Tech Support banner

Status
Not open for further replies.
1 - 20 of 40 Posts

·
Registered
Joined
·
28 Posts
Discussion Starter · #1 ·
I used the hijack analyzer.
====================================================================
Log was analyzed using KRC HijackThis Analyzer - Updated on 8/4/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of HijackThis v1.99.1
Scan saved at 8:18:38 AM, on 9/15/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr_______.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\WINDOWS\system32\SLEE503.exe
C:\Documents and Settings\DAD\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.earthlink.net/AL/Search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.usatoday.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.earthlink.net/AL/Search
R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll
R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: ElnkScamBHO Class - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: ElnkPubBHO Class - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink TotalAccess\Toolbar\ElnkPuB.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: ElnkProtectionBHO Class - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink TotalAccess\Toolbar\ProtctIE.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O2 - BHO: ElnkLegacyUninstBHO Class - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink TotalAccess\Toolbar\uninsttb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr_______.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [SpyBlocs3.0] C:\Program Files\SpyBlocsv3.0\SpyBlocs3.0.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [SAFE6_SAFE] "C:\Program Files\Steganos Safe 6\safe.exe" /booting
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: winlogin.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\tmpUpgrade\..\EmpirePoker.exe
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\tmpUpgrade\..\EmpirePoker.exe
O9 - Extra button: The Gaming Club Poker - {A18AC347-2CA3-4e5d-AB86-33BFC7EEB931} - C:\Program Files\gamingclubMPP\MPPoker.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\tmpUpgrade\..\PartyPoker.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\tmpUpgrade\..\PartyPoker.exe
O12 - Plugin for .mp4: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/4h/player.virtools.com/downloads/player/Install3.0/Installer.exe
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O20 - AppInit_DLLs: jths8he1wtmljzl.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: Steganos Live Encryption Engine (Version 503) [Service] (SLEE_503_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE503.exe


End of KRC HijackThis Analyzer Log.
====================================================================
 

·
Registered
Joined
·
6,574 Posts
Hi and Welcome to TSF!

Please subscribe to this thread to be notified of fixes as soon as they are posted by our Team. To do this, please click the "Thread Tools" button located in the original thread line and selecting "Subscribe to this Thread".

Save the next instructions in notepad, because you also have to work in safe mode without networking support, so this page wouldn't be available then. You should not have any browsers on.

If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are carrying out the procedures below.

It is also important you don't miss a step and perform everything in the right order!!. .

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

Please download these additional files/programs. Do not run them unless instructed to do so.
Unless otherwise stated, they should be stored in same directory as the HiJackThis program.

Please download Ad-aware at http://www.lavasoftusa.com/ and install it if you don't have it already. Make sure it's the newest version and check for any updates before running it. Also go to http://www.lavasoftusa.com/software/addons/vx2cleaner.shtml to download the plug-in for fixing VX2 variants. To run this tool, go into Ad-aware->Add-ons and select VX2 Cleaner. Then click Run Tool and OK to start it. If it's clean, it will say Status System Clean. Otherwise, you will have to click on the Clean button to remove the VX2 infection. Also make sure to customize the settings in Ad-aware at http://www.greyknight17.com/spyware.htm#adaware for better scan results. Run the scan and fix everything that it finds.

Download and install Spybot S&D http://security.kolla.de/. Run Spybot and click on the 'Search for Updates' button. Install any updates that are available.

Now click Mode menu and choose 'Advanced Mode'. Next click on Immunize to your left. Click the Immunize button (green cross) on top to Immunize your computer - you should do this each time there is an update. Now go to Tools->Resident. Make sure you enable TeaTimer after we are done. Do NOT enable Spybot TeaTimer Resident protection at this time. What this will do is monitor any system/registry changes and will ask you for permission to change any of these settings. It may also hinder our fix at this point. You may enable it after the fix is complete.

Now click on the 'Spybot-S&D' option on the top left to go back to the main screen. Next click on the 'Check for Problems' button. Let it run the scan. If it finds something, check all those in RED and hit the 'Fix Selected Problems' button. Exit Spybot. If you keep getting the DSO Exploit entries, even after you updated Windows and fixed them, then download the Spybot DSO Exploit Fix http://majorgeeks.com/download4392.html and install it over the current Spybot installation.

Download CWShredder at http://www.greyknight17.com/spy/CWShredder.exe and run it. Click on 'I Agree' button if you agree. Click on 'Fix' (it will automatically fix anything it finds for you) and then click OK. If it asks if you want to delete a certain random file, choose No and post that filename here. Let it finish the scan and then hit Next and Exit.

Unplug your computer from the Internet when you have finished downloading

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

REBOOT TO SAFE MODE
  1. Restart the computer. The computer begins processing a set of instructions known as BIOS.
  2. As soon as the BIOS has finished loading, begin tapping the F8 key on your keyboard.
  3. Continue to do so until the 'Windows Advanced Options' menu appears.
  4. Using the arrow keys on the keyboard, scroll to and select the menu item - Safe Mode.

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

Enable the viewing of Hidden files
  1. From Windows Explorer, go to Tools>Folder Options>View tab.
  2. Enable the option for `Show hidden files and folder´
  3. Disable the option for `Hide file extensions for known types´
  4. Disable the option for `Hide protected operating system files´
  5. Click Yes to confirm & then click OK

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

Start HiJackThis & go to Config>Misc Tools> Open process manager
Select the following and click Kill process one at a time. * Some entries may not be present
  • C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr_______.exe

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

Uninstall the following programs, if present, using Control Panel > Add/Remove Programs :
  • Viewpoint
    SpyBlocsv3.0

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

Run a scan with HiJackThis & select(tick) the following & click [Fix checked] :

R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr_______.exe
O4 - HKLM\..\Run: [SpyBlocs3.0] C:\Program Files\SpyBlocsv3.0\SpyBlocs3.0.exe
O4 - Global Startup: winlogin.exe
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712...0/Installer.exe
O20 - AppInit_DLLs: jths8he1wtmljzl.dll.dll.dll.dll.dll.dll.dll.dll.dl l.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll. dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dl l.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll. dll.dll.dll


= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

Locate and delete the following folder(s), if present:
  • C:\Program Files\Viewpoint\
    C:\Program Files\SpyBlocsv3.0\
Locate and delete the following file(s), if present:
  • C:\WINDOWS\system32\winlogin.exe
    C:\WINDOWS\system32\win32sockdrv.dll
    C:\WINDOWS\system32\yuetyutr.dll
Search for & delete ... using Start> Search... the following file(s), if present:
  • jths8he1wtmljzl.dll

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

REBOOT TO NORMAL MODE

Do an online scan at one of the following sites:
Take note the names and locations of any file it detects but fails to clean.
* Turn off the real time scanner of any existing antivirus program while performing the online scan

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

In your next post, please include fresh logs from:
  1. HiJackThis
  2. Online scan
Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now
 

·
Registered
Joined
·
28 Posts
Discussion Starter · #3 ·
Thanks for the help.

