Apropos, Sluggish Computer and Internet

christianb · 10-09-2005, 12:19 AM

Hi there,

I have had trouble with my computer for about a week now. Microsoft's anti-spyware keeps detecting and trying to remove 'Apropos Media Browser Modifier.' I have been following the other threads on this, and have tried to replicate the fix, with no success. I even tried running the FixARP.zip batch file. Please help!

Here is my HijackThis log:

Thanks,
christianb

< ---------- log start--------------->
Logfile of HijackThis v1.99.1
Scan saved at 11:15:03 PM, on 10/8/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Genny\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1125981702537
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

< ---------- end log --------------->

sUBs · 10-09-2005, 02:25 AM

Please do not simply download & run the FixARP file.
It is a customised file for individual cases.
The files/folders that it deletes are irreversible.

Please download - FindAP.zip

**IMPORTANT - extract/unzip the contents to a folder of it's own **

From within that folder, double-click on FindAP.bat
It will produce a log for you to post back to me.

Next, download RootKitRevealer.zip
Unzip it to the desktop, run it, and click Scan. This will generate a log file.
Please post the entire contents of the log file in your next reply.

If the file is too big, place it as an attachment instead.

christianb · 10-09-2005, 08:37 AM

Here is the log from the FindAP.bat step. Will post the RootKitRevealer.zip log shortly.

Running from directory:
C:\FindAP
~~~~~~
Registry entries found:

[HKEY_LOCAL_MACHINE\Software\Aprps]

[HKEY_LOCAL_MACHINE\Software\Aprps\Client]
"PartnerId"="WB.VER2"

~~~~~~

sUBs · 10-09-2005, 09:34 AM

Please post the RootkitRevealer's log when it's ready

christianb · 10-09-2005, 12:46 PM

I've been running the RootkitRealer since 7:30am (it is now 11:45am); is it normal for it to take this long? It is currently scanning c:\windows\$ntservicepackninstall$.

Thanks!

sUBs · 10-09-2005, 12:50 PM

Keep it running. Norton antivirus may be disrupting it.

Unplug/disconnect yourself from the internet & disable Norton Antivirus. You can re-enable it when it's finished.

christianb · 10-09-2005, 01:02 PM

Two very suspicious processes are taking up a lot of CPU cycles. Specifically "TXLMVA.exe" and "System" (system does not have a .exe at the end).

Also, I did turn off realtime Norton protection and unplugged the internet connection (posting from my work machine).

I'll post the RootRevealerKit log as soon as it is done.

sUBs · 10-09-2005, 01:09 PM

System is a Windows process.
I suspect the other process to be the RootKitRevealer itself. It does have a habit of naming itself randomly.

christianb · 10-09-2005, 05:01 PM

The rootkit crashed. After rerunning it, it very quickly came up with this log:

