_ftp.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\necko_http.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\necko_res.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\necko_socket.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\necko_strconv.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\necko_viewsource.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsAddonRepository.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsBadCertHandler.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsBlocklistService.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsContentDispatchChooser.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsContentPrefService.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsDefaultCLH.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsDictionary.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsDownloadManagerUI.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsExtensionManager.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsHandlerService.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsHelperAppDlg.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsLivemarkService.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsLoginInfo.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsLoginManager.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsLoginManagerPrompter.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsPostUpdateWin.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsProgressDialog.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsProxyAutoConfig.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsResetPref.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsTaggingService.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsTryToClose.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsUpdateService.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsURLFormatter.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsWebHandlerApp.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsXmlRpcClient.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\nsXULAppInstall.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\oji.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\parentalcontrols.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\pipboot.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\pipboot.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\pipnss.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\pipnss.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\pippki.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\pippki.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\places.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\plugin.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\pluginGlue.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\pref.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\prefetch.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\profile.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\proxyObject.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\rdf.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\satchel.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\saxparser.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\shistory.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\spellchecker.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\storage-Legacy.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\storage.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\toolkitprofile.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\transformiix.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\txEXSLTRegExFunctions.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\txmgr.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\txtsvc.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\uconv.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\unicharutil.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\universalchardet.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\update.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\uriloader.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\urlformatter.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\webBrowser_core.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\webbrowserpersist.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\webshell_idls.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\websrvcs.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\widget.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\windowds.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\windowwatcher.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\xml-rpc.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\xmlextras.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\xpcom_base.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\xpcom_components.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\xpcom_ds.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\xpcom_io.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\xpcom_system.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\xpcom_thread.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\xpcom_xpti.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\xpconnect.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\xpinstall.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\xulapp.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\xulapp_setup.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\xuldoc.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\xultmpl.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\xulutil.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\components\zipwriter.xpt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\crashreporter.exe
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\crashreporter.ini
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\defaults\autoconfig\platform.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\defaults\autoconfig\prefcalls.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\defaults\pref\xulrunner.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\defaults\profile\chrome\userChrome-example.css
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\defaults\profile\chrome\userContent-example.css
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\defaults\profile\localstore.rdf
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\defaults\profile\US\chrome\userChrome-example.css
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\defaults\profile\US\chrome\userContent-example.css
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\defaults\profile\US\localstore.rdf
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\dependentlibs.list
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\dictionaries\en-US.aff
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\dictionaries\en-US.dic
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\freebl3.chk
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\freebl3.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\greprefs\all.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\greprefs\security-prefs.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\greprefs\xpinstall.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\IA2Marshal.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\javaxpcom.jar
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\javaxpcomglue.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\js3250.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\LICENSE
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\modules\debug.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\modules\DownloadUtils.jsm
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\modules\ISO8601DateUtils.jsm
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\modules\JSON.jsm
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\modules\Microformats.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\modules\PluralForm.jsm
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\modules\utils.js
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\modules\XPCOMUtils.jsm
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\mozctl.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\mozctlx.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\MSVCP71.DLL
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\msvcr71.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\nspr4.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\nss3.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\nssckbi.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\nssdbm3.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\nssutil3.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\platform.ini
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\plc4.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\plds4.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\plugins\npnul32.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\README.txt
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\arrow.gif
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\arrowd.gif
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\broken-image.gif
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\charsetalias.properties
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\charsetData.properties
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\contenteditable.css
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\designmode.css
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\dtd\mathml.dtd
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\dtd\xhtml11.dtd
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\EditorOverride.css
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\entityTables\html40Latin1.properties
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\entityTables\html40Special.properties
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\entityTables\html40Symbols.properties
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\entityTables\htmlEntityVersions.properties
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\entityTables\mathml20.properties
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\entityTables\transliterate.properties
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfont.properties
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontStandardSymbolsL.properties
end part 1 of 2

louise townsend
Novice
Novice

Status :
Online
Offline

Posts : 10
Joined : 2010-01-05
Gender : Female
OS : xp professional
Points : 25368
# Likes : 0