First I wasnt able to get rid of 04 global startup winlogin
Also wouldnt let me delete c:windows/system32/winlogin.exe

Nothing showed up on spybot, I had an earlier version I usually ran, but updated

Here is the results for Panda activescan and newest hijack


Incident Status Location

Adware:adware/superspider No disinfected C:\PROGRAM FILES\q330994.exe
Spyware:spyware/bridge No disinfected C:\WINDOWS\SYSTEM32\bridge.dll
Adware:adware/cws.searchmeup No disinfected C:\WINDOWS\mstasks1.exe
Adware:adware/msxmidi No disinfected C:\WINDOWS\msxmidi.exe
Spyware:spyware/new.net No disinfected C:\WINDOWS\NDNuninstall6_22.exe
Adware:adware/startpage.id No disinfected C:\WINDOWS\nem216.dll
Spyware:Spyware/New.net No disinfected C:\WINDOWS\NDNuninstall6_22.exe
Spyware:Spyware/New.net No disinfected C:\WINDOWS\NDNuninstall6_30-1.exe
Logfile of HijackThis v1.99.1
Scan saved at 7:17:15 PM, on 9/15/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\SLEE503.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Steganos Safe 6\safe.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\BigFix\BigFix.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\DAD\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.earthlink.net/AL/Search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.usatoday.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.earthlink.net/AL/Search
R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll
R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: ElnkScamBHO Class - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: ElnkPubBHO Class - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink TotalAccess\Toolbar\ElnkPuB.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: ElnkProtectionBHO Class - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink TotalAccess\Toolbar\ProtctIE.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O2 - BHO: ElnkLegacyUninstBHO Class - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink TotalAccess\Toolbar\uninsttb.dll
O3 - Toolbar: Pa&nicware Pop-Up Stopper Pro - {B1E741E7-1E77-40D4-9FD8-51949B9CCBD0} - C:\Program Files\Panicware\Pop-Up Stopper Pro\popuppro.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [SAFE6_SAFE] "C:\Program Files\Steganos Safe 6\safe.exe" /booting
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: winlogin.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\tmpUpgrade\..\EmpirePoker.exe
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\tmpUpgrade\..\EmpirePoker.exe
O9 - Extra button: The Gaming Club Poker - {A18AC347-2CA3-4e5d-AB86-33BFC7EEB931} - C:\Program Files\gamingclubMPP\MPPoker.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\tmpUpgrade\..\PartyPoker.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\tmpUpgrade\..\PartyPoker.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mp4: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: Steganos Live Encryption Engine (Version 503) [Service] (SLEE_503_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE503.exe

Thanks
 

·
Registered
Joined
·
6,574 Posts
Welcome Back

Save the next instructions in notepad, because you also have to work in safe mode without networking support, so this page wouldn't be available then. You should not have any browsers on.

If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are carrying out the procedures below.

It is also important you don't miss a step and perform everything in the right order!!. .

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

Please download these additional files/programs. Do not run them unless instructed to do so.
Unless otherwise stated, they should be stored in same directory as the HiJackThis program.

Download KillBox http://www.greyknight17.com/spy/KillBox.exe. Save it to the same directory as HTJ.

Please download CleanUp! (Alternate Link if main link don't work - http://www.greyknight17.com/spy/CleanUp.exe ) and install it. Do not run it yet!

Please download Trend Micro™ Anti-Spyware for the Web Utility (by clicking the "Scan and Clean your PC" button).
  • Save it to your desktop.
  • Double-click the new icon on your desktop (tmas-web-scan.exe)
  • It will say "Loading TrendMicro definitions".
  • Once the definitions are loaded, the program will appear to close then re-open.
  • Click "Start Scan"
  • After it's done scanning, click "Scan Results"
  • Make sure all items found have a check next to them, then click "Clean Threats Now".
  • Click Exit.
Reboot your computer. In place of the TrendMicro icon will be a text file called "Antispyware.log", please double-click that log and copy the entire contents and paste them in your next post.


Unplug your computer from the Internet when you have finished downloading

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

REBOOT TO SAFE MODE
  1. Restart the computer. The computer begins processing a set of instructions known as BIOS.
  2. As soon as the BIOS has finished loading, begin tapping the F8 key on your keyboard.
  3. Continue to do so until the 'Windows Advanced Options' menu appears.
  4. Using the arrow keys on the keyboard, scroll to and select the menu item - Safe Mode.

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

Enable the viewing of Hidden files
  1. From Windows Explorer, go to Tools>Folder Options>View tab.
  2. Enable the option for `Show hidden files and folder´
  3. Disable the option for `Hide file extensions for known types´
  4. Disable the option for `Hide protected operating system files´
  5. Click Yes to confirm & then click OK

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

Run KillBox and check the box that says 'End Explorer Shell While Killing File'. Next click on 'Delete on Reboot'. For each of the following files below, check the box that says 'Unregister .dll Before Deleting' if it's not grayed out. Copy and paste each of the following into KillBox (hitting the X button for each file - Choose YES when informs you the file will be deleted on Reboot. Choose NO when it asks if you want to reboot):

c:\windows\system32\winlogin.exe
C:\PROGRAM FILES\q330994.exe
C:\WINDOWS\SYSTEM32\bridge.dll
C:\WINDOWS\mstasks1.exe
C:\WINDOWS\msxmidi.exe
C:\WINDOWS\NDNuninstall6_22.exe
C:\WINDOWS\nem216.dll
C:\WINDOWS\NDNuninstall6_22.exe
C:\WINDOWS\NDNuninstall6_30-1.exe


= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu). Set the program up as follows:
*Click "Options..."
*Move the arrow down to "Custom CleanUp!"
*Put a check next to the following:
  • Empty Recycle Bins
  • Delete Cookies
  • Delete Prefetch files
    [X]Scan local drives for temporary files (Please uncheck this option)
  • Cleanup! All Users
Click OK
Press the CleanUp! button to start the program. Reboot/logoff when prompted.

WARNING - CleanUp! will delete all files and folders contained within Temporary Directories. If you knowingly have items you would like to keep stored in these locations, Move them now!!!