RootkitReveal lot
---------------------------------------

HKLM\SOFTWARE\C7XREA34eSn5 10/8/2005 9:29 PM 0 bytes Hidden from Windows API.
HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed 10/9/2005 3:47 PM 80 bytes Data mismatch between Windows API and raw hive data.
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_VGASAVE 9/2/2005 8:53 AM 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_VGAUPS 10/1/2005 10:44 AM 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Services\VgaUPS 10/9/2005 3:37 PM 0 bytes Hidden from Windows API.
C:\Program Files\Hp media 10/9/2005 12:00 AM 0 bytes Hidden from Windows API.
C:\Program Files\Hp media\ace.dll 10/1/2005 10:44 AM 568.00 KB Hidden from Windows API.
C:\Program Files\Hp media\AI_03-10-2005.log 10/3/2005 2:14 AM 3 bytes Hidden from Windows API.
C:\Program Files\Hp media\AI_04-10-2005.log 10/4/2005 12:37 AM 3 bytes Hidden from Windows API.
C:\Program Files\Hp media\AI_05-10-2005.log 10/5/2005 7:51 AM 3 bytes Hidden from Windows API.
C:\Program Files\Hp media\AI_06-10-2005.log 10/6/2005 8:29 PM 3 bytes Hidden from Windows API.
C:\Program Files\Hp media\AI_07-10-2005.log 10/7/2005 12:08 AM 3 bytes Hidden from Windows API.
C:\Program Files\Hp media\AI_08-10-2005.log 10/8/2005 2:16 AM 3 bytes Hidden from Windows API.
C:\Program Files\Hp media\AI_09-10-2005.log 10/9/2005 12:00 AM 3 bytes Hidden from Windows API.
C:\Program Files\Hp media\atl.dll 10/1/2005 10:44 AM 73.06 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache 10/6/2005 11:12 PM 0 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000029_433f5f76_000b71b0 10/1/2005 9:22 PM 30.21 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000029_433f6def_000baeb9 10/1/2005 10:19 PM 71.55 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000029_4343e8a6_0004c4b4 10/5/2005 7:52 AM 36 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000029_4346167b_000a037a 10/6/2005 11:32 PM 266.10 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000099_43445cf4_000af79e 10/5/2005 4:08 PM 134.24 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000120_433f6126_000aba95 10/1/2005 9:25 PM 606.41 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000120_434461b0_000dd40a 10/5/2005 4:28 PM 27.06 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000124_433eceec_00098968 10/1/2005 11:01 AM 27.88 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000124_433f6082_0007de29 10/6/2005 11:31 PM 174.78 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000012c_4340baee_0006acfc 10/2/2005 10:00 PM 3.27 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000012f_4340c204_000487ab 10/2/2005 10:30 PM 29.03 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000014f_4340bc99_00003d09 10/2/2005 10:07 PM 8.08 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000001d3_43401211_0006acfc 10/2/2005 10:00 AM 66.65 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000001e1_434045a0_000c65d4 10/2/2005 1:40 PM 569 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000001eb_43441448_00094c5f 10/5/2005 10:58 AM 36 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000001eb_434614b7_000e1113 10/6/2005 11:24 PM 66.52 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000030a_43420c80_000f35d6 10/3/2005 10:00 PM 332 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000384_433f6c28_000d1cef 10/1/2005 10:42 PM 2.67 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000384_43400f13_00094c5f 10/2/2005 9:47 AM 187.86 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000384_43432693_0005cd5a 10/4/2005 6:04 PM 12.48 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000003f9_4340bc70_0005b8d8 10/2/2005 10:06 PM 82.51 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000047e_433f7417_0000f424 10/1/2005 10:45 PM 4.37 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000047e_43400a90_0006ea05 10/2/2005 9:28 AM 127.88 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000633_4340358c_000c28cb 10/2/2005 12:31 PM 134.45 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000677_43432693_000a17fc 10/4/2005 6:04 PM 5.02 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000732_4340053b_0004c4b4 10/2/2005 9:05 AM 58.39 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000007c9_4340bad0_0003567e 10/2/2005 10:00 PM 46.08 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000007cf_43401200_00098968 10/2/2005 9:59 AM 70.64 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000084d_43405979_00007a12 10/2/2005 3:04 PM 53.88 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000871_434045a4_000e8b25 10/2/2005 1:40 PM 8.32 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000878_4340464d_00007a12 10/2/2005 1:42 PM 604 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000008af_4340b96a_0003d090 10/2/2005 9:54 PM 4.71 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000902_433f65af_00022551 10/1/2005 9:44 PM 78.59 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000902_433f73ef_00016e36 10/3/2005 10:07 PM 37.42 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000914_4340aeb2_00016e36 10/2/2005 9:08 PM 124.11 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000093b_4340c18e_00066ff3 10/3/2005 10:01 PM 298.77 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000940_4340454a_0006acfc 10/2/2005 1:38 PM 12.77 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000009ce_43404515_00000000 10/2/2005 1:37 PM 8.94 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000a1d_4340bc97_0000f424 10/2/2005 10:07 PM 1.29 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000a28_43404512_0003567e 10/2/2005 1:37 PM 72.03 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000a28_43437745_00008e94 10/4/2005 11:48 PM 36 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000a41_434058c0_0002625a 10/2/2005 3:01 PM 57.34 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000a41_43405b2a_00031975 10/2/2005 3:11 PM 42.72 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000a4a_43437699_000c7a56 10/4/2005 11:45 PM 17.23 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000bb3_43400168_0008d24d 10/4/2005 11:46 PM 21.82 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000bb3_4344144e_0004c4b4 10/5/2005 10:58 AM 608.76 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000bb3_434614c6_0004c4b4 10/6/2005 11:25 PM 57.45 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000bdb_433f6122_000e8b25 10/5/2005 10:58 AM 391.19 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000c15_4340358a_00016e36 10/2/2005 12:31 PM 55.45 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000c15_434350af_0001bfc1 10/4/2005 9:03 PM 16.50 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000d66_433f7420_000ca2dd 10/1/2005 10:46 PM 81.13 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000d66_4343268e_00055348 10/4/2005 6:16 PM 914 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000ddc_433f6487_0000f424 10/2/2005 9:54 PM 78.92 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000de5_43404508_000f0537 10/2/2005 1:37 PM 4.73 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000de5_434376c6_00055348 10/4/2005 11:46 PM 17.27 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000e12_434326a0_0005cd5a 10/4/2005 6:04 PM 1.07 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000e29_43404651_0008d24d 10/2/2005 1:42 PM 16.16 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000ea9_4340455a_00053ec6 10/2/2005 1:38 PM 0 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000ecc_43401207_000d1cef 10/2/2005 10:00 AM 95.81 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000ef5_4340bcb4_00089544 10/2/2005 10:08 PM 0 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000fbf_433f7416_000632ea 10/1/2005 10:45 PM 1.92 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000fc9_43400fa2_00076417 10/2/2005 9:49 AM 70.59 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00000fc9_434326a0_0002b3e5 10/4/2005 6:04 PM 604 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001030_434045a0_000ec82e 10/2/2005 1:40 PM 28.94 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001049_4340452a_0000b71b 10/2/2005 1:38 PM 13.50 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000010d9_43404591_000ca2dd 10/2/2005 1:39 PM 539 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000010d9_4340459d_0009c671 10/2/2005 1:39 PM 8.96 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000113e_4340465a_000a4083 10/2/2005 1:43 PM 35.55 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000117a_4340464c_000a7d8c 10/2/2005 1:42 PM 23.45 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000011f4_43432900_00060a63 10/4/2005 6:14 PM 3.08 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001238_433ed066_0001312d 10/1/2005 11:07 AM 7 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001238_43445fb5_00098968 10/5/2005 4:20 PM 23.69 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001243_4340b969_000c28cb 10/2/2005 9:54 PM 1.30 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000127e_434011fa_0004c4b4 10/2/2005 10:00 AM 122.72 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000127e_4343290c_00077899 10/4/2005 6:14 PM 3.23 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001295_43405ab6_000d9701 10/2/2005 3:09 PM 52.69 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000012db_4341d942_0000b71b 10/3/2005 6:22 PM 213.15 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000012db_43445ba8_000e4e1c 10/5/2005 4:03 PM 420.84 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000012db_434614f4_0007de29 10/6/2005 11:25 PM 52.34 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000139d_43400983_00066ff3 10/2/2005 9:23 AM 136.12 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000013f4_4340aeb4_000baeb9 10/2/2005 9:08 PM 210.86 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000013f5_43405ae8_000ca2dd 10/2/2005 3:10 PM 57.26 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001481_43432984_000c3d4d 10/4/2005 6:16 PM 30.71 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000153c_433f5fc5_0003d090 10/1/2005 9:19 PM 224.41 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000153c_4341d945_000487ab 10/3/2005 6:22 PM 186.13 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000153c_43445ce2_0002625a 10/5/2005 4:08 PM 115.66 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000153c_434614fa_000b34a7 10/6/2005 11:26 PM 4.26 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001547_433f60a1_000487ab 10/1/2005 9:22 PM 58.46 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001547_43420b28_000848fc 10/3/2005 9:55 PM 213.16 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000015a1_433f6544_0000b71b 10/1/2005 9:42 PM 17.33 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001643_43404504_0005b8d8 10/2/2005 1:37 PM 74.56 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001649_433f5fb6_000bebc2 10/2/2005 8:48 AM 45.01 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001649_4343eb1d_000bebc2 10/5/2005 8:02 AM 3.27 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001649_43461479_0001e848 10/6/2005 11:32 PM 43.93 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000164a_4340c18b_000d59f8 10/2/2005 10:28 PM 604.25 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000016c5_433f65ed_000487ab 10/1/2005 9:45 PM 18.91 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000016c5_433f73fd_000ec82e 10/3/2005 10:07 PM 116.72 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000016c5_434009e0_0005f5e1 10/2/2005 9:25 AM 55.55 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000016d4_4340134c_000a4083 10/2/2005 10:05 AM 4.96 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000017b8_4340af1b_000c65d4 