View user profile

Back to top Go down

Re: 32win/nuqel.e & bankerfox.a

Post by louise townsend on Thu Jan 07, 2010 12:16 am

PART 2 of 2

c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontSTIXNonUnicode.properties
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontSTIXSize1.properties
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontSymbol.properties
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontUnicode.properties
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\forms.css
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\grabber.gif
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\hiddenWindow.html
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\html.css
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\html\folder.png
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\langGroups.properties
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\language.properties
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\loading-image.gif
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\mathml.css
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\quirk.css
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\svg.css
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\table-add-column-after-active.gif
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\table-add-column-after-hover.gif
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\table-add-column-after.gif
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\table-add-column-before-active.gif
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\table-add-column-before-hover.gif
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\table-add-column-before.gif
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\table-add-row-after-active.gif
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\table-add-row-after-hover.gif
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\table-add-row-after.gif
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\table-add-row-before-active.gif
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\table-add-row-before-hover.gif
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\table-add-row-before.gif
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\table-remove-column-active.gif
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\table-remove-column-hover.gif
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\table-remove-column.gif
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\table-remove-row-active.gif
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\table-remove-row-hover.gif
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\table-remove-row.gif
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\ua.css
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\viewsource.css
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\res\wincharset.properties
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\smime3.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\softokn3.chk
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\softokn3.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\sqlite3.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\ssl3.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\updater.exe
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\version.properties
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\xpcom.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\xpcshell.exe
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\xpicleanup.exe
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\xpidl.exe
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\xpt_dump.exe
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\xpt_link.exe
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\xul.dll
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\xulrunner-stub.exe
c:\documents and settings\Towny\Application Data\LimeWire\browser\xulrunner\xulrunner.exe
c:\documents and settings\Towny\Application Data\LimeWire\certificate\limewire.keystore
c:\documents and settings\Towny\Application Data\LimeWire\createtimes.cache
c:\documents and settings\Towny\Application Data\LimeWire\data.ser
c:\documents and settings\Towny\Application Data\LimeWire\downloads.dat
c:\documents and settings\Towny\Application Data\LimeWire\fileurns.cache
c:\documents and settings\Towny\Application Data\LimeWire\filters.props
c:\documents and settings\Towny\Application Data\LimeWire\gnutella.net
c:\documents and settings\Towny\Application Data\LimeWire\installation.props
c:\documents and settings\Towny\Application Data\LimeWire\library.dat
c:\documents and settings\Towny\Application Data\LimeWire\library5.dat
c:\documents and settings\Towny\Application Data\LimeWire\limewire.props
c:\documents and settings\Towny\Application Data\LimeWire\lock
c:\documents and settings\Towny\Application Data\LimeWire\mojito.props
c:\documents and settings\Towny\Application Data\LimeWire\mozilla-profile\.autoreg
c:\documents and settings\Towny\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_001_
c:\documents and settings\Towny\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_002_
c:\documents and settings\Towny\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_003_
c:\documents and settings\Towny\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_MAP_
c:\documents and settings\Towny\Application Data\LimeWire\mozilla-profile\Cache\AE98BDF4d01
c:\documents and settings\Towny\Application Data\LimeWire\mozilla-profile\cert8.db
c:\documents and settings\Towny\Application Data\LimeWire\mozilla-profile\compreg.dat
c:\documents and settings\Towny\Application Data\LimeWire\mozilla-profile\cookies.sqlite
c:\documents and settings\Towny\Application Data\LimeWire\mozilla-profile\downloads.sqlite
c:\documents and settings\Towny\Application Data\LimeWire\mozilla-profile\extensions.cache
c:\documents and settings\Towny\Application Data\LimeWire\mozilla-profile\extensions.ini
c:\documents and settings\Towny\Application Data\LimeWire\mozilla-profile\history.dat
c:\documents and settings\Towny\Application Data\LimeWire\mozilla-profile\key3.db
c:\documents and settings\Towny\Application Data\LimeWire\mozilla-profile\permissions.sqlite
c:\documents and settings\Towny\Application Data\LimeWire\mozilla-profile\places.sqlite-journal
c:\documents and settings\Towny\Application Data\LimeWire\mozilla-profile\places.sqlite
c:\documents and settings\Towny\Application Data\LimeWire\mozilla-profile\pluginreg.dat
c:\documents and settings\Towny\Application Data\LimeWire\mozilla-profile\prefs.js
c:\documents and settings\Towny\Application Data\LimeWire\mozilla-profile\secmod.db
c:\documents and settings\Towny\Application Data\LimeWire\mozilla-profile\XPC.mfl
c:\documents and settings\Towny\Application Data\LimeWire\mozilla-profile\xpti.dat