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

REBOOT TO NORMAL MODE

Run a scan with HiJackThis & select(tick) the following & click [Fix checked] :

O4 - Global Startup: winlogin.exe

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

Do an online scan at one of the following sites:
Take note the names and locations of any file it detects but fails to clean.
* Turn off the real time scanner of any existing antivirus program while performing the online scan

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

In your next post, please include fresh logs from:
  1. HiJackThis
  2. Online scan
  3. Antispyware.log
Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now
 

·
Registered
Joined
·
28 Posts
Discussion Starter · #5 ·
Thanks

I still couldnt get 04 global to delete

Had to post in two parts

Logfile of HijackThis v1.99.1
Scan saved at 3:11:31 AM, on 9/16/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\system32\SLEE503.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\TrojanHunter 4.2\THGuard.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\BigFix\BigFix.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\DAD\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.earthlink.net/AL/Search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.usatoday.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.earthlink.net/AL/Search
R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll
R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: ElnkScamBHO Class - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: ElnkPubBHO Class - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink TotalAccess\Toolbar\ElnkPuB.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: ElnkProtectionBHO Class - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink TotalAccess\Toolbar\ProtctIE.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O2 - BHO: ElnkLegacyUninstBHO Class - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink TotalAccess\Toolbar\uninsttb.dll
O3 - Toolbar: Pa&nicware Pop-Up Stopper Pro - {B1E741E7-1E77-40D4-9FD8-51949B9CCBD0} - C:\Program Files\Panicware\Pop-Up Stopper Pro\popuppro.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [SAFE6_SAFE] "C:\Program Files\Steganos Safe 6\safe.exe" /booting
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: winlogin.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\tmpUpgrade\..\EmpirePoker.exe
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\tmpUpgrade\..\EmpirePoker.exe
O9 - Extra button: The Gaming Club Poker - {A18AC347-2CA3-4e5d-AB86-33BFC7EEB931} - C:\Program Files\gamingclubMPP\MPPoker.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\tmpUpgrade\..\PartyPoker.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\tmpUpgrade\..\PartyPoker.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mp4: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: Steganos Live Encryption Engine (Version 503) [Service] (SLEE_503_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE503.exe
 

·
Registered
Joined
·
28 Posts
Discussion Starter · #6 ·
Part 2 of 3
Antispyware.log