10/2/2005 9:10 PM 3.05 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000182f_43437691_000145af 10/4/2005 11:45 PM 163.61 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000187e_434009db_0001312d 10/2/2005 9:24 AM 51.20 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000018be_433eceb1_000b34a7 10/5/2005 4:16 PM 40.16 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000018be_434411b0_000b34a7 10/5/2005 10:47 AM 36 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000018be_43445b16_00000000 10/5/2005 4:00 PM 36 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000018be_4345f3c7_000487ab 10/6/2005 9:04 PM 23.78 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000018be_4346168b_000d1cef 10/6/2005 11:32 PM 13.86 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000018d7_43400f20_0004c4b4 10/2/2005 9:47 AM 141.43 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000018d7_43432695_000c3d4d 10/4/2005 6:04 PM 36 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001916_433f6c10_000a7d8c 10/1/2005 10:11 PM 81 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001916_433f743f_0001312d 10/1/2005 10:46 PM 8.29 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001953_43400f34_0003567e 10/2/2005 9:47 AM 142.17 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001953_4343269e_000923d8 10/4/2005 6:04 PM 4.31 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000196f_4340b96f_000d59f8 10/2/2005 9:54 PM 5.08 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000198c_4340aefa_0001312d 10/2/2005 9:09 PM 66.95 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000199f_4340af6c_0007a120 10/2/2005 9:11 PM 221 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000019d9_43401248_00007a12 10/2/2005 10:00 AM 134.89 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000019d9_43432967_000edcb0 10/4/2005 6:16 PM 174.92 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000019da_434035db_0001312d 10/2/2005 12:32 PM 56.59 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000019da_43435307_00082fb4 10/4/2005 9:13 PM 13.67 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001ad4_433ed0dc_000ca2dd 10/1/2005 11:09 AM 438 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001ad4_43420bfe_0009a4fa 10/3/2005 9:58 PM 150.90 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001bd9_434045a4_000a037a 10/2/2005 1:40 PM 569 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001bfc_43405ad8_00022551 10/2/2005 3:10 PM 48.83 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001cd0_43400877_000ec82e 10/2/2005 9:19 AM 605.01 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001cdf_43404650_000c28cb 10/2/2005 1:42 PM 2.26 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001d11_43404557_0008d24d 10/2/2005 1:38 PM 505 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001d18_4340358f_000501bd 10/2/2005 12:31 PM 3.66 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001d3f_43405163_0008d24d 10/2/2005 2:30 PM 21.41 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001d5e_434051d9_00031975 10/2/2005 2:32 PM 7.74 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001db5_4340bc9b_00090f56 10/2/2005 10:07 PM 3 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001dc0_4340124b_000632ea 10/2/2005 10:00 AM 21.38 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001dc3_4340c19e_00076417 10/2/2005 10:29 PM 3 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001e1f_43420b88_0001350a 10/3/2005 9:56 PM 81 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001f16_43404184_0007270e 10/2/2005 1:22 PM 118.63 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00001fb4_434081a3_00022551 10/2/2005 5:56 PM 154.58 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002044_4340819f_000d9701 10/2/2005 5:55 PM 210.86 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002059_4343290c_00045f24 10/4/2005 6:14 PM 604 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000020a8_43405923_0008d24d 10/2/2005 3:03 PM 49.78 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000212c_4340590e_00016e36 10/2/2005 3:03 PM 133.62 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000214e_4340af32_00089544 10/2/2005 9:10 PM 2.78 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002213_43446075_00040d99 10/5/2005 4:23 PM 27.35 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002237_4340bc99_000e1113 10/2/2005 10:07 PM 3 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000022cd_43400d4f_000d59f8 10/2/2005 9:39 AM 121.69 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000022cd_43432692_000182b8 10/4/2005 6:04 PM 4.78 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000022e4_4340af6c_000d59f8 10/2/2005 9:11 PM 1.30 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000022ee_43400542_00003d09 10/2/2005 9:05 AM 140.07 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002350_434461c3_0008583b 10/5/2005 4:29 PM 30.86 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000023c9_433f740c_000d1cef 10/1/2005 10:45 PM 1.70 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002462_4340465a_000b34a7 10/2/2005 1:43 PM 602 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000249e_434328ff_000edcb0 10/4/2005 6:14 PM 691 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000251f_43435127_0007b5a2 10/4/2005 9:05 PM 13.36 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002528_43404557_000d1cef 10/2/2005 1:38 PM 13.50 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000260d_433ed0fe_000a4083 10/1/2005 11:10 AM 11.36 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000260d_43400426_0006acfc 10/2/2005 9:00 AM 264.10 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000260d_43420c80_0006dd86 10/3/2005 10:00 PM 43.14 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000261e_433f6c0e_000e1113 10/1/2005 10:11 PM 190.65 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000261e_43400d55_000a4083 10/2/2005 9:39 AM 186.83 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000261e_43432692_00036b00 10/4/2005 6:04 PM 657 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000263d_4340451a_000a7d8c 10/2/2005 1:37 PM 505 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002668_43404529_00016e36 10/2/2005 1:38 PM 32.21 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000026a6_433ecf2a_000f0537 10/2/2005 2:28 PM 924 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000026a6_43445f12_0003567e 10/5/2005 4:17 PM 36.98 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000026b1_4340464e_000d9701 10/2/2005 1:42 PM 539 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000026e9_433f5fbe_0008d24d 10/1/2005 9:19 PM 123.50 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000026e9_4341d93e_000e1113 10/3/2005 6:22 PM 121.45 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000026e9_434412fd_000501bd 10/5/2005 10:53 AM 608.88 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000027d3_4340819b_000dd40a 10/2/2005 5:55 PM 121.42 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000027da_43404651_000501bd 10/2/2005 1:42 PM 46.65 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002833_434328fd_0006fe87 10/4/2005 6:14 PM 37.06 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000288f_433f7435_00031975 10/1/2005 10:46 PM 4.42 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000288f_43400d47_0009c671 10/2/2005 9:39 AM 141.52 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000288f_43432691_000e9fa7 10/4/2005 6:04 PM 1 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000028e2_434045a7_0000b71b 10/2/2005 1:40 PM 8.32 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002959_4340451f_000b71b0 10/2/2005 1:37 PM 505 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002b00_4340134c_0007a120 10/2/2005 10:05 AM 58.76 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002b0c_43400fc6_0006ea05 10/2/2005 9:50 AM 122.26 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002b0c_43432900_0000518b 10/4/2005 6:14 PM 604 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002b0f_434058ca_000ec82e 10/2/2005 3:01 PM 55.70 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002b43_4340c245_000e8b25 10/2/2005 10:31 PM 36 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002ba5_434045a6_000a4083 10/2/2005 1:40 PM 524 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002bb8_4340bc9b_0000f424 10/2/2005 10:07 PM 17.00 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002bfa_4340bc98_00076417 10/2/2005 10:07 PM 688 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002c3b_43400910_0002dc6c 10/2/2005 9:21 AM 119.37 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002c49_433f7422_0007a120 10/1/2005 10:46 PM 4.49 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002cd6_433f5f89_000af79e 10/1/2005 9:18 PM 279 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002cd6_43400158_00044aa2 10/2/2005 8:48 AM 123.62 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002cd6_4343eb19_0005f5e1 10/5/2005 8:02 AM 71.91 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002cd6_434411e9_00094c5f 10/5/2005 10:48 AM 123.39 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002cd6_4345f4d7_0004c4b4 10/6/2005 9:08 PM 354 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002cd6_4346170e_0007a120 10/6/2005 11:34 PM 533 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002d12_43420b2e_0001230a 10/3/2005 9:55 PM 135.15 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002ea6_433f5fc1_0005f5e1 10/1/2005 9:19 PM 210.92 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002ea6_434614dc_00040d99 10/6/2005 11:32 PM 50.99 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002f0b_43405ad1_000baeb9 10/2/2005 3:10 PM 141.68 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002f14_433f666a_000b34a7 10/1/2005 10:40 PM 90.92 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002f14_433f7416_0008d24d 10/1/2005 10:45 PM 4.88 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002f14_43432681_000acf17 10/4/2005 6:04 PM 16.55 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002fa1_4340ba81_000d9701 10/2/2005 10:00 PM 866 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002fe7_43404591_000a7d8c 10/2/2005 1:39 PM 23.08 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002fff_433f6b5e_0002dc6c 10/1/2005 10:28 PM 3.80 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00002fff_433f7434_0002625a 10/1/2005 10:46 PM 81.56 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003004_43437686_0005cd5a 10/4/2005 11:45 PM 123.63 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000301c_43420c81_0009ba20 10/3/2005 10:00 PM 78 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000301c_434460c8_000ec82e 10/5/2005 4:24 PM 30.26 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000305e_43420b26_0007546f 10/3/2005 9:55 PM 123.70 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003106_43405950_000e4e1c 10/2/2005 3:04 PM 130.87 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000314f_433f6487_0007de29 10/1/2005 9:39 PM 545 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000031ad_4340af40_0002dc6c 10/2/2005 9:10 PM 4.34 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003223_4340af15_0005b8d8 10/2/2005 9:09 PM 83.95 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000323b_433f60e1_000aba95 10/1/2005 9:24 PM 398 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000323b_43400423_000ca2dd 10/2/2005 9:00 AM 211.33 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000323b_43420c7f_00012479 10/3/2005 10:00 PM 81 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003260_4340af3c_00094c5f 10/2/2005 9:10 PM 73.26 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000328a_4340b96a_00029f63 