c:\documents and settings\Towny\Application Data\LimeWire\player.props
c:\documents and settings\Towny\Application Data\LimeWire\promotion\promodb.backup
c:\documents and settings\Towny\Application Data\LimeWire\promotion\promodb.data
c:\documents and settings\Towny\Application Data\LimeWire\promotion\promodb.lck
c:\documents and settings\Towny\Application Data\LimeWire\promotion\promodb.properties
c:\documents and settings\Towny\Application Data\LimeWire\promotion\promodb.script
c:\documents and settings\Towny\Application Data\LimeWire\pub1.key
c:\documents and settings\Towny\Application Data\LimeWire\public.key
c:\documents and settings\Towny\Application Data\LimeWire\questions.props
c:\documents and settings\Towny\Application Data\LimeWire\responses.cache
c:\documents and settings\Towny\Application Data\LimeWire\secureMessage.key
c:\documents and settings\Towny\Application Data\LimeWire\simpp.xml
c:\documents and settings\Towny\Application Data\LimeWire\spam.dat
c:\documents and settings\Towny\Application Data\LimeWire\tables.props
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme.lwtp
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\01_star.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\02_star.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\03_star.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\04_star.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\05_star.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\chat.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\dir_closed.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\dir_open.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\forward_dn.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\forward_up.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\kill.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\kill_on.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\lime.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\logo.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\notsearching.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\pause_dn.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\pause_up.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\play_dn.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\play_up.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\question.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\rewind_dn.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\rewind_up.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\searching.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\splash.png
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\splashpro.png
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\stop_dn.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\stop_up.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\theme.txt
c:\documents and settings\Towny\Application Data\LimeWire\themes\black_theme\warning.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme.lwtp
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\01_star.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\02_star.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\03_star.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\04_star.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\05_star.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\chat.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\dir_closed.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\dir_open.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\forward_dn.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\forward_up.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\kill.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\logo.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\notsearching.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\pause_dn.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\pause_up.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\play_dn.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\play_up.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\question.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\rewind_dn.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\rewind_up.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\search.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\searching.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\splash.png
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\splashpro.png
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\stop_dn.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\stop_up.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\theme.txt
c:\documents and settings\Towny\Application Data\LimeWire\themes\classic_theme\warning.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme.lwtp
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\01_star.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\02_star.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\03_star.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\04_star.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\05_star.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\chat.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\dir_closed.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\dir_open.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\forward_dn.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\forward_up.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\kill.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\kill_on.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\lime.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\logo.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\notsearching.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\pause_dn.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\pause_up.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\play_dn.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\play_up.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\question.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\rewind_dn.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\rewind_up.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\searching.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\splash.png
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\splashpro.png
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\stop_dn.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\stop_up.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\theme.txt
c:\documents and settings\Towny\Application Data\LimeWire\themes\limewire_theme\warning.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme.lwtp