Started Scanning
Internet Cookies
Found 'insightexpressai.com' in 'Internet Explorer Cache'
Found 'hc2.humanclick.com' in 'Internet Explorer Cache'
Found 'com.com' in 'Internet Explorer Cache'
Found 'keywordmax.com' in 'Internet Explorer Cache'
Found 'hc2.humanclick.com' in 'Internet Explorer Cache'
Found 'go.com' in 'Internet Explorer Cache'
Found 'ad.yieldmanager.com' in 'Internet Explorer Cache'
Programs in Memory
Windows Registry
Found '' in 'SOFTWARE\iMesh'
Found '' in 'SOFTWARE\LimeWire'
Found '' in 'Software\iMesh'
Found '' in 'SOFTWARE\Magnet'
Found '' in 'SOFTWARE\Classes\magnet'
Found '' in 'SOFTWARE\Classes\magnet\shell\open\command'
Found 'URL Protocol' in 'SOFTWARE\Classes\magnet'
Found '' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1'
Found '' in 'Software\Microsoft\Internet Explorer\Explorer Bars\{30D02401-6A81-11D0-8274-00C04FD5AE38}'
Internet URL Shortcuts
Files and Directories
Found '' in 'C:\Casino'
Found 'Mss32.dll' in 'C:\Program Files\gamingclubMPP'
Found '' in 'C:\Program Files\iMesh'
Found 'LimeWire20.dll' in 'C:\Program Files\LimeWire'
Found 'account0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'account1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'account2.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but0_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but0_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but12_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but12_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but13_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but13_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but14_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but14_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but16_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but16_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but17_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but17_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but18_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but18_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but20_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but20_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but21_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but21_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but22_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but22_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but23_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but23_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but24_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but24_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but25_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but25_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but37_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but37_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but38_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but38_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but3_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but3_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but42_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but42_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but44_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but44_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'But48_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'But48_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but49_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but49_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but51_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but51_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but52_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but52_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but55_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but55_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but56_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but56_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'But57_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'But57_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but58_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'But58_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'But59_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'But59_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but5_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but5_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'But60_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'But60_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but61_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but61_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but9999_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'but9999_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'cash_BD0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'cash_BD1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'cash_confirm0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'cash_confirm1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'cash_hist0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'cash_hist1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'cash_Mail0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'cash_Mail1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'cash_Policy0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'cash_Policy1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'cash_req0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'cash_req1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'cash_Reverse0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'cash_Reverse1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'cash_submit0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'cash_submit1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'cash_submit2.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'cc_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'cc_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'clear0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'clear1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'convert0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'convert1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'convert2.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'CVCHelp0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'CVCHelp1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'CVCHelp2.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'cvv2.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'cvv2_Dis.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'Depfont0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'Depfont1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'depositby.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'empty_0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'empty_1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'Fax0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'fax1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'GoBack0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'GoBack1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'Lower_Or.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'phone0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'phone1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'Secured.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'statics.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'submit0.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'submit1.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'TitleSub.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'title_cashoutHistory.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'title_CashoutPolicy.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'title_CashReq.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'title_CC.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'Title_Point.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'Title_ReverseBankroll.bmp' in 'C:\Program Files\PacificPoker\Cash\media'
Found 'name_font.bmp' in 'C:\Program Files\PacificPoker\media'
Found 'Shared_.dll' in 'C:\Program Files\PacificPoker'
Found 'FlashAX.inf' in 'C:\WINDOWS\inf'
Found 'NDNuninstall6_22.exe' in 'C:\WINDOWS'
Found 'NDNuninstall6_30-1.exe' in 'C:\WINDOWS'
Finished Scanning
Started Backup
Finished Backup
Started Cleaning
Checking for 'C:\Casino' in shortcut areas.
Checking for 'C:\Casino' in startup areas.
Cleaning 'C:\Casino'
Checking for 'C:\Casino\Sportfanatik.com Poker\browser.exe' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\browser.exe' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\browser.exe'
Checking for 'C:\Casino\Sportfanatik.com Poker\cam.cas' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\cam.cas' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\cam.cas'
Checking for 'C:\Casino\Sportfanatik.com Poker\cardlib.dll' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\cardlib.dll' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\cardlib.dll'
Checking for 'C:\Casino\Sportfanatik.com Poker\common.dll' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\common.dll' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\common.dll'
Checking for 'C:\Casino\Sportfanatik.com Poker\countries.lst' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\countries.lst' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\countries.lst'
Checking for 'C:\Casino\Sportfanatik.com Poker\creditdebit.dll' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\creditdebit.dll' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\creditdebit.dll'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\bj_arrow.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\bj_arrow.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\bj_arrow.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\butt_arrowdown.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\butt_arrowdown.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\butt_arrowdown.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\butt_arrowup.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\butt_arrowup.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\butt_arrowup.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\butt_calc.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\butt_calc.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\butt_calc.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\butt_drop.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\butt_drop.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\butt_drop.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\but_browse.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\but_browse.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\but_browse.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\but_check.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\but_check.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\but_check.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\but_check_blue.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\but_check_blue.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\but_check_blue.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\but_close.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\but_close.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\but_close.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\but_folderup.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\but_folderup.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\but_folderup.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\but_join.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\but_join.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\but_join.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\but_ok.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\but_ok.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\but_ok.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\but_radio_blue.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\but_radio_blue.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\but_radio_blue.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\but_stnd_130.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\but_stnd_130.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\but_stnd_130.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\but_stnd_nrm.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\but_stnd_nrm.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\but_stnd_nrm.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\but_tournament.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\but_tournament.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\but_tournament.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\but_trans.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\but_trans.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\but_trans.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\cardback.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\cardback.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\cardback.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\card_anim.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\card_anim.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\card_anim.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\caret.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\caret.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\caret.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\cashier_bkg.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\cashier_bkg.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\cashier_bkg.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\cashier_nav.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\cashier_nav.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\cashier_nav.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\dice_anim2.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\dice_anim2.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\dice_anim2.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\download_anim.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\download_anim.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\download_anim.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\download_bkg.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\download_bkg.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\download_bkg.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\download_button.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\download_button.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\download_button.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\drop_down_banking.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\drop_down_banking.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\drop_down_banking.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\drop_down_live_help.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\drop_down_live_help.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\drop_down_live_help.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\drop_down_more_games.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\drop_down_more_games.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\drop_down_more_games.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\drop_down_promos.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\drop_down_promos.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\drop_down_promos.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\edit.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\edit.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\edit.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\font16fet.xbf' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\font16fet.xbf' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\font16fet.xbf'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\font_main.xbf' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\font_main.xbf' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\font_main.xbf'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\guest_book.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\guest_book.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\guest_book.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\guest_book_buttons.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\guest_book_buttons.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\guest_book_buttons.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\hand_cursor.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\hand_cursor.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\hand_cursor.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\icon_forfun.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\icon_forfun.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\icon_forfun.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\icon_forfun_small.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\icon_forfun_small.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\icon_forfun_small.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\icon_mtt.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\icon_mtt.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\icon_mtt.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\icon_sc.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\icon_sc.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\icon_sc.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\icon_sc_small.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\icon_sc_small.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\icon_sc_small.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\icon_tournament.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\icon_tournament.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\icon_tournament.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\icon_tx.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\icon_tx.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\icon_tx.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\icon_tx_small.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\icon_tx_small.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\icon_tx_small.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\info.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\info.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\info.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\install_bkg.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\install_bkg.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\install_bkg.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\install_butt.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\install_butt.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\install_butt.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\install_check.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\install_check.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\install_check.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\jt_forfun_listtitles.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\jt_forfun_listtitles.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\jt_forfun_listtitles.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\jt_mtt_listtitles.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\jt_mtt_listtitles.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\jt_mtt_listtitles.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\jt_sc5_icon.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\jt_sc5_icon.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\jt_sc5_icon.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\jt_sc_icon.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\jt_sc_icon.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\jt_sc_icon.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\jt_sc_listtitles.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\jt_sc_listtitles.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\jt_sc_listtitles.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\jt_tournament_listtitles.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\jt_tournament_listtitles.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\jt_tournament_listtitles.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\jt_tx5_icon.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\jt_tx5_icon.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\jt_tx5_icon.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\jt_tx_icon.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\jt_tx_icon.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\jt_tx_icon.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\jt_tx_listtitles.