10/2/2005 9:54 PM 7.20 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000032c1_4340aeeb_00022551 10/2/2005 9:09 PM 70.55 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000032de_4340af3d_000aba95 10/2/2005 9:10 PM 4.46 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000032e6_433f6c28_00089544 10/1/2005 10:40 PM 1.77 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000032e6_43400d78_00094c5f 10/2/2005 9:40 AM 90.93 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000032e6_43432693_000145af 10/4/2005 6:04 PM 455 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003371_4340bc78_000d9701 10/2/2005 10:07 PM 98.23 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000033ea_43420e30_000a74d9 10/3/2005 10:08 PM 1.86 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000342d_4340af33_0000f424 10/2/2005 9:10 PM 1.30 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000357e_43405964_0004c4b4 10/2/2005 3:04 PM 53.07 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003605_4340aa21_000d59f8 10/2/2005 8:48 PM 12.05 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000368e_433f68ab_0000b71b 10/1/2005 10:40 PM 37.13 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000368e_433f741e_000aba95 10/1/2005 10:46 PM 7.85 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000368e_43432689_000edcb0 10/4/2005 6:04 PM 2.90 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003699_43400969_00029f63 10/2/2005 9:35 PM 51.49 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000036a1_43405787_000d1cef 10/2/2005 2:56 PM 206 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000037e5_4343297a_00055348 10/4/2005 6:16 PM 109.87 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000037e6_4340122b_0001ab3f 10/2/2005 10:00 AM 23.06 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000037e6_43432967_0001fcca 10/4/2005 6:16 PM 1.50 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003807_434350af_0009daf3 10/4/2005 9:03 PM 87.60 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000384d_4340baee_000c65d4 10/2/2005 10:00 PM 5.73 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000387c_4340aed6_00039387 10/2/2005 9:08 PM 57.71 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003895_4340af2e_000b34a7 10/2/2005 9:10 PM 56.83 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000390c_433eceea_00022551 10/1/2005 11:01 AM 63.52 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000390c_4341d947_000aba95 10/3/2005 6:22 PM 166.75 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003960_43404518_00066ff3 10/2/2005 1:37 PM 597 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000039b3_43420b2a_0009b79e 10/3/2005 9:55 PM 161.62 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000039b3_43445e94_00089544 10/5/2005 4:15 PM 36 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000039ce_4343537f_00077899 10/4/2005 9:15 PM 13.46 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003a27_4340aeb7_0002625a 10/2/2005 9:08 PM 196.77 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003a4c_4340aa0a_000632ea 10/2/2005 8:48 PM 5.80 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003a54_4340bc75_0008d24d 10/2/2005 10:07 PM 223 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003a61_433f7435_00094c5f 10/1/2005 10:46 PM 8.10 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003a61_43432691_000f19b9 10/4/2005 6:04 PM 1.23 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003a8d_4340134c_000cdfe6 10/2/2005 10:05 AM 3.48 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003a8d_434350ab_0004d936 10/6/2005 11:12 PM 5.80 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003a9e_433f6484_0007a120 10/2/2005 9:53 PM 56.88 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003b25_433ed0db_00000000 10/1/2005 11:09 AM 7.61 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003b25_433f60c9_000ec82e 10/1/2005 9:23 PM 111.91 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003b25_43420b87_000767d5 10/3/2005 9:56 PM 44.13 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003b29_4340bc97_000a037a 10/2/2005 10:07 PM 1.83 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003b65_4340ba5d_000a037a 10/2/2005 9:58 PM 61.10 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003b97_4340451b_0006acfc 10/2/2005 1:37 PM 29.26 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003c61_433f6b31_00057bcf 10/1/2005 10:28 PM 22.94 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003c61_43432691_000145af 10/4/2005 6:04 PM 1 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003cd5_433f6603_0005b8d8 10/1/2005 9:45 PM 23.95 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003cd5_433f7402_0001e848 10/1/2005 10:45 PM 81.10 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003cd5_43400a4e_000ca2dd 10/2/2005 9:26 AM 0 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003cd5_43420e2b_000811b9 10/3/2005 10:07 PM 21.45 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003d6c_433eceb3_00057bcf 10/1/2005 11:00 AM 36 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003d6c_4341438e_000e4e1c 10/3/2005 7:43 AM 606.49 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003d6c_4343eb18_000a4083 10/5/2005 8:02 AM 87.60 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003d6c_43445b67_0008d24d 10/5/2005 4:01 PM 198.35 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003d6c_4345f497_000cdfe6 10/6/2005 9:07 PM 32.94 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003d6c_4346170d_00053ec6 10/6/2005 11:34 PM 711 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003e09_4340bae8_000487ab 10/2/2005 10:00 PM 36.39 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003e12_433f6200_000bebc2 10/1/2005 9:28 PM 84.39 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003e12_43400560_000ec82e 10/2/2005 9:05 AM 195.02 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003ee9_43404587_0008583b 10/2/2005 1:39 PM 18.37 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003f4a_4340429e_000c65d4 10/2/2005 1:27 PM 3.41 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00003f97_4340455e_0000f424 10/2/2005 1:38 PM 32.15 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000401d_43400d91_0003d090 10/2/2005 9:40 AM 187.64 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000401d_43432693_00032df7 10/4/2005 6:04 PM 231 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004027_4340451b_00089544 10/2/2005 1:37 PM 543 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004080_433f6614_000501bd 10/1/2005 9:46 PM 22.39 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004080_433f7402_000d9701 10/1/2005 10:45 PM 1.99 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004080_43400a54_00031975 10/2/2005 3:03 PM 43.66 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004080_43420e2d_000d8de3 10/3/2005 10:07 PM 7.80 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004087_434012f7_000bebc2 10/2/2005 10:04 AM 23.06 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004087_43432985_000960e1 10/4/2005 6:16 PM 1.29 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000409d_4340094d_000f0537 10/2/2005 9:33 PM 122.54 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000040a5_43404557_00057bcf 10/2/2005 1:38 PM 24.64 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000412f_4340455e_00090f56 10/2/2005 1:38 PM 13.50 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000041bb_434412d7_0003567e 10/5/2005 10:52 AM 36 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000041bb_43445b98_00089544 10/5/2005 4:02 PM 219.40 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000041bb_4346148f_00031975 10/6/2005 11:32 PM 3.54 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000422d_43432689_00036b00 10/4/2005 6:04 PM 4.77 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004230_434008ad_000a7d8c 10/2/2005 9:19 AM 84 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000428b_43420b78_00050273 10/3/2005 9:56 PM 605.70 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004325_43404546_00081b32 10/2/2005 1:38 PM 505 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004402_43432694_00055348 10/4/2005 6:04 PM 367 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000440d_433eceed_0005b8d8 10/1/2005 11:01 AM 325 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000440d_433f609b_0008583b 10/1/2005 9:22 PM 185.43 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000440d_43445d44_0000f424 10/5/2005 4:09 PM 76.91 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000441d_4340456d_000487ab 10/2/2005 1:39 PM 505 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000442b_43432983_0006c17e 10/4/2005 6:16 PM 0 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000045c5_43404518_0005f5e1 10/2/2005 1:37 PM 505 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000045c8_4340c242_000c65d4 10/2/2005 10:31 PM 36 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004626_4340464e_000dd40a 10/2/2005 1:42 PM 543 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004657_433f7422_0003567e 10/1/2005 10:46 PM 1.36 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000468c_43404559_000f0537 10/2/2005 1:38 PM 32.15 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000046cf_43401208_0007de29 10/2/2005 9:59 AM 401 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004740_4340c19c_00053ec6 10/2/2005 10:29 PM 200.62 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004823_433ecd9a_0001ab3f 10/1/2005 10:55 AM 0 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004823_43414326_000af79e 10/3/2005 7:41 AM 36 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004823_434411b0_000aba95 10/5/2005 10:47 AM 36 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004823_43445b15_000ec82e 10/5/2005 4:00 PM 36 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004823_4345f3b5_00040d99 10/6/2005 9:04 PM 22.26 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004823_43461683_00003d09 10/6/2005 11:32 PM 93.03 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000489c_43400d61_000f0537 10/2/2005 9:40 AM 187.74 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000489c_43432692_00059051 10/4/2005 6:04 PM 455 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000048cc_43400a7b_00016e36 10/2/2005 3:02 PM 48.42 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000048db_4340bc98_00022551 10/2/2005 10:07 PM 7.24 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000048db_434376c4_0002f0ee 10/4/2005 11:46 PM 163.62 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004908_4340af45_000a7d8c 10/2/2005 9:10 PM 41.61 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004944_433f6523_0001e848 10/3/2005 10:04 PM 75.24 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000494a_43400f1d_000cdfe6 10/2/2005 9:47 AM 128.28 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000494a_43432693_0007b5a2 10/4/2005 6:04 PM 2.90 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004963_4340464e_000b34a7 10/2/2005 1:42 PM 29.81 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000049f7_434012f4_000d9701 10/2/2005 10:03 AM 141.40 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000049f7_43432982_000182b8 10/4/2005 6:16 PM 53.95 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004a0e_4340aa3a_00076417 10/2/2005 8:49 PM 5.80 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004a80_434009b4_0000b71b 10/2/2005 9:24 AM 58.37 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004a80_43420e1e_000293e9 10/3/2005 10:07 PM 5.22 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004a92_4340bc96_000baeb9 10/2/2005 10:07 PM 5.60 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004ad4_43437694_000edcb0 10/4/2005 11:45 PM 163.66 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004ae1_433eceb2_0008583b 10/1/2005 11:00 AM 36 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004ae1_433f5f87_00098968 10/1/2005 9:18 PM 77.06 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004ae1_4343eb17_0008583b 10/5/2005 8:02 AM 18.76 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004ae1_4345f3fe_000a4083 10/6/2005 9:05 PM 29.95 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004ae1_434616ea_000d59f8 10/6/2005 11:34 PM 10.93 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004b72_4340bc98_0001ab3f 10/2/2005 10:07 PM 688 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004b99_4340bc97_000a7d8c 10/2/2005 10:07 PM 319 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004c29_4340bc96_000e1113 10/2/2005 10:07 PM 1.83 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004c66_4340459e_0008d24d 10/2/2005 1:39 PM 569 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004c85_434035e2_000e4e1c 10/2/2005 12:32 PM 642 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004cad_433f6487_00076417 10/1/2005 9:39 PM 2.55 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004cad_434007b7_0003d090 10/2/2005 9:15 AM 145.24 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004cd4_434011e4_000d1cef 10/2/2005 9:59 AM 18.78 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004d54_4343534c_0007f2ab 10/4/2005 9:15 PM 642 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004d9a_4340456d_000ca2dd 10/2/2005 1:39 PM 13.50 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004db7_433f609d_000d9701 10/1/2005 9:22 PM 24.29 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004db7_433f71a9_0002dc6c 10/1/2005 10:35 PM 26.43 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004dc8_433f60a5_0007de29 10/1/2005 9:23 PM 71.74 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004df2_433f6488_0002625a 10/1/2005 9:39 PM 4.81 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004e08_43404546_0008d24d 10/2/2005 1:38 PM 721 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004e38_434045cb_00053ec6 10/2/2005 1:40 PM 38.38 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004e57_43404309_000baeb9 10/2/2005 1:28 PM 7 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004e68_4340bc46_000e8b25 10/2/2005 10:06 PM 92.63 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004ebf_434050f7_0004c4b4 10/2/2005 2:28 PM 51.34 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004ecf_4340b978_0009c671 10/2/2005 9:54 PM 12.97 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004f5b_43405abe_0003567e 10/2/2005 3:10 PM 51.52 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004f66_434081a5_000ec82e 10/2/2005 5:56 PM 211.08 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004fc0_43404583_00066ff3 10/2/2005 1:39 PM 505 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00004fe2_434045a6_0007de29 10/2/2005 1:40 PM 23.48 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005005_434350ad_0003e512 10/6/2005 11:13 PM 781.54 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005039_4343269d_0005cd5a 10/4/2005 6:04 PM 36.66 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000513e_434035e3_0006ea05 10/2/2005 12:32 PM 0 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000051d1_4340459d_0005b8d8 10/2/2005 1:39 PM 59.51 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000526a_4340c22e_00016e36 10/2/2005 10:31 PM 25.78 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000527f_43405a45_000ca2dd 10/2/2005 3:08 PM 51.75 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005422_43400910_000bebc2 10/2/2005 9:21 AM 78 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005429_4340c246_0000b71b 10/2/2005 10:31 PM 36 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000542c_43400f2a_0007270e 10/2/2005 9:47 AM 190.29 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005478_43405966_0007270e 10/2/2005 3:04 PM 150.58 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000549b_434045a8_000f0537 10/2/2005 1:40 PM 32.18 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000054d6_4340455a_00029f63 10/2/2005 1:38 PM 505 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000054dc_433f741e_00031975 10/1/2005 10:46 PM 5.79 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000054dc_43432689_00049c2d 10/4/2005 6:04 PM 34.99 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000561c_4340bc98_0004c4b4 10/2/2005 10:07 PM 316 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000567e_4340b96f_0006acfc 10/2/2005 9:54 PM 46.21 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000056ae_43400536_0001e848 10/2/2005 9:05 AM 211.54 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000056ae_43420c9b_00007190 10/3/2005 10:01 PM 629 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000056ae_43446189_000487ab 10/5/2005 4:28 PM 34.88 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005753_43420e32_000d8ea3 10/3/2005 10:08 PM 1.70 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005772_433f65bf_000af79e 10/1/2005 9:44 PM 60.45 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005772_43400977_000e1113 10/2/2005 9:36 PM 48.92 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005772_43420e10_000bde46 10/3/2005 10:07 PM 3.30 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000057c2_434059a6_00040d99 10/2/2005 3:05 PM 54.35 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000057d3_43432963_0002f0ee 10/4/2005 6:16 PM 49.62 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005815_4340456d_00016e36 10/2/2005 1:39 PM 37.41 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005878_433f6155_000501bd 10/1/2005 9:25 PM 606.41 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005882_43405980_0001e848 10/2/2005 3:04 PM 138.81 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000058ad_4340ba81_0008d24d 10/2/2005 10:00 PM 46.08 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000590e_43401349_00016e36 10/2/2005 10:05 AM 56.69 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005981_4340c245_000e1113 10/2/2005 10:31 PM 36 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005a9c_434045a1_0002dc6c 10/2/2005 1:40 PM 597 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005a9f_43432909_000d6e7a 10/4/2005 6:14 PM 41.66 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005ab0_4340af31_000632ea 10/2/2005 9:10 PM 225 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005af1_433ecebf_00016e36 10/2/2005 2:56 PM 167.23 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005af1_4340015e_000aba95 10/2/2005 8:48 AM 163.46 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005af1_4343eb58_000aba95 10/5/2005 8:03 AM 36 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005af1_434412d7_0002625a 10/5/2005 10:52 AM 36 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005af1_4346148d_00066ff3 10/6/2005 11:32 PM 4.59 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005c5e_4340459e_000c28cb 10/2/2005 1:39 PM 597 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005c67_433f7416_00022551 10/1/2005 10:45 PM 82.46 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005c67_4343266f_000e9fa7 10/4/2005 6:03 PM 36 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005cfd_4340055a_000f0537 10/2/2005 9:05 AM 22.59 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005d03_433ecf30_0001312d 10/1/2005 11:07 AM 126.98 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005d03_433f60ab_00029f63 10/1/2005 9:23 PM 504.48 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005d03_43445f3a_000af79e 10/5/2005 4:18 PM 28.20 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005d24_434376b2_0007f2ab 10/4/2005 11:46 PM 161.91 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005d2a_4340ba60_000487ab 10/2/2005 9:58 PM 8.77 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005d3d_4340af35_00016e36 10/2/2005 9:10 PM 3.05 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005dd5_43432903_0001fcca 10/4/2005 6:14 PM 930 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005e14_433f6488_0001e848 10/1/2005 9:39 PM 3.79 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005e14_434007b8_00039387 10/2/2005 9:15 AM 84 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005e41_4340af63_00090f56 10/2/2005 9:11 PM 71.93 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005e76_4340451f_000bebc2 10/2/2005 1:37 PM 543 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005e9d_43432692_0004221b 10/4/2005 6:04 PM 485 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005ed0_43404309_0002625a 10/2/2005 1:28 PM 126.48 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005f1e_43400fb1_000d59f8 10/2/2005 9:49 AM 79.46 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005f1e_434326a0_000b0c20 10/4/2005 6:04 PM 4.31 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005f23_43404591_000d1cef 10/2/2005 1:39 PM 604 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005f32_433f6204_000baeb9 10/1/2005 9:28 PM 23.05 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005f34_434050f6_00003d09 10/2/2005 2:28 PM 3.47 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005f45_4340450d_000e4e1c 10/2/2005 1:37 PM 532 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005f49_4340079e_0003d090 10/2/2005 9:15 AM 292.68 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005f90_433ecebe_000c28cb 10/1/2005 11:00 AM 49.38 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005f90_43419467_00076417 10/5/2005 4:01 PM 165 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005f90_4343eb1a_000f0537 10/5/2005 8:02 AM 3.30 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005f90_43445b7d_000aba95 10/5/2005 4:02 PM 255.99 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005f90_434611eb_000ca2dd 10/6/2005 11:12 PM 157 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005fa4_434011ea_00007a12 10/2/2005 10:00 AM 141.38 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00005fa4_4343290b_000cb75f 10/4/2005 6:14 PM 692 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000060bf_433f7414_00007a12 10/1/2005 10:45 PM 7.88 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000060bf_43400a87_0001312d 10/2/2005 3:10 PM 124.63 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006172_43432692_000a920e 10/4/2005 6:04 PM 237 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006275_4340c1fa_000632ea 10/3/2005 10:01 PM 36.72 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000062b0_4340bcb4_00044aa2 10/2/2005 10:08 PM 107.74 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000634f_43405b38_000b71b0 10/2/2005 3:12 PM 123.32 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000638c_43405a29_000c65d4 10/2/2005 3:07 PM 48.37 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000063c6_4340c19d_000487ab 10/2/2005 10:29 PM 8.28 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000063cb_433ed0dd_00003d09 10/1/2005 11:09 AM 455 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000063cb_433f60d9_00007a12 10/1/2005 9:24 PM 123.88 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000063cb_434081af_000dd40a 10/2/2005 5:56 PM 186.35 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000063cb_43420bff_000189e0 10/3/2005 9:58 PM 81 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006443_43445ef4_00029f63 10/5/2005 4:17 PM 48.90 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006479_43404546_0006ea05 10/2/2005 1:38 PM 36.39 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000064a0_43405941_00007a12 10/2/2005 3:03 PM 45.71 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000064e0_4340465a_000bebc2 10/2/2005 1:43 PM 604 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006512_434050f5_000632ea 10/2/2005 2:28 PM 980 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006586_4340bc97_0005f5e1 10/2/2005 10:07 PM 7.28 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000658c_4340455e_0003567e 10/2/2005 1:38 PM 505 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000662a_434045cb_0005b8d8 10/2/2005 1:40 PM 569 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000066b4_434045a9_0000b71b 10/2/2005 1:40 PM 524 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000066c4_433f73a4_0005f5e1 10/1/2005 10:44 PM 22.03 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000066c4_434008ad_00040d99 10/2/2005 9:19 AM 132.85 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000066fa_4340432d_0004c4b4 10/6/2005 9:00 PM 30.96 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000066fa_434376a5_00008e94 10/4/2005 11:45 PM 164.14 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006747_434045a9_00066ff3 10/2/2005 1:40 PM 8.32 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006778_4340bc95_0008583b 10/2/2005 10:07 PM 55.92 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006784_433eceb2_0007de29 10/1/2005 11:00 AM 38 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006784_433f6dfa_0001ab3f 10/1/2005 10:19 PM 50.67 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006784_4340014e_00098968 10/2/2005 8:48 AM 605.54 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006784_4345f3dc_000487ab 10/6/2005 9:04 PM 36.13 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006784_434616c5_000a4083 10/6/2005 11:33 PM 5.14 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006874_4340bc98_0004c4b4 10/2/2005 10:07 PM 447 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006899_433f73fe_00076417 10/1/2005 10:45 PM 7.83 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006899_434009f1_0006ea05 10/2/2005 9:25 AM 147.48 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000068f5_43404518_00031975 10/2/2005 1:37 PM 23.77 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000692c_433f73f1_000c28cb 10/1/2005 10:45 PM 1 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000692c_434009af_0006acfc 10/2/2005 9:24 AM 58.90 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000692c_43420e1d_00097dd9 10/3/2005 10:07 PM 1.86 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006952_433f5f92_00022551 10/1/2005 9:18 PM 19.76 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006952_434411fd_00081b32 10/5/2005 10:48 AM 210.10 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006952_4346022b_000a7d8c 10/6/2005 10:05 PM 3.20 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000069d0_43404522_000487ab 10/2/2005 1:37 PM 24.60 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006ad4_43432903_000edcb0 10/4/2005 6:14 PM 438.57 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006ad6_433f666e_00094c5f 10/1/2005 9:47 PM 27.22 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006ad6_433f7416_000aba95 10/1/2005 10:45 PM 1.37 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006b36_433f61e6_0001e848 10/1/2005 9:28 PM 171.71 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006b61_4340c19a_0002625a 10/2/2005 10:28 PM 604.25 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006b72_43432692_000b8632 10/4/2005 6:04 PM 5.98 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006b89_433f611c_0000b71b 10/5/2005 4:01 PM 44.58 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006b89_43446085_0003567e 10/5/2005 4:23 PM 51.11 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006bc9_43405908_0008d24d 10/2/2005 3:02 PM 136.76 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006bcb_4343269f_000a17fc 10/4/2005 6:04 PM 4.37 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006be8_43432695_000e9fa7 10/4/2005 6:04 PM 40.51 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006bfc_433ed0dd_0003567e 10/1/2005 11:09 AM 220 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006bfc_43446018_0006acfc 10/5/2005 4:22 PM 19.80 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006c69_43432691_000a920e 10/4/2005 6:04 PM 5.21 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006ca5_4340c0bb_0004c4b4 10/2/2005 10:25 PM 84 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006d76_4340464c_000ec82e 10/2/2005 1:42 PM 602 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006dd0_4340bc76_00007a12 10/2/2005 10:07 PM 1.30 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006df1_4340015a_000dd40a 10/2/2005 8:48 AM 210.76 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006df1_4346147c_0004c4b4 10/6/2005 11:23 PM 0 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006e5d_433ed0dc_0007de29 10/1/2005 11:09 AM 729 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006e5d_433f60ca_0006acfc 10/1/2005 9:23 PM 398 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006e5d_43446009_000bebc2 10/5/2005 4:21 PM 11.31 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006e7e_43404583_000c65d4 10/2/2005 1:39 PM 13.50 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006ea1_4340459e_0006ea05 10/2/2005 1:39 PM 23.49 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006f11_434043a1_000e8b25 10/2/2005 1:36 PM 30.96 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006f11_434376a9_00036b00 10/4/2005 11:46 PM 18.50 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006f3c_4340450d_0004c4b4 10/2/2005 1:37 PM 24.83 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00006fc9_43404522_000cdfe6 10/2/2005 1:37 PM 13.50 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000700d_4340bc96_0009c671 10/2/2005 10:07 PM 896 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000701f_433ecf2d_000e8b25 10/2/2005 1:28 PM 12.08 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000701f_43420b84_000e8e62 10/3/2005 9:56 PM 163.04 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00007049_433f73f0_00022551 10/1/2005 10:45 PM 8.87 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00007049_43400991_0002625a 10/2/2005 9:27 AM 52.42 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000071f0_43432693_0003e512 10/4/2005 6:04 PM 1.03 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000072a6_4340af28_00016e36 10/2/2005 10:07 PM 82.08 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000072ae_433f5f89_000f0537 10/1/2005 9:18 PM 296 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000072ae_43414395_000c65d4 10/3/2005 7:43 AM 4.82 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000072ae_4345f5c9_0007a120 10/6/2005 9:12 PM 27.63 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00007346_434045cb_000af79e 10/2/2005 1:40 PM 8.32 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00007365_4340c0b9_0008d24d 10/2/2005 10:25 PM 156.52 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000073b1_4340af3d_000b71b0 10/2/2005 9:10 PM 9.26 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000073d9_43437689_000960e1 10/4/2005 11:46 PM 209.65 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000073da_433f65a5_00076417 10/1/2005 9:44 PM 17.27 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000073da_43400956_000dd40a 10/2/2005 9:22 AM 60.15 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00007426_4340b4cd_00000000 10/2/2005 9:34 PM 48.83 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000745e_434081b1_00040d99 10/2/2005 5:56 PM 81 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000749f_4340af78_000af79e 10/2/2005 9:11 PM 40.72 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000759a_433f6128_000baeb9 10/3/2005 7:43 AM 199.58 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000759a_4340053e_00044aa2 10/2/2005 9:57 PM 122.16 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000759a_43420cae_00062d50 10/3/2005 10:01 PM 725 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000759a_434461c3_00076417 10/5/2005 4:29 PM 36 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\000075ef_433f7421_0004c4b4 10/1/2005 10:46 PM 5.67 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000075ef_43400aca_0009c671 10/2/2005 9:28 AM 53.96 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000075ef_43432690_00001482 10/4/2005 6:04 PM 211 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000765f_43434fd2_000e629e 10/4/2005 9:00 PM 189.15 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000767d_433ecfef_000ca2dd 10/1/2005 11:05 AM 3.40 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000767d_43420b86_00000372 10/3/2005 9:56 PM 81 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000767d_43445fa4_00039387 10/5/2005 4:20 PM 31.41 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00007833_434081a7_0007a120 10/2/2005 5:56 PM 151.73 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00007874_43400fbb_00003d09 10/2/2005 9:50 AM 90.93 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\000078d4_43404529_00040d99 10/2/2005 1:38 PM 505 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000797d_4340079e_00000000 10/2/2005 9:15 AM 604.99 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00007983_4343268f_0008a9c6 10/4/2005 6:04 PM 34.23 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000798b_433f6596_0000f424 10/1/2005 9:44 PM 19.89 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\0000798b_43400953_00029f63 10/2/2005 9:34 PM 51.09 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00007a5a_43420b85_000e1481 10/3/2005 9:56 PM 628 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00007a61_43404547_00039387 10/2/2005 1:38 PM 13.50 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00007ac2_43404522_0008583b 10/2/2005 1:37 PM 505 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00007dd1_433f743a_00007a12 10/1/2005 10:46 PM 1.95 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00007dd1_43432692_0002b3e5 10/4/2005 6:04 PM 3.09 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00007e0e_434056ca_000af79e 10/2/2005 2:53 PM 3.16 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00007e87_433ecee3_00081b32 10/3/2005 6:22 PM 1.12 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00007e87_4346151d_000dd40a 10/6/2005 11:26 PM 104.94 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00007f4f_433f74b9_000a7d8c 10/1/2005 10:48 PM 36 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00007f4f_43432693_00068475 10/4/2005 6:04 PM 341 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00007f61_4340134c_000af79e 10/2/2005 10:05 AM 4.93 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00007f96_433ed0dd_000487ab 10/1/2005 11:09 AM 311 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00007f96_433f60d9_00094c5f 10/1/2005 9:23 PM 398 bytes Hidden from Windows API.
C:\Program Files\Hp media\Cache\00007fbe_4340134c_000d1cef 10/2/2005 10:05 AM 9.47 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00007ff5_433ed0dd_000c65d4 10/1/2005 11:09 AM 2.36 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\00007ff5_43420c7e_0002928c 10/3/2005 10:00 PM 183.13 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\dns 10/6/2005 11:37 PM 43.88 KB Hidden from Windows API.
C:\Program Files\Hp media\Cache\index 10/6/2005 11:34 PM 83.23 KB Hidden from Windows API.
C:\Program Files\Hp media\mycomcat.exe 10/1/2005 10:44 AM 156.00 KB Hidden from Windows API.
C:\Program Files\Hp media\paclnt07.exe 10/6/2005 11:32 PM 908.00 KB Hidden from Windows API.
C:\Program Files\Hp media\WinGenerics.dll 10/1/2005 10:44 AM 560.00 KB Hidden from Windows API.
C:\WINDOWS\system32\drivers\tsbismpx9.sys 10/1/2005 10:44 AM 12.00 KB Hidden from Windows API.
C:\WINDOWS\system32\vctsrdpa.exe 10/1/2005 10:44 AM 424.00 KB Hidden from Windows API.

sUBs · 10-09-2005, 11:34 PM

Please download the file I have attached to this post. - fixARP.zip

**IMPORTANT - Extract/Unzip it to it's own folder

Next, please reboot your computer in SafeMode by doing the following:
1. Restart your computer
2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3. Instead of Windows loading as normal, a menu should appear
4. Select the option to run Windows in Safe Mode.

From within it's folder, double click on fixARP.bat
Wait for it to present you with a log.

Then reboot to Normal Mode & post that log along with a new findAP log

christianb · 10-10-2005, 12:15 AM

Wow! Here are the relevant logs:

fixARP log:
Deletion of folder succeeded!

Deletion of file C:\WINDOWS\system32\drivers\tsbismpx9.sys succeeded!

Deletion of file C:\WINDOWS\system32\vctsrdpa.exe succeeded!

----------------------------------------------------

Here is the FindAP log:

Running from directory:
C:\FindAP
~~~~~~
Registry entries found:

~~~~~~
----------------------------------------------------

Here is a new HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 11:13:46 PM, on 10/9/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Genny\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1125981702537
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TXLMVA - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Genny\LOCALS~1\Temp\TXLMVA.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

----------------------------------------------------

sUBs · 10-10-2005, 12:42 AM

Your system is clean. Please follow these simple steps in order to keep your computer clean and secure:

CLEAR & RESET SYSTEM RESTORE'S CACHE
Go to Start >> Run - type control sysdm.cpl,,4 & press Enter
- Tick on the checkbox - Turn off System Restore on all drives
- Click Apply
Turn it back 'On' by unticking the same checkbox & click OK
DISABLE THE VIEWING OF SYSTEM FILES
From Windows Explorer, go to Tools>Folder Options> View tab.
- Untick - Show hidden files and folder
- Tick - Hide file extensions for known types
- Tick - Hide protected operating system files
Click Yes to confirm & then click OK
SECURING INTERNET EXPLORER
From within Internet Explorer click on the Tools menu and then click on Internet Options.
- Select the Security tab
  - Click once on the Internet icon so it becomes highlighted.
  - Select Custom Level .
    - Change 'Download signed ActiveX controls' to Prompt
    - Change 'Download unsigned ActiveX controls' to Disable
    - Change 'Initialize and script ActiveX controls not marked as safe' to Disable
    - Change 'Installation of desktop items' to Prompt
    - Change 'Launching programs and files in an IFRAME' to Prompt
    - Change 'Navigate sub-frames across different domains' to Prompt
    - When all these changes have been made, click on the OK button.
  - If it prompts you as to whether or not you want to save the settings, press the Yes button.
- Select OK to exit the Internet Properties page.
ANTIVIRUS SOFTWARE
It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

See this link for a listing of some online & their stand-alone antivirus programs:

Virus, Spyware, and Malware Protection and Removal Resources

It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
FIREWALL
Without a firewall your computer is succeptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here.
Microsoft Windows Update
Visit windowsupdate.com regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
SPYBOT - SEARCH & DESTROY
Download and install Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here
AD-AWARE
Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here
SPYWAREBLASTER
SpywareBlaster prevents the installation of malicious ActiveX, adware, browser hijackers, dialers, and other potentially unwanted software. Blocks spyware/tracking cookies & restricts the actions of potentially unwanted sites.

Unlike other programs, SpywareBlaster does not have to remain running in the background. A tutorial on installing & using this product can be found here
IE-SPYAD
IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. A tutorial on installing this product can be found here
MVPS HOST FILE
The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. It can be downloaded here - MVPS Hosts file

Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.

Trillian or Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
Weather Watcher - Free taskbar weather program that is free, malware free, and resource light.
Firefox - Use this alternate browser. Whilst Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.
Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.
Google Toolbar - Get the free google toolbar to help stop pop up windows.
CleanUP! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.

ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.

NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.
Winpatrol - Download and install the free version of Winpatrol.
A tutorial for this product is located here:
Using Winpatrol to protect your computer from malicious software

To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein

After doing all these, your system will be optimised against future threats.

It's okay to delete the Hijack This folder in a couple weeks if everything is working okay.
Have a safe & happy computing day.

Please respond to this thread one more time so we can mark this thread as resolved.

christianb · 10-11-2005, 04:15 PM

Thanks so much! MSFT's tool no longer finds the spyware.

The computer still appears to be very slow in browsing the web (IE in particular). If the computer is still more sluggish than normal in a few days, I'll inquire further in the appropriate section of the site.

Thanks again,
Christianb

10-09-2005, 12:19 AM	#1 (permalink)
christianb Registered User Join Date: Oct 2005 Posts: 7 OS: xp	Apropos, Sluggish Computer and Internet Hi there, I have had trouble with my computer for about a week now. Microsoft's anti-spyware keeps detecting and trying to remove 'Apropos Media Browser Modifier.' I have been following the other threads on this, and have tried to replicate the fix, with no success. I even tried running the FixARP.zip batch file. Please help! Here is my HijackThis log: Thanks, christianb < ---------- log start---------------> Logfile of HijackThis v1.99.1 Scan saved at 11:15:03 PM, on 10/8/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\NavNT\defwatch.exe C:\Program Files\NavNT\rtvscan.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\system32\MsgSys.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Genny\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local., R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1125981702537 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing) < ---------- end log --------------->

10-09-2005, 02:25 AM	#2 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,328 OS: N/A	Please do not simply download & run the FixARP file. It is a customised file for individual cases. The files/folders that it deletes are irreversible. Please download - FindAP.zip IMPORTANT - extract/unzip the contents to a folder of it's own From within that folder, double-click on FindAP.bat It will produce a log for you to post back to me. Next, download RootKitRevealer.zip Unzip it to the desktop, run it, and click Scan. This will generate a log file. Please post the entire contents of the log file in your next reply. If the file is too big, place it as an attachment instead. __________________ Question - what have you done for the community today?

10-09-2005, 09:34 AM	#4 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,328 OS: N/A	Please post the RootkitRevealer's log when it's ready __________________ Question - what have you done for the community today?

10-09-2005, 12:50 PM	#6 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,328 OS: N/A	Keep it running. Norton antivirus may be disrupting it. Unplug/disconnect yourself from the internet & disable Norton Antivirus. You can re-enable it when it's finished. __________________ Question - what have you done for the community today?

10-09-2005, 01:02 PM	#7 (permalink)
christianb Registered User Join Date: Oct 2005 Posts: 7 OS: xp	Two very suspicious processes are taking up a lot of CPU cycles. Specifically "TXLMVA.exe" and "System" (system does not have a .exe at the end). Also, I did turn off realtime Norton protection and unplugged the internet connection (posting from my work machine). I'll post the RootRevealerKit log as soon as it is done. Last edited by christianb; 10-09-2005 at 01:03 PM.

10-09-2005, 08:37 AM	#3 (permalink)
christianb Registered User Join Date: Oct 2005 Posts: 7 OS: xp	Here is the log from the FindAP.bat step. Will post the RootKitRevealer.zip log shortly. Running from directory: C:\FindAP ~~~~~~ Registry entries found: [HKEY_LOCAL_MACHINE\Software\Aprps] [HKEY_LOCAL_MACHINE\Software\Aprps\Client] "PartnerId"="WB.VER2" ~~~~~~

10-09-2005, 12:46 PM	#5 (permalink)
christianb Registered User Join Date: Oct 2005 Posts: 7 OS: xp	I've been running the RootkitRealer since 7:30am (it is now 11:45am); is it normal for it to take this long? It is currently scanning c:\windows\$ntservicepackninstall$. Thanks!

10-09-2005, 01:09 PM	#8 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,328 OS: N/A	System is a Windows process. I suspect the other process to be the RootKitRevealer itself. It does have a habit of naming itself randomly. __________________ Question - what have you done for the community today?

10-09-2005, 11:34 PM	#10 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,328 OS: N/A	Please download the file I have attached to this post. - fixARP.zip IMPORTANT - Extract/Unzip it to it's own folder Next, please reboot your computer in SafeMode by doing the following: 1. Restart your computer 2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8. 3. Instead of Windows loading as normal, a menu should appear 4. Select the option to run Windows in Safe Mode. From within it's folder, double click on fixARP.bat Wait for it to present you with a log. Then reboot to Normal Mode & post that log along with a new findAP log** __________________ Question - what have you done for the community today?

10-10-2005, 12:15 AM	#11 (permalink)
christianb Registered User Join Date: Oct 2005 Posts: 7 OS: xp	Wow! Here are the relevant logs: fixARP log: Deletion of folder succeeded! Deletion of file C:\WINDOWS\system32\drivers\tsbismpx9.sys succeeded! Deletion of file C:\WINDOWS\system32\vctsrdpa.exe succeeded! ---------------------------------------------------- Here is the FindAP log: Running from directory: C:\FindAP ~~~~~~ Registry entries found: ~~~~~~ ---------------------------------------------------- Here is a new HijackThis log: Logfile of HijackThis v1.99.1 Scan saved at 11:13:46 PM, on 10/9/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\NavNT\vptray.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\Program Files\NavNT\defwatch.exe C:\Program Files\NavNT\rtvscan.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\MsgSys.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\Genny\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local., R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1125981702537 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: TXLMVA - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Genny\LOCALS~1\Temp\TXLMVA.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing) ----------------------------------------------------

10-10-2005, 12:42 AM	#12 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,328 OS: N/A	Your system is clean. Please follow these simple steps in order to keep your computer clean and secure: CLEAR & RESET SYSTEM RESTORE'S CACHE Go to Start >> Run - type control sysdm.cpl,,4 & press Enter Tick on the checkbox - Turn off System Restore on all drives Click Apply Turn it back 'On' by unticking the same checkbox & click OK DISABLE THE VIEWING OF SYSTEM FILES From Windows Explorer, go to Tools>Folder Options> View tab. Untick - Show hidden files and folder Tick - Hide file extensions for known types Tick - Hide protected operating system files Click Yes to confirm & then click OK SECURING INTERNET EXPLORER From within Internet Explorer click on the Tools menu and then click on Internet Options. Select the Security tab Click once on the Internet icon so it becomes highlighted. Select Custom Level . Change 'Download signed ActiveX controls' to Prompt Change 'Download unsigned ActiveX controls' to Disable Change 'Initialize and script ActiveX controls not marked as safe' to Disable Change 'Installation of desktop items' to Prompt Change 'Launching programs and files in an IFRAME' to Prompt Change 'Navigate sub-frames across different domains' to Prompt When all these changes have been made, click on the OK button. If it prompts you as to whether or not you want to save the settings, press the Yes button. Select OK to exit the Internet Properties page. ANTIVIRUS SOFTWARE It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See this link for a listing of some online & their stand-alone antivirus programs: Virus, Spyware, and Malware Protection and Removal Resources It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out. FIREWALL Without a firewall your computer is succeptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here. Microsoft Windows Update Visit windowsupdate.com regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates. SPYBOT - SEARCH & DESTROY Download and install Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here AD-AWARE Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here SPYWAREBLASTER SpywareBlaster prevents the installation of malicious ActiveX, adware, browser hijackers, dialers, and other potentially unwanted software. Blocks spyware/tracking cookies & restricts the actions of potentially unwanted sites. Unlike other programs, SpywareBlaster does not have to remain running in the background. A tutorial on installing & using this product can be found here IE-SPYAD IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. A tutorial on installing this product can be found here MVPS HOST FILE The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. It can be downloaded here - MVPS Hosts file Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety. Trillian or Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN) Weather Watcher - Free taskbar weather program that is free, malware free, and resource light. Firefox - Use this alternate browser. Whilst Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness. Sun's Java - It's much more secure than Microsoft's Java Virtual Machine. Google Toolbar - Get the free google toolbar to help stop pop up windows. CleanUP! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders. ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT. ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry. NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster. Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here: Using Winpatrol to protect your computer from malicious software To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day. Please respond to this thread one more time so we can mark this thread as resolved. __________________ Question - what have you done for the community today?

10-11-2005, 04:15 PM	#13 (permalink)
christianb Registered User Join Date: Oct 2005 Posts: 7 OS: xp	Thanks so much! MSFT's tool no longer finds the spyware. The computer still appears to be very slow in browsing the web (IE in particular). If the computer is still more sluggish than normal in a few days, I'll inquire further in the appropriate section of the site. Thanks again, Christianb