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\01_star.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\02_star.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\03_star.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\04_star.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\05_star.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\chat.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\forward_dn.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\forward_up.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\kill.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\kill_on.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\logo.png
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\notsearching.png
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\pause_dn.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\pause_up.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\play_dn.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\play_up.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\question.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\rewind_dn.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\rewind_up.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\searching.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\splash.png
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\splashpro.png
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\stop_dn.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\stop_up.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\theme.txt
c:\documents and settings\Towny\Application Data\LimeWire\themes\other_theme\warning.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme.lwtp
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\01_star.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\02_star.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\03_star.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\04_star.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\05_star.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\chat.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\forward_dn.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\forward_up.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\kill.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\kill_on.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\logo.png
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\notsearching.png
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\pause_dn.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\pause_up.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\play_dn.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\play_up.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\question.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\rewind_dn.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\rewind_up.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\searching.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\splash.png
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\splashpro.png
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\stop_dn.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\stop_up.gif
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\theme.txt
c:\documents and settings\Towny\Application Data\LimeWire\themes\windows_theme\warning.gif
c:\documents and settings\Towny\Application Data\LimeWire\ttdata.cache
c:\documents and settings\Towny\Application Data\LimeWire\ttree.cache
c:\documents and settings\Towny\Application Data\LimeWire\ttroot.cache
c:\documents and settings\Towny\Application Data\LimeWire\update.xml
c:\documents and settings\Towny\Application Data\LimeWire\version.key
c:\documents and settings\Towny\Application Data\LimeWire\version.xml
c:\documents and settings\Towny\Application Data\LimeWire\versions.props
c:\documents and settings\Towny\Application Data\LimeWire\xml\data\audio.sxml3
c:\documents and settings\Towny\Application Data\LimeWire\xml\data\delete_me
c:\documents and settings\Towny\Application Data\LimeWire\xml\data\video.sxml3
c:\documents and settings\Towny\Application Data\LimeWire\xml\misc\application.gif
c:\documents and settings\Towny\Application Data\LimeWire\xml\misc\audio.gif
c:\documents and settings\Towny\Application Data\LimeWire\xml\misc\document.gif
c:\documents and settings\Towny\Application Data\LimeWire\xml\misc\image.gif
c:\documents and settings\Towny\Application Data\LimeWire\xml\misc\video.gif
c:\documents and settings\Towny\Application Data\LimeWire\xml\schemas\application.xsd
c:\documents and settings\Towny\Application Data\LimeWire\xml\schemas\audio.xsd
c:\documents and settings\Towny\Application Data\LimeWire\xml\schemas\document.xsd
c:\documents and settings\Towny\Application Data\LimeWire\xml\schemas\image.xsd
c:\documents and settings\Towny\Application Data\LimeWire\xml\schemas\video.xsd
c:\program files\Azureus
c:\program files\Azureus\aereg.dll
c:\program files\Azureus\Azureus.exe
c:\program files\Azureus\Azureus.exe.manifest
c:\program files\Azureus\Azureus2.jar
c:\program files\Azureus\AzureusUpdater.exe
c:\program files\Azureus\msvcr71.dll
c:\program files\Azureus\plugins\azplugins\azplugins_2.1.4.jar
c:\program files\Azureus\plugins\azrating\azrating_1.3.1.jar
c:\program files\Azureus\plugins\azupdater\azupdater_1.8.8.zip
c:\program files\Azureus\plugins\azupdater\azupdaterpatcher_1.8.3.jar
c:\program files\Azureus\plugins\azupdater\azupdaterpatcher_1.8.8.jar
c:\program files\Azureus\plugins\azupdater\plugin.properties
c:\program files\Azureus\plugins\azupdater\plugin.properties_1.8.8
c:\program files\Azureus\plugins\azupdater\Updater.jar
c:\program files\Azureus\plugins\azupdater\Updater.jar.bak
c:\program files\Azureus\plugins\rssfeed\ChangeLog.txt
c:\program files\Azureus\plugins\rssfeed\ChangeLog.txt.bak
c:\program files\Azureus\plugins\rssfeed\license.txt
c:\program files\Azureus\plugins\rssfeed\license.txt.bak
c:\program files\Azureus\plugins\rssfeed\plugin.properties
c:\program files\Azureus\plugins\rssfeed\plugin.properties_1.3.5
c:\program files\Azureus\plugins\rssfeed\rssfeed.options
c:\program files\Azureus\plugins\rssfeed\rssfeed_1.3.4.jar
c:\program files\Azureus\plugins\rssfeed\rssfeed_1.3.4.zip
c:\program files\Azureus\plugins\rssfeed\rssfeed_1.3.5.jar
c:\program files\Azureus\plugins\rssfeed\rssfeed_1.3.5.zip
c:\program files\Azureus\swt-awt-win32-3318.dll
c:\program files\Azureus\swt-gdip-win32-3318.dll
c:\program files\Azureus\swt-wgl-win32-3318.dll
c:\program files\Azureus\swt-win32-3318.dll
c:\program files\Azureus\swt.jar
c:\program files\Azureus\uninstall.exe
c:\program files\LimeWire
c:\program files\LimeWire\hs_err_pid2444.log
c:\program files\LimeWire\hs_err_pid2752.log
c:\program files\LimeWire\hs_err_pid3488.log
c:\windows\Ydahegohewa.bin