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\jt_tx_listtitles.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\jt_tx_listtitles.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\login.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\login.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\login.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\main_bkg.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\main_bkg.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\main_bkg.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\main_blind_level.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\main_blind_level.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\main_blind_level.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\main_blind_structure.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\main_blind_structure.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\main_blind_structure.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\main_filter_buttons.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\main_filter_buttons.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\main_filter_buttons.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\main_infowin.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\main_infowin.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\main_infowin.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\main_listbkg.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\main_listbkg.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\main_listbkg.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\main_listhi.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\main_listhi.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\main_listhi.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\main_name.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\main_name.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\main_name.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\main_name_bar.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\main_name_bar.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\main_name_bar.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\main_vert_line.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\main_vert_line.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\main_vert_line.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\mark_s_low.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\mark_s_low.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\mark_s_low.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\mark_s_std.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\mark_s_std.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\mark_s_std.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\msg_icons.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\msg_icons.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\msg_icons.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\mtt_filter_buttons.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\mtt_filter_buttons.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\mtt_filter_buttons.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\mt_icon_small.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\mt_icon_small.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\mt_icon_small.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\panel_bigchat.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\panel_bigchat.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\panel_bigchat.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\panel_buttons.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\panel_buttons.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\panel_buttons.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\panel_chat.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\panel_chat.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\panel_chat.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\panel_chatbuttons.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\panel_chatbuttons.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\panel_chatbuttons.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\panel_downbutton.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\panel_downbutton.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\panel_downbutton.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\panel_mainlobby.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\panel_mainlobby.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\panel_mainlobby.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\panel_newgame.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\panel_newgame.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\panel_newgame.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\panel_options.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\panel_options.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\panel_options.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\player_boubles.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\player_boubles.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\player_boubles.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\player_icons.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\player_icons.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\player_icons.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\player_icons2.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\player_icons2.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\player_icons2.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\player_namebox.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\player_namebox.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\player_namebox.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\pointer.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\pointer.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\pointer.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_betslider.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_betslider.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\poker_betslider.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_but.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_but.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\poker_but.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_but_130.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_but_130.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\poker_but_130.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_but_bet.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_but_bet.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\poker_but_bet.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_but_labels.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_but_labels.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\poker_but_labels.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_cards.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_cards.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\poker_cards.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_cardsymbols.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_cardsymbols.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\poker_cardsymbols.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_compstatus.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_compstatus.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\poker_compstatus.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_deckside.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_deckside.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\poker_deckside.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_makechoice.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_makechoice.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\poker_makechoice.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_playnextround.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_playnextround.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\poker_playnextround.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_popup.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_popup.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\poker_popup.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_popup_potinfo.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_popup_potinfo.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\poker_popup_potinfo.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_popup_small.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_popup_small.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\poker_popup_small.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_popup_tablelimit.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_popup_tablelimit.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\poker_popup_tablelimit.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_roundmeter.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_roundmeter.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\poker_roundmeter.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_seatnumbers.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_seatnumbers.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\poker_seatnumbers.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_signs.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_signs.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\poker_signs.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_topnav.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_topnav.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\poker_topnav.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_tourn_info.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_tourn_info.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\poker_tourn_info.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_waitbutton.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\poker_waitbutton.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\poker_waitbutton.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\sc_bkg5.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\sc_bkg5.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\sc_bkg5.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\sc_bkg7.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\sc_bkg7.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\sc_bkg7.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\st_icon_small.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\st_icon_small.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\st_icon_small.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\table_listtitles.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\table_listtitles.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\table_listtitles.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\tab_tableinfo.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\tab_tableinfo.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\tab_tableinfo.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\tab_tournamentinfo.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\tab_tournamentinfo.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\tab_tournamentinfo.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\timeout_dark.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\timeout_dark.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\timeout_dark.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\tournamentinfo_window.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\tournamentinfo_window.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\tournamentinfo_window.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\tournament_bkg.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\tournament_bkg.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\tournament_bkg.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\tournament_listtitles.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\tournament_listtitles.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\tournament_listtitles.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\tx_bkg5_3.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\tx_bkg5_3.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\tx_bkg5_3.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\tx_bkg7.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\tx_bkg7.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\tx_bkg7.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\tx_puck.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\tx_puck.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\tx_puck.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\upgrade_button.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\upgrade_button.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\upgrade_button.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\wd_checkbut.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\wd_checkbut.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\wd_checkbut.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\wd_forfun.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\wd_forfun.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\wd_forfun.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\win_bkg.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\win_bkg.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\win_bkg.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\win_bkggold.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\win_bkggold.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\win_bkggold.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\win_bkg_drk.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\win_bkg_drk.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\win_bkg_drk.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\win_buttons.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\win_buttons.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\win_buttons.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\win_but_long.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\win_but_long.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\win_but_long.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\win_graphics.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\win_graphics.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\win_graphics.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\win_loading.bmp' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\win_loading.bmp' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\win_loading.bmp'
Checking for 'C:\Casino\Sportfanatik.com Poker\data\win_title_bkg.jpg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\data\win_title_bkg.jpg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\data\win_title_bkg.jpg'
Checking for 'C:\Casino\Sportfanatik.com Poker\db.dll' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\db.dll' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\db.dll'
Checking for 'C:\Casino\Sportfanatik.com Poker\devlib.dll' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\devlib.dll' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\devlib.dll'
Checking for 'C:\Casino\Sportfanatik.com Poker\devlibcomm.dll' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\devlibcomm.dll' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\devlibcomm.dll'
Checking for 'C:\Casino\Sportfanatik.com Poker\filemap.lst' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\filemap.lst' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\filemap.lst'
Checking for 'C:\Casino\Sportfanatik.com Poker\games.xrs' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\games.xrs' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\games.xrs'
Checking for 'C:\Casino\Sportfanatik.com Poker\install.exe' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\install.exe' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\install.exe'
Checking for 'C:\Casino\Sportfanatik.com Poker\INSTALL.LOG' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\INSTALL.LOG' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\INSTALL.LOG'
Checking for 'C:\Casino\Sportfanatik.com Poker\licens.txt' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\licens.txt' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\licens.txt'
Checking for 'C:\Casino\Sportfanatik.com Poker\midi\casino02.mid' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\midi\casino02.mid' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\midi\casino02.mid'
Checking for 'C:\Casino\Sportfanatik.com Poker\modstatus.lst' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\modstatus.lst' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\modstatus.lst'
Checking for 'C:\Casino\Sportfanatik.com Poker\mp3dec.asi' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\mp3dec.asi' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\mp3dec.asi'
Checking for 'C:\Casino\Sportfanatik.com Poker\mss32.dll' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\mss32.dll' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\mss32.dll'
Checking for 'C:\Casino\Sportfanatik.com Poker\msvcrt.dll' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\msvcrt.dll' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\msvcrt.dll'
Checking for 'C:\Casino\Sportfanatik.com Poker\options.cfg' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\options.cfg' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\options.cfg'
Checking for 'C:\Casino\Sportfanatik.com Poker\poker.exe' in shortcut areas.
Found 'Sportfanatik.com Poker.lnk' in 'C:\Documents and Settings\DAD\Start Menu\Programs\Sportfanatik.com Poker\'
Checking for 'C:\Casino\Sportfanatik.com Poker\poker.exe' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\poker.exe'
Checking for 'C:\Casino\Sportfanatik.com Poker\sc.dll' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sc.dll' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sc.dll'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_1.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_1.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_1.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_10.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_10.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_10.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_11.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_11.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_11.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_12.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_12.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_12.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_13.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_13.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_13.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_14.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_14.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_14.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_15.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_15.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_15.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_16.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_16.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_16.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_17.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_17.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_17.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_18.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_18.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_18.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_19.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_19.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_19.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_2.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_2.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_2.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_20.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_20.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_20.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_21.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_21.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_21.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_22.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_22.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_22.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_23.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_23.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_23.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_24.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_24.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_24.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_25.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_25.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_25.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_26.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_26.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_26.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_27.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_27.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_27.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_28.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_28.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_28.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_29.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_29.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_29.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_3.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_3.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_3.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_30.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_30.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_30.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_31.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_31.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_31.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_32.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_32.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_32.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_33.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_33.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_33.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_34.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_34.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_34.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_35.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_35.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_35.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_36.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_36.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_36.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_4.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_4.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_4.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_40.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_40.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_40.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_5.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_5.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_5.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_50.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_50.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_50.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_6.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_6.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_6.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_7.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_7.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_7.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_75.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_75.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_75.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_8.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_8.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_8.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_9.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_9.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_9.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_button.wav' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_button.wav' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_button.wav'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_cardmix.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_cardmix.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_cardmix.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_chip.wav' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_chip.wav' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_chip.wav'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_deal.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_deal.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_deal.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_mkchoice.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_mkchoice.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_mkchoice.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_wins.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\c_wins.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\c_wins.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_2pair.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_2pair.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_2pair.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_ace.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_ace.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_ace.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_aces.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_aces.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_aces.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_action.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_action.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_action.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_alert.wav' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_alert.wav' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_alert.wav'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_allin.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_allin.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_allin.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_and.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_and.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_and.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_ap.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_ap.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_ap.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_bet.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_bet.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_bet.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_cent.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_cent.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_cent.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_check.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_check.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_check.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_checkknock.wav' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_checkknock.wav' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_checkknock.wav'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_coc.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_coc.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_coc.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_deuces.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_deuces.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_deuces.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_eights.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_eights.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_eights.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_fives.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_fives.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_fives.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_flush.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_flush.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_flush.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_foak.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_foak.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_foak.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_fold.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_fold.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_fold.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_force.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_force.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_force.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_fours.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_fours.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_fours.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_full.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_full.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_full.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_fullh.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_fullh.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_fullh.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_hcard.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_hcard.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_hcard.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_high.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_high.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_high.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_jack.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_jack.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_jack.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_jacks.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_jacks.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_jacks.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_kicker.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_kicker.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_kicker.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_king.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_king.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_king.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_kings.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_kings.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_kings.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_mainp.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_mainp.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_mainp.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_nines.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_nines.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_nines.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_opfor.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_opfor.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_opfor.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_pair.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_pair.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_pair.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_pairof.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_pairof.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_pairof.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_plseat.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_plseat.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_plseat.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_queen.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_queen.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_queen.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_queens.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_queens.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_queens.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_raise.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_raise.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_raise.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_rf.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_rf.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_rf.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_river.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_river.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_river.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_sevens.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_sevens.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_sevens.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_sflush.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_sflush.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_sflush.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_sidep.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_sidep.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_sidep.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_sixes.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_sixes.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_sixes.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_sppot.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_sppot.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_sppot.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_straight.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_straight.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_straight.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_tens.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_tens.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_tens.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_threes.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_threes.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_threes.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_tok.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_tok.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_tok.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_tothe.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_tothe.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_tothe.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_welcome.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\p_welcome.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\p_welcome.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\tx_flop.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\tx_flop.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\tx_flop.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\tx_pall.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\tx_pall.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\tx_pall.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\tx_polabli.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\tx_polabli.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\tx_polabli.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\tx_posmbli.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\tx_posmbli.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\tx_posmbli.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\tx_turn.mp3' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\sfx\tx_turn.mp3' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\sfx\tx_turn.mp3'
Checking for 'C:\Casino\Sportfanatik.com Poker\shfolder.dll' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\shfolder.dll' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\shfolder.dll'
Checking for 'C:\Casino\Sportfanatik.com Poker\srvmap.lst' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\srvmap.lst' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\srvmap.lst'
Checking for 'C:\Casino\Sportfanatik.com Poker\texas.dll' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\texas.dll' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\texas.dll'
Checking for 'C:\Casino\Sportfanatik.com Poker\UNWISE.EXE' in shortcut areas.
Found 'Uninstall Sportfanatik.com Poker.lnk' in 'C:\Documents and Settings\DAD\Start Menu\Programs\Sportfanatik.com Poker\'
Checking for 'C:\Casino\Sportfanatik.com Poker\UNWISE.EXE' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\UNWISE.EXE'
Checking for 'C:\Casino\Sportfanatik.com Poker\update.exe' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\update.exe' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\update.exe'
Checking for 'C:\Casino\Sportfanatik.com Poker\xml.dll' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\xml.dll' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\xml.dll'
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\common.xrs' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\common.xrs' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\xrs\common.xrs'
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\creditdebit.xrs' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\creditdebit.xrs' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\xrs\creditdebit.xrs'
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\filemap.xrs' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\filemap.xrs' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\xrs\filemap.xrs'
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\forfun_join.xrs' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\forfun_join.xrs' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\xrs\forfun_join.xrs'
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\game_panel_sc.xrs' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\game_panel_sc.xrs' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\xrs\game_panel_sc.xrs'
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\game_panel_tx.xrs' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\game_panel_tx.xrs' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\xrs\game_panel_tx.xrs'
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\ingame_join.xrs' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\ingame_join.xrs' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\xrs\ingame_join.xrs'
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\install.xrs' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\install.xrs' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\xrs\install.xrs'
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\mc_main.xrs' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\mc_main.xrs' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\xrs\mc_main.xrs'
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\message.xrs' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\message.xrs' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\xrs\message.xrs'
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\mtt_join.xrs' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\mtt_join.xrs' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\xrs\mtt_join.xrs'
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\mtt_lobby.xrs' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\mtt_lobby.xrs' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\xrs\mtt_lobby.xrs'
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\optdef.xrs' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\optdef.xrs' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\xrs\optdef.xrs'
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\poker_limits.xrs' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\poker_limits.xrs' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\xrs\poker_limits.xrs'
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\sc_join.xrs' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\sc_join.xrs' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\xrs\sc_join.xrs'
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\sc_main.xrs' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\sc_main.xrs' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\xrs\sc_main.xrs'
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\texas_join.xrs' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\texas_join.xrs' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\xrs\texas_join.xrs'
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\texas_main.xrs' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\texas_main.xrs' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\xrs\texas_main.xrs'
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\tournament_join.xrs' in shortcut areas.
Checking for 'C:\Casino\Sportfanatik.com Poker\xrs\tournament_join.xrs' in startup areas.
Cleaning 'C:\Casino\Sportfanatik.com Poker\xrs\tournament_join.xrs'
Checking for 'C:\Program Files\gamingclubMPP\Mss32.dll' in shortcut areas.
Checking for 'C:\Program Files\gamingclubMPP\Mss32.dll' in startup areas.
Cleaning 'C:\Program Files\gamingclubMPP\Mss32.dll'
Checking for 'C:\Program Files\iMesh' in shortcut areas.
Checking for 'C:\Program Files\iMesh' in startup areas.
Cleaning 'C:\Program Files\iMesh'
Checking for 'C:\Program Files\LimeWire\LimeWire20.dll' in shortcut areas.
Checking for 'C:\Program Files\LimeWire\LimeWire20.dll' in startup areas.
Cleaning 'C:\Program Files\LimeWire\LimeWire20.dll'
 

·
Registered
Joined
·
28 Posts
Discussion Starter · #7 ·
Part 3 of 3

Checking for 'C:\Program Files\PacificPoker\Cash\media\account0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\account0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\account0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\account1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\account1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\account1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\account2.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\account2.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\account2.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but0_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but0_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but0_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but0_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but0_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but0_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but12_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but12_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but12_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but12_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but12_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but12_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but13_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but13_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but13_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but13_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but13_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but13_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but14_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but14_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but14_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but14_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but14_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but14_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but16_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but16_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but16_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but16_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but16_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but16_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but17_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but17_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but17_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but17_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but17_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but17_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but18_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but18_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but18_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but18_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but18_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but18_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but20_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but20_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but20_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but20_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but20_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but20_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but21_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but21_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but21_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but21_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but21_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but21_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but22_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but22_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but22_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but22_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but22_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but22_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but23_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but23_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but23_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but23_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but23_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but23_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but24_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but24_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but24_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but24_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but24_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but24_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but25_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but25_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but25_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but25_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but25_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but25_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but37_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but37_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but37_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but37_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but37_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but37_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but38_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but38_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but38_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but38_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but38_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but38_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but3_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but3_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but3_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but3_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but3_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but3_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but42_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but42_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but42_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but42_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but42_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but42_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but44_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but44_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but44_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but44_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but44_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but44_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\But48_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\But48_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\But48_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\But48_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\But48_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\But48_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but49_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but49_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but49_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but49_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but49_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but49_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but51_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but51_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but51_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but51_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but51_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but51_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but52_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but52_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but52_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but52_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but52_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but52_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but55_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but55_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but55_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but55_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but55_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but55_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but56_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but56_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but56_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but56_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but56_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but56_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\But57_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\But57_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\But57_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\But57_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\But57_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\But57_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but58_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but58_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but58_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\But58_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\But58_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\But58_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\But59_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\But59_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\But59_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\But59_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\But59_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\But59_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but5_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but5_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but5_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but5_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but5_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but5_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\But60_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\But60_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\But60_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\But60_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\But60_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\But60_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but61_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but61_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but61_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but61_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but61_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but61_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but9999_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but9999_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but9999_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\but9999_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\but9999_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\but9999_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_BD0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_BD0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\cash_BD0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_BD1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_BD1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\cash_BD1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_confirm0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_confirm0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\cash_confirm0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_confirm1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_confirm1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\cash_confirm1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_hist0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_hist0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\cash_hist0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_hist1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_hist1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\cash_hist1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_Mail0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_Mail0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\cash_Mail0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_Mail1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_Mail1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\cash_Mail1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_Policy0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_Policy0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\cash_Policy0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_Policy1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_Policy1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\cash_Policy1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_req0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_req0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\cash_req0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_req1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_req1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\cash_req1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_Reverse0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_Reverse0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\cash_Reverse0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_Reverse1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_Reverse1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\cash_Reverse1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_submit0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_submit0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\cash_submit0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_submit1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_submit1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\cash_submit1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_submit2.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\cash_submit2.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\cash_submit2.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\cc_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\cc_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\cc_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\cc_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\cc_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\cc_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\clear0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\clear0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\clear0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\clear1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\clear1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\clear1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\convert0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\convert0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\convert0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\convert1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\convert1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\convert1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\convert2.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\convert2.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\convert2.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\CVCHelp0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\CVCHelp0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\CVCHelp0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\CVCHelp1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\CVCHelp1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\CVCHelp1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\CVCHelp2.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\CVCHelp2.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\CVCHelp2.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\cvv2.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\cvv2.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\cvv2.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\cvv2_Dis.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\cvv2_Dis.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\cvv2_Dis.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\Depfont0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\Depfont0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\Depfont0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\Depfont1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\Depfont1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\Depfont1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\depositby.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\depositby.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\depositby.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\empty_0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\empty_0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\empty_0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\empty_1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\empty_1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\empty_1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\Fax0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\Fax0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\Fax0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\fax1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\fax1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\fax1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\GoBack0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\GoBack0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\GoBack0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\GoBack1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\GoBack1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\GoBack1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\Lower_Or.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\Lower_Or.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\Lower_Or.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\phone0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\phone0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\phone0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\phone1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\phone1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\phone1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\Secured.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\Secured.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\Secured.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\statics.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\statics.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\statics.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\submit0.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\submit0.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\submit0.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\submit1.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\submit1.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\submit1.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\TitleSub.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\TitleSub.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\TitleSub.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\title_cashoutHistory.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\title_cashoutHistory.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\title_cashoutHistory.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\title_CashoutPolicy.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\title_CashoutPolicy.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\title_CashoutPolicy.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\title_CashReq.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\title_CashReq.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\title_CashReq.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\title_CC.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\title_CC.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\title_CC.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\Title_Point.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\Title_Point.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\Title_Point.bmp'
Checking for 'C:\Program Files\PacificPoker\Cash\media\Title_ReverseBankroll.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Cash\media\Title_ReverseBankroll.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Cash\media\Title_ReverseBankroll.bmp'
Checking for 'C:\Program Files\PacificPoker\media\name_font.bmp' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\media\name_font.bmp' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\media\name_font.bmp'
Checking for 'C:\Program Files\PacificPoker\Shared_.dll' in shortcut areas.
Checking for 'C:\Program Files\PacificPoker\Shared_.dll' in startup areas.
Cleaning 'C:\Program Files\PacificPoker\Shared_.dll'
Checking for 'C:\WINDOWS\inf\FlashAX.inf' in shortcut areas.
Checking for 'C:\WINDOWS\inf\FlashAX.inf' in startup areas.
Cleaning 'C:\WINDOWS\inf\FlashAX.inf'
Checking for 'C:\WINDOWS\NDNuninstall6_22.exe' in shortcut areas.
Checking for 'C:\WINDOWS\NDNuninstall6_22.exe' in startup areas.
Cleaning 'C:\WINDOWS\NDNuninstall6_22.exe'
Checking for 'C:\WINDOWS\NDNuninstall6_30-1.exe' in shortcut areas.
Checking for 'C:\WINDOWS\NDNuninstall6_30-1.exe' in startup areas.
Cleaning 'C:\WINDOWS\NDNuninstall6_30-1.exe'
Finished Cleaning


Incident Status Location

Adware:adware/superspider No disinfected C:\WINDOWS\SYSTEM32\a.exe


Thanks
 

·
Registered
Joined
·
6,574 Posts
Use Killbox again with the same settings:

C:\WINDOWS\SYSTEM32\a.exe
C:\WINDOWS\SYSTEM32\winlogin.exe


Fix this in HJT:

O4 - Global Startup: winlogin.exe


And reboot your computer.

TMAS did a good job, there was lots for it to clean so i'd like you to run it again to make sure it's done it's job properly..

When done - re run HJT and post the results.
 

·
Registered
Joined
·
28 Posts
Discussion Starter · #9 ·
Ok computer is still shutting off

HJ wont delete 04 global says it is running

This came up on my symantec scan:

Virus name: Backdoor.Graybird
File: C:\DOCUME~1\DAD\LOCALS~1\Temp\mc21.tmp

twas was clean

Here is HJ log

Logfile of HijackThis v1.99.1
Scan saved at 9:53:15 AM, on 9/16/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\system32\SLEE503.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\TrojanHunter 4.2\THGuard.exe
C:\Program Files\Steganos Safe 6\safe.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\BigFix\BigFix.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\DAD\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.earthlink.net/AL/Search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.usatoday.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.earthlink.net/AL/Search
R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll
R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: ElnkScamBHO Class - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: ElnkPubBHO Class - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink TotalAccess\Toolbar\ElnkPuB.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: ElnkProtectionBHO Class - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink TotalAccess\Toolbar\ProtctIE.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O2 - BHO: ElnkLegacyUninstBHO Class - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink TotalAccess\Toolbar\uninsttb.dll
O3 - Toolbar: Pa&nicware Pop-Up Stopper Pro - {B1E741E7-1E77-40D4-9FD8-51949B9CCBD0} - C:\Program Files\Panicware\Pop-Up Stopper Pro\popuppro.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [SAFE6_SAFE] "C:\Program Files\Steganos Safe 6\safe.exe" /booting
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: winlogin.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\tmpUpgrade\..\EmpirePoker.exe
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\tmpUpgrade\..\EmpirePoker.exe
O9 - Extra button: The Gaming Club Poker - {A18AC347-2CA3-4e5d-AB86-33BFC7EEB931} - C:\Program Files\gamingclubMPP\MPPoker.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\tmpUpgrade\..\PartyPoker.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\tmpUpgrade\..\PartyPoker.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mp4: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: Steganos Live Encryption Engine (Version 503) [Service] (SLEE_503_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE503.exe

Thanks
 

·
Registered
Joined
·
6,574 Posts
I could be on a wild goose chase here... Two Virus scanners have ignored winlogin, so I'm assuming it's the LEGIT one, and not one of the two viruses.

Please download CleanUp! (Alternate Link if main link don't work - http://www.greyknight17.com/spy/CleanUp.exe ) and install it. Do not run it yet!

Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu). Set the program up as follows:
*Click "Options..."
*Move the arrow down to "Custom CleanUp!"
*Put a check next to the following:
  • Empty Recycle Bins
  • Delete Cookies
  • Delete Prefetch files
    [X]Scan local drives for temporary files (Please uncheck this option)
  • Cleanup! All Users
Click OK
Press the CleanUp! button to start the program. Reboot/logoff when prompted.

WARNING - CleanUp! will delete all files and folders contained within Temporary Directories. If you knowingly have items you would like to keep stored in these locations, Move them now!!!
 

·
Registered
Joined
·
6,574 Posts
Download the WinloginRemove.zip file and save it to your hard drive (you may want to right click and use Save Target As). Extract WinloginRemove.exe from the ZIP and run it. There is no installer or uninstaller. Simply delete the WinloginRemove.exe file to uninstall.

Run HJT and fix the associated 04 and reboot. Re scan and submit and new HJT log.
 

·
Registered
Joined
·
28 Posts
Discussion Starter · #14 ·
Thanks

I ran that and it said no occurences found
Do I need to be in safe mode to run it?

Also the associated 04 is that just the global 04?

And when you say rescan - do I rescan just with Hijack?
 

·
Registered
Joined
·
6,574 Posts

·
Registered
Joined
·
28 Posts
Discussion Starter · #17 ·
OK thanks

Here is log

Logfile of HijackThis v1.99.1
Scan saved at 10:46:12 AM, on 9/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\system32\SLEE503.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\DAD\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.earthlink.net/AL/Search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.usatoday.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.earthlink.net/AL/Search
R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll
R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: ElnkScamBHO Class - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: ElnkPubBHO Class - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink TotalAccess\Toolbar\ElnkPuB.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: ElnkProtectionBHO Class - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink TotalAccess\Toolbar\ProtctIE.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O2 - BHO: ElnkLegacyUninstBHO Class - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink TotalAccess\Toolbar\uninsttb.dll
O3 - Toolbar: Pa&nicware Pop-Up Stopper Pro - {B1E741E7-1E77-40D4-9FD8-51949B9CCBD0} - C:\Program Files\Panicware\Pop-Up Stopper Pro\popuppro.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\tmpUpgrade\..\EmpirePoker.exe
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\tmpUpgrade\..\EmpirePoker.exe
O9 - Extra button: The Gaming Club Poker - {A18AC347-2CA3-4e5d-AB86-33BFC7EEB931} - C:\Program Files\gamingclubMPP\MPPoker.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\tmpUpgrade\..\PartyPoker.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\tmpUpgrade\..\PartyPoker.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mp4: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: Steganos Live Encryption Engine (Version 503) [Service] (SLEE_503_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE503.exe
 

·
Registered
Joined
·
6,574 Posts
Ah - we got it eventually.. Win-eto was the infection, i knew it was there - just didn't know 'exactly' which tool to use to take it out.

Are there any other problems?

Your log is clean. Well done

Do you have any more problems with your computer? If not, you should be set to go.

However, there still remains a few bits of housekeeping ...

Reset hidden/system files and folders
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View tab.
  • Deselect the Show hidden files and folders option.
  • Select the Hide file extensions for known types option.
  • Select the Hide protected operating system files option.
  • Click Yes to confirm.
  • Click OK.

Clear Java Cache
  1. Click Start >Settings>Control Panel
  2. Click the Java Plugin Icon
  3. Click the Cache tab
  4. Click the Clear button and click OK to confirm
Note: Please repeat this procedure for each "Java Plugin" button in your Control Panel

Follow the instructions outlined here to clear Sun Java's cache.


Create a new System Restore point
  • click Start >> Run - type SYSDM.CPL & press Enter
  • select the System Restore Tab
  • tick on the checkbox - "Turn off System Restore on all drives"
  • click Apply
  • then untick the same checkbox & click OK

Enable Windows Auto Update
  • Go to Start>Run - type wuaucpl.cpl
  • tick on the checkbox - "Keep my computer up to date"
  • Under settings, choose "Automatically download the updates, and install them on the schedule that I specify".
  • Click on "OK".

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:
  • SpywareBlaster to help prevent spyware from installing in the first place.
  • SpywareGuard to catch and block spyware before it can execute.
  • IESpy-Ad to block access to malicious websites so you cannot be redirected to them from an infected site or email.

If you do not have a firewall, here are 3 free ones available for personal use:

In light of your recent hiccup, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles
Have a safe & happy computing day.

Please respond to this thread one more time so we can mark this thread as resolved.
 

·
Registered
Joined
·
28 Posts
Discussion Starter · #20 ·
I had to say it but my computer is still shutting down. I left and came back it was off, the I restarted and it went off again
 
1 - 20 of 40 Posts
Status
Not open for further replies.
Top