.
((((((((((((((((((((((((( Files Created from 2009-12-07 to 2010-01-07 )))))))))))))))))))))))))))))))
.

2010-01-05 23:59 . 2010-01-05 05:27 3776280 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\setup.exe
2010-01-05 23:59 . 2010-01-05 05:27 4043032 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgui.exe
2010-01-05 23:59 . 2010-01-05 05:27 2033432 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtray.exe
2010-01-05 23:59 . 2010-01-05 05:27 3967256 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll
2010-01-05 23:59 . 2010-01-05 05:27 2352920 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgresf.dll
2010-01-05 23:59 . 2010-01-05 05:27 916248 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcfgx.dll
2010-01-05 22:27 . 2010-01-05 22:27 -------- d-----w- c:\documents and settings\Towny\Application Data\Malwarebytes
2010-01-05 22:27 . 2009-12-30 06:55 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-05 22:27 . 2010-01-05 22:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-05 22:27 . 2009-12-30 06:54 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-05 22:27 . 2010-01-05 22:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-05 22:20 . 2010-01-05 22:20 0 ----a-w- c:\windows\nsreg.dat
2010-01-05 22:20 . 2010-01-05 22:20 -------- d-----w- c:\documents and settings\Towny\Local Settings\Application Data\Mozilla
2010-01-05 05:27 . 2010-01-05 05:27 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-01-05 05:27 . 2010-01-05 05:27 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2010-01-05 05:27 . 2010-01-05 05:27 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-01-05 05:27 . 2010-01-05 05:27 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-01-05 05:27 . 2010-01-06 23:03 -------- d-----w- c:\windows\system32\drivers\Avg
2010-01-05 05:27 . 2010-01-05 05:27 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-12-20 04:38 . 2009-12-20 04:38 -------- d-----w- c:\documents and settings\Towny\Application Data\Big Fish Games
2009-12-17 08:44 . 2009-12-17 08:45 -------- d-----w- c:\program files\Common Files\DivX Shared

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-05 22:16 . 2008-04-28 09:54 -------- d-----w- c:\documents and settings\Towny\Application Data\U3
2010-01-05 10:09 . 2007-07-19 04:28 -------- d-----w- c:\program files\Trend Micro
2010-01-05 05:27 . 2009-11-18 02:18 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2009-12-27 10:44 . 2009-02-13 14:19 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-12-24 17:13 . 2009-09-17 12:15 -------- d-----w- c:\documents and settings\Towny\Application Data\vlc
2009-12-17 08:45 . 2007-07-25 04:26 -------- d-----w- c:\program files\DivX
2009-11-18 03:06 . 2009-11-18 03:06 -------- d-----w- c:\program files\DVD Decrypter
2009-11-18 03:06 . 2009-11-16 06:03 -------- d-----w- c:\program files\coolpro2
2009-11-18 03:01 . 2009-11-16 05:34 120 ----a-w- c:\windows\Lcecumecahale.dat
2009-11-18 02:18 . 2008-07-18 13:02 -------- d-----w- c:\program files\AVG
2009-11-16 06:04 . 2009-11-16 06:04 -------- d-----w- c:\documents and settings\Towny\Application Data\Syntrillium
2009-11-14 00:47 . 2009-11-14 00:47 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-11-14 00:47 . 2009-11-14 00:47 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-11-14 00:47 . 2009-11-14 00:47 856064 ----a-w- c:\windows\system32\divx_xx07.dll
2009-11-14 00:47 . 2009-11-14 00:47 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-11-14 00:47 . 2009-11-14 00:47 843776 ----a-w- c:\windows\system32\divx_xx16.dll
2009-11-14 00:47 . 2009-11-14 00:47 839680 ----a-w- c:\windows\system32\divx_xx11.dll
2009-11-14 00:47 . 2009-11-14 00:47 696320 ----a-w- c:\windows\system32\DivX.dll
2009-11-11 07:29 . 2009-11-11 07:29 30704 ---ha-w- c:\windows\system32\mlfcache.dat
2009-10-29 07:46 . 2001-08-23 12:00 832512 ------w- c:\windows\system32\wininet.dll
2009-10-29 07:46 . 2007-04-12 10:44 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:46 . 2001-08-23 12:00 17408 ------w- c:\windows\system32\corpol.dll
2009-10-21 05:38 . 2007-04-12 10:44 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-21 05:38 . 2007-04-12 10:44 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-20 16:20 . 2007-04-12 10:44 265728 ------w- c:\windows\system32\drivers\http.sys
2009-10-13 10:30 . 2001-08-23 12:00 270336 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2001-08-23 12:00 149504 ----a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2001-08-23 12:00 79872 ----a-w- c:\windows\system32\raschap.dll
2006-08-28 08:55 . 2006-08-28 08:55 36155 -c--a-w- c:\program files\db_pcc.dat
2006-08-25 03:33 . 2006-08-25 03:33 3870719 ----a-w- c:\program files\pcc.exe
2006-08-25 03:33 . 2006-08-25 03:33 3584 ----a-w- c:\program files\1033.mst
2006-08-25 03:33 . 2006-08-25 03:33 2487652 -c--a-w- c:\program files\tmpcc.msi
2006-08-25 02:57 . 2006-08-25 02:57 218 ----a-w- c:\program files\setup.ini
2006-08-21 08:21 . 2006-08-21 08:21 126228 -c--a-w- c:\program files\license.rtf
2006-08-18 06:08 . 2006-08-18 06:08 7952384 -c--a-w- c:\program files\TMASOEDL.msi
2006-08-18 06:08 . 2006-08-18 06:08 7378944 -c--a-w- c:\program files\TMASOLDL.msi
2006-01-13 03:33 . 2006-01-13 03:33 64 -c--a-w- c:\program files\Tmsrl.dat
.

((((((((((((((((((((((((((((( [You must be registered and logged in to see this link.] )))))))))))))))))))))))))))))))))))))))))
.
- 2001-08-23 12:00 . 2010-01-05 23:13 71264 c:\windows\system32\perfc009.dat
+ 2001-08-23 12:00 . 2010-01-06 22:27 71264 c:\windows\system32\perfc009.dat
+ 2001-08-23 12:00 . 2010-01-06 22:27 441454 c:\windows\system32\perfh009.dat
- 2001-08-23 12:00 . 2010-01-05 23:13 441454 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-10 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-11 7630848]
"FileBackup"="c:\program files\Opti\OTB\OTB.exe" [2007-01-10 1060864]
"PCLEPCI"="c:\progra~1\Pinnacle\PPE\PPE.EXE" [2004-08-30 36864]
"NSLauncher"="c:\program files\Nokia\Nokia Software Launcher\NSLauncher.exe" [2006-11-27 2658304]
"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-22 483328]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-04 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-01-05 2033432]

c:\documents and settings\Towny\Start Menu\Programs\Startup\
Picture Motion Browser Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2007-6-6 368640]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [2008-7-24 25214]
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-7-26 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-01-05 05:27 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk
backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Towny^Start Menu^Programs^Startup^Picture Motion Browser Media Check Tool.lnk]
path=c:\documents and settings\Towny\Start Menu\Programs\Startup\Picture Motion Browser Media Check Tool.lnk
backup=c:\windows\pss\Picture Motion Browser Media Check Tool.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2006-06-12 21:20 127036 ----a-w- c:\windows\system32\DLA\DLACTRLW.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\emMON]
2006-05-30 13:24 61440 ----a-w- c:\windows\emMON.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2006-02-18 18:41 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-09-21 08:36 305440 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JMB36X Configure]
2006-06-02 08:45 385024 ------r- c:\windows\system32\JMRaidTool.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2006-08-11 13:43 7630848 ----a-w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2006-08-11 13:43 86016 ----a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2006-08-11 13:43 1519616 ----a-w- c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck]
2003-11-10 09:06 406016 ------w- c:\windows\system32\PSDrvCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-04 17:54 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]
2006-04-10 01:19 729088 ----a-w- c:\program files\Analog Devices\SoundMAX\SMax4.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
2006-05-01 10:07 843776 ----a-r- c:\program files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"c:\\Program Files\\Asus\\AsusUpdate\\Update.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [1/5/2010 1:27 PM 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [1/5/2010 1:27 PM 360584]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [1/5/2010 1:27 PM 285392]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;c:\windows\system32\drivers\atl01_xp.sys [4/12/2007 7:14 PM 34944]
R3 BENDER;Pinnacle DV/AV Capture;c:\windows\system32\drivers\bender.sys [11/21/2006 1:34 PM 200320]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [5/19/2008 9:43 PM 138112]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [5/19/2008 9:43 PM 8320]
.
Contents of the 'Scheduled Tasks' folder

2010-01-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 04:34]

2010-01-06 c:\windows\Tasks\SDMsgUpdate (TE).job
- e:\applic~1\SMARTD~1\Messages\SDNotify.exe [2008-02-22 23:53]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride =
uSearchAssistant = [You must be registered and logged in to see this link.]
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: {A0F1C92D-32A9-44B1-9E59-3E722AF7B4DC} = 192.168.0.1
FF - ProfilePath - c:\documents and settings\Towny\Application Data\Mozilla\Firefox\Profiles\hjxwd3om.default\
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - hȋdden: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre1.6.0_01\bin\jusched.exe
AddRemove-Azureus - c:\program files\Azureus\Uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2010-01-07 08:05
Windows 5.1.2600 Service Pack 3 NTFS

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************
.
Completion time: 2010-01-07 08:07:29
ComboFix-quarantined-files.txt 2010-01-07 00:07
ComboFix2.txt 2010-01-06 03:34

Pre-Run: 97,130,766,336 bytes free
Post-Run: 97,058,820,096 bytes free

- - End Of File - - 235B919D08838F6C4FDFB0916F6B18F3

louise townsend
Novice
Novice

Status :
Online
Offline

Posts : 10
Joined : 2010-01-05
Gender : Female
OS : xp professional
Points : 25368
# Likes : 0

View user profile

Back to top Go down

Re: 32win/nuqel.e & bankerfox.a

Post by Belahzur on Thu Jan 07, 2010 12:18 am

Hello.

Updating Java:

  • Download the latest version of [You must be registered and logged in to see this link.].
  • Select the second option where it says "This special release provides a few key fixes.".
  • Click the "Download" button to the right.
  • In the Window that opens, select your platform, check the "agree" box, and click Continue.
  • Click on the link to download Windows Offline Installation and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Then from your desktop double-click on jre-6u17-windows-i586.exe that you downloaded to install the newest version.

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /uninstall

This will also reset your restore points.

How is the machine running now?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre
Points : 245029
# Likes : 1

View user profile

Back to top Go down

Re: 32win/nuqel.e & bankerfox.a

Post by louise townsend on Thu Jan 07, 2010 2:37 am

Helloooo and thank you,

Working better than before!

I'm so impressed, you were all over it like a fat chick on a cupcake! You can consider me a fan.

FYI - I live in an extremely remote town (1300km to any PCHelp). I've gladly made a donation - make sure you get a cuppa coffee out of it. Smile

Love your site,
Love your ethics, but mostly,
Love your work.


Thanks again,
Lou.

louise townsend
Novice
Novice

Status :
Online
Offline

Posts : 10
Joined : 2010-01-05
Gender : Female
OS : xp professional
Points : 25368
# Likes : 0

View user profile

Back to top Go down

Re: 32win/nuqel.e & bankerfox.a

Post by Belahzur on Thu Jan 07, 2010 2:01 pm

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers. Goofy

1) Please navigate to [You must be registered and logged in to see this link.] and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

[You must be registered and logged in to see this link.]
A tutorial on using Ad-Aware to remove spyware from your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using Spybot to remove spyware from your computer may be found [You must be registered and logged in to see this link.]. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

[You must be registered and logged in to see this link.]
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found [You must be registered and logged in to see this link.].

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
[You must be registered and logged in to see this link.]
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
[You must be registered and logged in to see this link.]

5) Finally, consider maintaining a firewall. Some good free firewalls are [You must be registered and logged in to see this link.], or
[You must be registered and logged in to see this link.]
A tutorial on understanding and using firewalls may be found [You must be registered and logged in to see this link.].

Please also read Tony Klein's excellent article: [You must be registered and logged in to see this link.]

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found [You must be registered and logged in to see this link.].

Hopefully this should take care of your problems! Good luck. Big Grin


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre
Points : 245029
# Likes : 1

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum