Whitesmoke translator virus removal

piabads · January 20, 2011

Hi,

I copied this from a closed thread, but it applies to me as well. My log is below the quoted text; thank you in advance for advice!!

"I have a nasty little virus from somehow downloading whitesmoke translator, and I'm wondering how I can remove this virus. I saw in another thread about downloading ComboFix.exe, which I ran and then created a log in a text file. Below is the text from C:\ComboFix.txt. Can anyone provide me with some help to remove this virus? Thanks!"

ComboFix 11-01-18.04 - MBT 01/19/2011 12:31:41.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3582.1803 [GMT -5:00]

Running from: c:\documents and settings\MBT\My Documents\Downloads\ComboFix.exe

AV: Sophos Anti-Virus *Disabled/Updated* {3F13C776-3CBE-4DE9-8BF6-09E5183CA2BD}

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\LocalService\Application Data\whitesmoketoolbar

c:\documents and settings\LocalService\Application Data\whitesmoketoolbar\dtx.ini

c:\documents and settings\LocalService\Application Data\whitesmoketoolbar\exeArgs.xml

c:\documents and settings\LocalService\Application Data\whitesmoketoolbar\guid.dat

c:\documents and settings\LocalService\Application Data\whitesmoketoolbar\setupCfg.xml

c:\documents and settings\Mary Beth Taormina\Application Data\whitesmoketoolbar

c:\documents and settings\Mary Beth Taormina\Application Data\whitesmoketoolbar\dtx.ini

c:\documents and settings\Mary Beth Taormina\Application Data\whitesmoketoolbar\guid.dat

c:\documents and settings\Mary Beth Taormina\Application Data\whitesmoketoolbar\preferences.dat

c:\documents and settings\Mary Beth Taormina\Application Data\whitesmoketoolbar\stat.log

c:\documents and settings\Mary Beth Taormina\Application Data\whitesmoketoolbar\stats.dat

c:\documents and settings\Mary Beth Taormina\Application Data\whitesmoketoolbar\uninstallIE.dat

c:\documents and settings\Mary Beth Taormina\Application Data\whitesmoketoolbar\uninstallStatIE.dat

c:\documents and settings\Mary Beth Taormina\g2mdlhlpx.exe

c:\program files\Search Toolbar

c:\program files\Search Toolbar\icon.ico

c:\program files\Search Toolbar\SearchToolbarUninstall.exe

c:\program files\Search Toolbar\SearchToolbarUpdater.exe

c:\program files\WhiteSmoke Translator

c:\program files\WhiteSmoke Translator\buy.ico

c:\program files\WhiteSmoke Translator\ComVistaElevator.dll

c:\program files\WhiteSmoke Translator\Dictionary48x48.ico

c:\program files\WhiteSmoke Translator\html\english\common\iepngfix\blank.gif

c:\program files\WhiteSmoke Translator\html\english\common\iepngfix\checkerboard.gif

c:\program files\WhiteSmoke Translator\html\english\common\iepngfix\helix.gif

c:\program files\WhiteSmoke Translator\html\english\common\iepngfix\iepngfix.htc

c:\program files\WhiteSmoke Translator\html\english\common\iepngfix\iepngfix.html

c:\program files\WhiteSmoke Translator\html\english\common\iepngfix\opacity.png

c:\program files\WhiteSmoke Translator\html\english\common\js\common.js

c:\program files\WhiteSmoke Translator\html\english\common\js\pngfix.js

c:\program files\WhiteSmoke Translator\html\english\common\js\prototype.js

c:\program files\WhiteSmoke Translator\html\english\common\js\xmlhttp.js

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Background\ajax-loader.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Background\bottom_bg.png

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Background\bottom_left_corner.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Background\corner_bottom_left.png

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Background\corner_bottom_right.png

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Background\corner_top_left.png

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Background\corner_top_right.png

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Background\down_arrow.png

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Background\empty.jpg

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Background\input_bg.png

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Background\left_input.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Background\loading_dictionary.swf

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Background\resize.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Background\right_input.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Background\search_strip_bg3.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Buttons\dictionary_disabled.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Buttons\dictionary_over.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Buttons\dictionary_press.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Buttons\dictionary_up.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Buttons\down_arrow.png

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Buttons\go_disabled.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Buttons\go_over.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Buttons\go_press.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Buttons\go_up.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Buttons\idioms_disabled.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Buttons\idioms_over.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Buttons\idioms_press.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Buttons\idioms_up.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Buttons\thesaurus_disabled.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Buttons\thesaurus_over.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Buttons\thesaurus_press.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Buttons\thesaurus_up.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Buttons\translate_normal.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Buttons\translate_pressed.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Buttons\translate_rollover.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Buttons\translation_disabled.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Buttons\translation_over.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Buttons\translation_press.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\Buttons\translation_up.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\captionbar\caption_bar_close_down.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\captionbar\caption_bar_close_over.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\captionbar\caption_bar_close_up.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\captionbar\caption_bar_max_down.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\captionbar\caption_bar_max_over.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\captionbar\caption_bar_max_up.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\captionbar\caption_bar_min_down.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\captionbar\caption_bar_min_over.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\captionbar\caption_bar_min_up.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\captionbar\caption_dictionary_off.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\captionbar\caption_dictionary_press.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\captionbar\caption_dictionary_roll_over.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\captionbar\caption_strip.png

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\captionbar\caption_strip_right_corner.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\captionbar\caption_strip_right_corner.png

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\captionbar\caption_translation_off.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\captionbar\caption_translation_press.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\captionbar\caption_translation_roll_over.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\captionbar\logo.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\popup\screen_bg.png

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\popup\screen_bg_bottom.png

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\popup\screen_bg_top.png

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\popup\screen_captionbar_press.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\popup\screen_captionbar_up.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\img\spacer.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\index.html

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\js\common.js

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\js\Contextmenu.js

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\js\dictInterface.js

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\js\jquery.combobox.js

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\js\jquery.js

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\js\prototype.js

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\js\xmlhttp.js

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\style\combobox.css

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\style\Contextmenu.css

c:\program files\WhiteSmoke Translator\html\english\dictClientDic\style\dictionary.css

c:\program files\WhiteSmoke Translator\html\english\dictClientRegistration\img\body_bg.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientRegistration\img\captionbar\caption_bar_close_down.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientRegistration\img\captionbar\caption_bar_close_over.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientRegistration\img\captionbar\caption_bar_close_up.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientRegistration\img\captionbar\caption_strip.png

c:\program files\WhiteSmoke Translator\html\english\dictClientRegistration\img\captionbar\logo.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientRegistration\img\congra.png

c:\program files\WhiteSmoke Translator\html\english\dictClientRegistration\img\continue_button_click.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientRegistration\img\continue_button_over.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientRegistration\img\continue_button_up.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientRegistration\img\intro.jpg

c:\program files\WhiteSmoke Translator\html\english\dictClientRegistration\img\welcome.png

c:\program files\WhiteSmoke Translator\html\english\dictClientRegistration\index.html

c:\program files\WhiteSmoke Translator\html\english\dictClientRegistration\js\regInterface.js

c:\program files\WhiteSmoke Translator\html\english\dictClientRegistration\style\registration.css

c:\program files\WhiteSmoke Translator\html\english\dictClientWelcome\content\img\Background\attic\use_ws_bgNEW.PNG

c:\program files\WhiteSmoke Translator\html\english\dictClientWelcome\content\img\Background\translator-welcome-final.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientWelcome\content\img\Background\translator-welcome-final.jpg

c:\program files\WhiteSmoke Translator\html\english\dictClientWelcome\content\img\Background\translator-welcome-final.png

c:\program files\WhiteSmoke Translator\html\english\dictClientWelcome\content\img\Background\use_ws_bgNEW.jpg

c:\program files\WhiteSmoke Translator\html\english\dictClientWelcome\content\img\Background\use_ws_bgNEW.PNG

c:\program files\WhiteSmoke Translator\html\english\dictClientWelcome\content\img\buy_button.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientWelcome\content\img\caption_bar_close_down.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientWelcome\content\img\caption_bar_close_over.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientWelcome\content\img\caption_bar_close_up.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientWelcome\content\img\captionbar\arrow_white.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientWelcome\content\img\captionbar\caption_strip.png

c:\program files\WhiteSmoke Translator\html\english\dictClientWelcome\content\img\captionbar\left_bot_chunk.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientWelcome\content\img\captionbar\right_bot_chunk.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientWelcome\content\img\captionbar\white_x_button.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientWelcome\content\img\close_button.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientWelcome\content\img\close_button_down.gif

c:\program files\WhiteSmoke Translator\html\english\dictClientWelcome\content\img\expired_bg.png

c:\program files\WhiteSmoke Translator\html\english\dictClientWelcome\content\js\iframeInterface.js

c:\program files\WhiteSmoke Translator\html\english\dictClientWelcome\content\style\welcome.css

c:\program files\WhiteSmoke Translator\html\english\dictClientWelcome\content\welcome_all.html

c:\program files\WhiteSmoke Translator\html\english\dictClientWelcome\content\welcome_expired.html

c:\program files\WhiteSmoke Translator\html\english\dictClientWelcome\index.html

c:\program files\WhiteSmoke Translator\html\english\dictClientWelcome\js\welcomeInterface.js

c:\program files\WhiteSmoke Translator\html\english\dictClientWelcome\style\welcomescreen.css

c:\program files\WhiteSmoke Translator\license_agreement_translator.txt

c:\program files\WhiteSmoke Translator\Microsoft.VC80.CRT.manifest

c:\program files\WhiteSmoke Translator\msvcm80.dll

c:\program files\WhiteSmoke Translator\msvcp80.dll

c:\program files\WhiteSmoke Translator\msvcr80.dll

c:\program files\WhiteSmoke Translator\osmax.ocx

c:\program files\WhiteSmoke Translator\secman.dll

c:\program files\WhiteSmoke Translator\settings.ini

c:\program files\WhiteSmoke Translator\TCCons.dll

c:\program files\WhiteSmoke Translator\WCapture.dll

c:\program files\WhiteSmoke Translator\WCaptureX.dll

c:\program files\WhiteSmoke Translator\WCustom.dll

c:\program files\WhiteSmoke Translator\WhiteSmokeDictRegistration.exe

c:\program files\WhiteSmoke Translator\WHook.dll

c:\program files\WhiteSmoke Translator\WMonitorX.dll

c:\program files\WhiteSmoke Translator\WSDictHookDll.dll

c:\program files\WhiteSmoke Translator\WSLogger.exe

c:\program files\WhiteSmoke Translator\WSTrayDictMode.exe

c:\program files\whitesmoketoolbar

c:\program files\whitesmoketoolbar\chrome\content\lib\about.xml

c:\program files\whitesmoketoolbar\chrome\content\lib\dtxpanel.xul

c:\program files\whitesmoketoolbar\chrome\content\lib\dtxpanelwin.xul

c:\program files\whitesmoketoolbar\chrome\content\lib\dtxprefwin.xul

c:\program files\whitesmoketoolbar\chrome\content\lib\dtxwin.xul

c:\program files\whitesmoketoolbar\chrome\content\lib\emailnotifierproviders.xml

c:\program files\whitesmoketoolbar\chrome\content\lib\external.js

c:\program files\whitesmoketoolbar\chrome\content\lib\neterror.xhtml

c:\program files\whitesmoketoolbar\chrome\content\lib\rsspreview.html

c:\program files\whitesmoketoolbar\chrome\content\lib\rsswin.xml

c:\program files\whitesmoketoolbar\chrome\content\lib\rsswin.xsl

c:\program files\whitesmoketoolbar\chrome\content\lib\vmncode.js

c:\program files\whitesmoketoolbar\chrome\content\lib\wmpstreamer.html

c:\program files\whitesmoketoolbar\chrome\content\modules\datastore.jsm

c:\program files\whitesmoketoolbar\chrome\content\neterror.xhtml

c:\program files\whitesmoketoolbar\chrome\content\newtab\images\btn_search.gif

c:\program files\whitesmoketoolbar\chrome\content\newtab\images\bullet.gif

c:\program files\whitesmoketoolbar\chrome\content\newtab\images\field_bg.gif

c:\program files\whitesmoketoolbar\chrome\content\newtab\images\powered_by_yahoo.gif

c:\program files\whitesmoketoolbar\chrome\content\newtab\newtab.html

c:\program files\whitesmoketoolbar\chrome\content\preferences.xml

c:\program files\whitesmoketoolbar\chrome\content\toolbar.htm

c:\program files\whitesmoketoolbar\chrome\content\toolbar.xul

c:\program files\whitesmoketoolbar\chrome\content\vmncode.js

c:\program files\whitesmoketoolbar\chrome\content\vmnrsswin.xml

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Facebook\skin\css\dialog.css

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Facebook\skin\images\bg.gif

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Facebook\skin\images\btn-wide-close-over.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Facebook\skin\images\btn-wide-close.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Facebook\skin\images\default.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Facebook\skin\images\transparent.gif

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Facebook\skin\images\win-btm-left.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Facebook\skin\images\win-btm-mdl.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Facebook\skin\images\win-btm-right-resize.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Facebook\skin\images\win-btm-right.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Facebook\skin\main.html

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Facebook\skin\scripts\defscript.js

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Facebook\tb_icon.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Facebook\widget.jsw

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Facebook\widget.xml

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Facebook\widget_version.txt

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\css\twitter.css

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\images\btn-login-over.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\images\btn-login.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\images\btn-submit.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\images\loginbg.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\images\refresh-over.gif

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\images\refresh.gif

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\images\scrollbottom-disable.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\images\scrollbottom-down.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\images\scrollbottom-over.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\images\scrollbottom.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\images\scrolltop-disable.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\images\scrolltop-down.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\images\scrolltop-over.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\images\scrolltop.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\images\tab-off-l.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\images\tab-off-r.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\images\tab-on-l.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\images\tab-on-r.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\images\throbber.gif

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\images\Thumbs.db

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\images\twitter-logo48.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\images\twitter_top.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\js\jquery.js

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\js\scripts.js

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\skin\css\dialog.css

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\skin\images\bg.gif

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\skin\images\btn-wide-close-over.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\skin\images\btn-wide-close.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\skin\images\default.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\skin\images\transparent.gif

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\skin\images\win-btm-left.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\skin\images\win-btm-mdl.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\skin\images\win-btm-right-resize.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\skin\images\win-btm-right.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\skin\main.html

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\skin\scripts\defscript.js

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\tb_icon.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\Thumbs.db

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\widget.jsw

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\widget.xml

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\widget_version.txt

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.WebTV\skin\css\dialog.css

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.WebTV\skin\images\bg.gif

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.WebTV\skin\images\btn-search.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.WebTV\skin\images\btn-wide-close-over.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.WebTV\skin\images\btn-wide-close.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.WebTV\skin\images\default.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.WebTV\skin\images\Thumbs.db

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.WebTV\skin\images\transparent.gif

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.WebTV\skin\images\win-btm-left.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.WebTV\skin\images\win-btm-mdl.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.WebTV\skin\images\win-btm-right-resize.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.WebTV\skin\images\win-btm-right.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.WebTV\skin\main.html

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.WebTV\skin\scripts\defscript.js

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.WebTV\tb_icon.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.WebTV\widget.jsw

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.WebTV\widget.xml

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.WebTV\widget_version.txt

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\css\dialog.css

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\arrow-grey.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\arrows_grey-left.gif

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\arrows_grey-right.gif

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\btn-search-over.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\btn-search.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\powered-by-youtube.gif

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\scrollb-disable.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\scrollb-down.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\scrollb.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\scrollt-disable.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\scrollt-down.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\scrollt.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\tab-off-l.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\tab-off-r.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\tab-on-l.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\tab-on-r.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\tab-over-l.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\tab-over-r.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\tab-red-left.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\tab-red-mdl.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\tab-red-right.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\tab-white-left.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\tab-white-mdl.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\tab-white-right.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\throbber.gif

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\Thumbs.db

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\vid-bg.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images\youtube.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\index.html

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\js\jquery-1.3.2.min.js

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\js\jquery.autocomplete.min.js

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\skin\css\dialog.css

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\skin\images\bg.gif

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\skin\images\btn-search.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\skin\images\btn-wide-close-over.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\skin\images\btn-wide-close.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\skin\images\default.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\skin\images\Thumbs.db

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\skin\images\transparent.gif

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\skin\images\win-btm-left.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\skin\images\win-btm-mdl.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\skin\images\win-btm-right-resize.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\skin\images\win-btm-right.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\skin\main.html

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\skin\scripts\defscript.js

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\tb_icon.png

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\widget.jsw

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\widget.xml

c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\widget_version.txt

c:\program files\whitesmoketoolbar\chrome\data\dynamicElements\vmntoolbar.xsl

c:\program files\whitesmoketoolbar\chrome\data\rss\rss.xml

c:\program files\whitesmoketoolbar\chrome\data\search\engines.xml

c:\program files\whitesmoketoolbar\chrome\data\search\search.xsl

c:\program files\whitesmoketoolbar\chrome\data\weather\icons.xml

c:\program files\whitesmoketoolbar\chrome\skin\634017460871087500_png

c:\program files\whitesmoketoolbar\chrome\skin\about.gif

c:\program files\whitesmoketoolbar\chrome\skin\babylon_logo.png

c:\program files\whitesmoketoolbar\chrome\skin\bing_16x16.png

c:\program files\whitesmoketoolbar\chrome\skin\bing_searchicon_20x22_spaced_hover_png

c:\program files\whitesmoketoolbar\chrome\skin\bing_searchicon_20x22_spaced_png

c:\program files\whitesmoketoolbar\chrome\skin\blank_png

c:\program files\whitesmoketoolbar\chrome\skin\bluelite.gif

c:\program files\whitesmoketoolbar\chrome\skin\bluesky.gif

c:\program files\whitesmoketoolbar\chrome\skin\btn-search-over.png

c:\program files\whitesmoketoolbar\chrome\skin\btn-search.png

c:\program files\whitesmoketoolbar\chrome\skin\btn-settings-over.png

c:\program files\whitesmoketoolbar\chrome\skin\btn-settings.png

c:\program files\whitesmoketoolbar\chrome\skin\btn-widgets-over.png

c:\program files\whitesmoketoolbar\chrome\skin\btn-widgets.png

c:\program files\whitesmoketoolbar\chrome\skin\btn_settings.png

c:\program files\whitesmoketoolbar\chrome\skin\ca.png

c:\program files\whitesmoketoolbar\chrome\skin\checkMyText_png

c:\program files\whitesmoketoolbar\chrome\skin\checkMyText_png_png

c:\program files\whitesmoketoolbar\chrome\skin\dictionary.png

c:\program files\whitesmoketoolbar\chrome\skin\Dictionary_png

c:\program files\whitesmoketoolbar\chrome\skin\Dictionary_png_png

c:\program files\whitesmoketoolbar\chrome\skin\divider.png

c:\program files\whitesmoketoolbar\chrome\skin\downloadcom.png

c:\program files\whitesmoketoolbar\chrome\skin\dtxlogo.png

c:\program files\whitesmoketoolbar\chrome\skin\DTXWizard\skin\icon_library\Basics\folder.png

c:\program files\whitesmoketoolbar\chrome\skin\email.png

c:\program files\whitesmoketoolbar\chrome\skin\email_on.png

c:\program files\whitesmoketoolbar\chrome\skin\eteacher_png

c:\program files\whitesmoketoolbar\chrome\skin\facebook.png

c:\program files\whitesmoketoolbar\chrome\skin\feed_icon_png

c:\program files\whitesmoketoolbar\chrome\skin\feed_icon2_png

c:\program files\whitesmoketoolbar\chrome\skin\france_png

c:\program files\whitesmoketoolbar\chrome\skin\games.png

c:\program files\whitesmoketoolbar\chrome\skin\games_png

c:\program files\whitesmoketoolbar\chrome\skin\gamesIcon_png

c:\program files\whitesmoketoolbar\chrome\skin\graphred0.png

c:\program files\whitesmoketoolbar\chrome\skin\graphred0_5.png

c:\program files\whitesmoketoolbar\chrome\skin\graphred1.png

c:\program files\whitesmoketoolbar\chrome\skin\graphred1_5.png

c:\program files\whitesmoketoolbar\chrome\skin\graphred2.png

c:\program files\whitesmoketoolbar\chrome\skin\graphred2_5.png

c:\program files\whitesmoketoolbar\chrome\skin\graphred3.png

c:\program files\whitesmoketoolbar\chrome\skin\graphred3_5.png

c:\program files\whitesmoketoolbar\chrome\skin\graphred4.png

c:\program files\whitesmoketoolbar\chrome\skin\graphred4_5.png

c:\program files\whitesmoketoolbar\chrome\skin\graphred5.png

c:\program files\whitesmoketoolbar\chrome\skin\graphredna.png

c:\program files\whitesmoketoolbar\chrome\skin\grey.gif

c:\program files\whitesmoketoolbar\chrome\skin\ico-shield.png

c:\program files\whitesmoketoolbar\chrome\skin\images.png

c:\program files\whitesmoketoolbar\chrome\skin\italy_png

c:\program files\whitesmoketoolbar\chrome\skin\lib\add.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\aol.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\arrow-dn.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\arrow-right-disabled.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\arrow-right.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\arrow-up.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\bg-btn-divider.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\bg-btn-end.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\bg-btn-mdl.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\bg-btn-mdl_ff.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\bg-btn-start.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\bg-btnover-divider.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\bg-btnover-end.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\bg-btnover-mdl.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\bg-btnover-mdl_ff.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\bg-btnover-start.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\blank.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\btn-widgets-over.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\btn-widgets.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\btn_slider.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\btnback-down-vista.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\btnback-vista.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\btnleft-down-vista.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\btnleft-vista.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\btnright-down-vista.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\btnright-vista.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\button-splitter-down-vista.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\button-splitter-vista.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\checkmark.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\chevron.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\collapse.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\comcast.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\dtx.css

c:\program files\whitesmoketoolbar\chrome\skin\lib\edit-back-hot.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\edit-back.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\expand.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\found.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\gmail.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\highlight.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\highlight_blue.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\highlight_cyan.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\highlight_lime.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\highlight_magenta.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\highlight_yellow.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\hotmail.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\ico-check.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\imap.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\lastsearch-thumb-back.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\loadingMid.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\lock.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\logo-separator.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\mailcom.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\menu_bg-basic.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\menu_separator_bar.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\menu_separator_white.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\menuitem-splitter.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\menuitemback-down-vista.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\menuitemback-vista.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\menuitemleft-down-vista.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\menuitemleft-vista.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\menuitemright-down-vista.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\menuitemright-vista.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\modify.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\move.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\movetarget.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\css\panels.css

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\css\popupAbout.css

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\css\popupGames.css

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\css\popupRSS.css

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\css\popupWidgets.css

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\css\dialog.css

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\bg.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\btn-search.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\btn-wide-close-over.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\btn-wide-close.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\default.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\tab-off-l.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\tab-off-r.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\tab-on-l.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\tab-on-r.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\transparent.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\ttlbar-left.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\ttlbar-mdl.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\ttlbar-right.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\win-btm-left.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\win-btm-mdl.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\win-btm-right-resize.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\win-btm-right.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\win-left.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\win-right.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\main.html

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\scripts\defscript.js

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\footer.htm

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\gamecategory.xsl

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\gameData.js

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\gameList.xsl

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\games.xsl

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\gametype.xsl

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\arrow-dn.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\arrow-sml-drop.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\arrow-sml.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\arrow-up.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\arrowr-bluew5.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\bg-aboutbox.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\bg-btnover.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\bg-pnl520x390.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\btn-back.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\btn-close-grey.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\btn-close-greyover.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\btn-drag.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\btn-moredetails.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\btn-next-over.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\btn-next.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\btn-previous-over.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\btn-previous.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\btn-search-pnlbtm-over.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\btn-search-pnlbtm.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\bullet-orange.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\gamethumb-on.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\gamethumb2-over.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\ico-calendar.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\ico-download.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\ico-joystick24.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\ico-news24.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\ico-play.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\ico-tags.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\icon-Add.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\icon-download.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\icon-Info.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\icon-play.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\icon-shop.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\menul-bgon.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\menul-bgover.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\panel-botm-noscroll.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\scroll-bg-206.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\scroll-bg.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\scroll-topwin.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\scrollb-disable.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\scrollb-down.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\scrollb-over.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\scrollb.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\scrollt-disable.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\scrollt-down.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\scrollt-over.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\scrollt.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\searchbox-pnlbtm.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\star_x_grey.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\star_x_orange.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\TRUSTe_about.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\view-detailed-on.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\view-detailed-over.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\view-thumb-on.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\view-thumb-over.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\widgets-square-16px.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\widgets-square-24px.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\widgets.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\initHTML.html

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\popupGames.html

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\popupHTML.html

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\popupRSS.html

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\popupWidgets.html

c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\scroll.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\pop.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\css\manager.css

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\css\slider.css

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\bg-pnl.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\btn-close-grey.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\btn-close-greyover.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\collapsed_button.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\expanded_button.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\ico-playstation-down.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\ico-playstation-over.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\ico-playstation.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\ico-radio.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\music-note.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-btn-pause-on.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-btn-pause.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-btn-play-on.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-btn-play.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-eq-bg.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-eq-buffer.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-eq-busy.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-eq-off.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-eq-on.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-eq-warning.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-options-design-on.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-options-design.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-options-on.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-options.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-volume-0.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-volume-1.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-volume-2.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-volume-3.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-volume-mute.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\scrollbar-handle.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\scrollbar-track.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\slider.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\slideron.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\track.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\managerpanel.html

c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\volumeslider.html

c:\program files\whitesmoketoolbar\chrome\skin\lib\reload.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\remove.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\rename.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\resize-box.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\rss.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\rsschannelback.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\RSSLogo.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\rsstabdivider.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\scroll-left.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\scroll-right.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\search-go.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\search.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\text-ellipsis.xml

c:\program files\whitesmoketoolbar\chrome\skin\lib\throbber.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\toolbarsplitter.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\transparent_1px.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_02.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_03.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_04.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_06.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_07.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_08.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_09.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_10.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_11.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_12.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_13.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_14.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_15.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_16.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_18.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_19.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_20.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_21.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\btn-close-grey.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\btn-close-greyover.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\close-hot.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\close-normal.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\loadingMid.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\proxy.html

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\template.html

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\template.xml

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\templateFF.html

c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\throbber.gif

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\icons\cond999.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\icons\icons.xml

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\icons\na-s.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\icons\na-t.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\icons\na.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\icons\weather.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\add.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\arrowr-bluew5.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\bg-pnl.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\bg-pnl520x350.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\bg-pnl520x350blue-whitebg.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\bg-pnl520x350blue.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\box-check.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\box-uncheck.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\btn-close-grey.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\btn-close-greyover.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\btn-delete.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\btn-search-pnlbtm-over.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\btn-search-pnlbtm.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\btnarrow-next-off.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\btnarrow-next.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\btnarrow-previous-off.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\btnarrow-previous.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\ico-check.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\ico-hotandhumid-s.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\ico-hotandhumid.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\options-weather.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\over-blue.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\over-orange.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\powered-by-weatherbug.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\powered-by-weatherbug2.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\radio-checked.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\radio-unchecked.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\searchbox-pnlbtm.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\weather-contour.png

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\popupWeather.css

c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\popupWeather.html

c:\program files\whitesmoketoolbar\chrome\skin\lib\yahoo.png

c:\program files\whitesmoketoolbar\chrome\skin\lichen.gif

c:\program files\whitesmoketoolbar\chrome\skin\logo-about.png

c:\program files\whitesmoketoolbar\chrome\skin\logo-over.png

c:\program files\whitesmoketoolbar\chrome\skin\logo-separator.png

c:\program files\whitesmoketoolbar\chrome\skin\logo.png

c:\program files\whitesmoketoolbar\chrome\skin\mail.png

c:\program files\whitesmoketoolbar\chrome\skin\menuseparatorback.gif

c:\program files\whitesmoketoolbar\chrome\skin\modify-save.png

c:\program files\whitesmoketoolbar\chrome\skin\modify.png

c:\program files\whitesmoketoolbar\chrome\skin\modifyhot.png

c:\program files\whitesmoketoolbar\chrome\skin\music.png

c:\program files\whitesmoketoolbar\chrome\skin\namespacetoolbar.css

c:\program files\whitesmoketoolbar\chrome\skin\networkIcons_png

c:\program files\whitesmoketoolbar\chrome\skin\news.png

c:\program files\whitesmoketoolbar\chrome\skin\options\options-main.png

c:\program files\whitesmoketoolbar\chrome\skin\options\options-search.png

c:\program files\whitesmoketoolbar\chrome\skin\options\options-weather.png

c:\program files\whitesmoketoolbar\chrome\skin\options\options-widgets.png

c:\program files\whitesmoketoolbar\chrome\skin\orange.gif

c:\program files\whitesmoketoolbar\chrome\skin\pixsy.png

c:\program files\whitesmoketoolbar\chrome\skin\protect-id.png

c:\program files\whitesmoketoolbar\chrome\skin\relatedlinks.png

c:\program files\whitesmoketoolbar\chrome\skin\rss-collapse.png

c:\program files\whitesmoketoolbar\chrome\skin\rss-delete.png

c:\program files\whitesmoketoolbar\chrome\skin\rss-expand.png

c:\program files\whitesmoketoolbar\chrome\skin\rss-feed.png

c:\program files\whitesmoketoolbar\chrome\skin\rss-folder-remove.png

c:\program files\whitesmoketoolbar\chrome\skin\rss-folder-rename.png

c:\program files\whitesmoketoolbar\chrome\skin\rss-folder.png

c:\program files\whitesmoketoolbar\chrome\skin\rss-found.png

c:\program files\whitesmoketoolbar\chrome\skin\rss-reload.png

c:\program files\whitesmoketoolbar\chrome\skin\rss-subscribe.png

c:\program files\whitesmoketoolbar\chrome\skin\rss.png

c:\program files\whitesmoketoolbar\chrome\skin\rss_feed_icon_png

c:\program files\whitesmoketoolbar\chrome\skin\rssback.gif

c:\program files\whitesmoketoolbar\chrome\skin\rsstopback.gif

c:\program files\whitesmoketoolbar\chrome\skin\search-over.png

c:\program files\whitesmoketoolbar\chrome\skin\search.png

c:\program files\whitesmoketoolbar\chrome\skin\searchbar\searchbar-background-left.png

c:\program files\whitesmoketoolbar\chrome\skin\searchbar\searchbar-background-middle.png

c:\program files\whitesmoketoolbar\chrome\skin\searchbar\searchbar-background-right.png

c:\program files\whitesmoketoolbar\chrome\skin\settings.png

c:\program files\whitesmoketoolbar\chrome\skin\shopping.png

c:\program files\whitesmoketoolbar\chrome\skin\siteinfo.png

c:\program files\whitesmoketoolbar\chrome\skin\skin-bluelite.png

c:\program files\whitesmoketoolbar\chrome\skin\skin-bluesky.png

c:\program files\whitesmoketoolbar\chrome\skin\skin-grey.png

c:\program files\whitesmoketoolbar\chrome\skin\skin-lichen.png

c:\program files\whitesmoketoolbar\chrome\skin\skin-orange.png

c:\program files\whitesmoketoolbar\chrome\skin\skin-yellow.png

c:\program files\whitesmoketoolbar\chrome\skin\skin.xml

c:\program files\whitesmoketoolbar\chrome\skin\spain_png

c:\program files\whitesmoketoolbar\chrome\skin\technorati.png

c:\program files\whitesmoketoolbar\chrome\skin\throbber.gif

c:\program files\whitesmoketoolbar\chrome\skin\toolbarsplitter.png

c:\program files\whitesmoketoolbar\chrome\skin\translate.png

c:\program files\whitesmoketoolbar\chrome\skin\Translate_png

c:\program files\whitesmoketoolbar\chrome\skin\Translate_png_png

c:\program files\whitesmoketoolbar\chrome\skin\TRUSTe_about.png

c:\program files\whitesmoketoolbar\chrome\skin\TV_icon3_png

c:\program files\whitesmoketoolbar\chrome\skin\tvicon_png

c:\program files\whitesmoketoolbar\chrome\skin\tvIcons_png

c:\program files\whitesmoketoolbar\chrome\skin\usa_png

c:\program files\whitesmoketoolbar\chrome\skin\vmn.css

c:\program files\whitesmoketoolbar\chrome\skin\vmn.png

c:\program files\whitesmoketoolbar\chrome\skin\web.png

c:\program files\whitesmoketoolbar\chrome\skin\whtsmke_logo_png

c:\program files\whitesmoketoolbar\chrome\skin\whtsmke_logo_png_png

c:\program files\whitesmoketoolbar\chrome\skin\whtsmke_logo_png2_png

c:\program files\whitesmoketoolbar\chrome\skin\whtsmke_logo_png3_png

c:\program files\whitesmoketoolbar\chrome\skin\whtsmke_logo_png4_png

c:\program files\whitesmoketoolbar\chrome\skin\whtsmke_logo_png5_png

c:\program files\whitesmoketoolbar\chrome\skin\wikipedia.png

c:\program files\whitesmoketoolbar\chrome\skin\yahoosearch.png

c:\program files\whitesmoketoolbar\chrome\skin\yellow.gif

c:\program files\whitesmoketoolbar\chrome\skin\youtube.png

c:\program files\whitesmoketoolbar\chrome\skin\zoom.png

c:\program files\whitesmoketoolbar\components\windowmediator.js

c:\program files\whitesmoketoolbar\manifest.xml

c:\program files\whitesmoketoolbar\toolbar.xml

c:\program files\whitesmoketoolbar\uninstall.exe

c:\program files\whitesmoketoolbar\whitesmoketoolbar.dll

c:\program files\whitesmoketoolbar\whitesmoketoolbarX.dll

C:\usxxxxxxxx.exe

c:\usxxxxxxxx.exe\config.bin

c:\windows\system32\6to4v32.dll

c:\windows\system32\drivers\jgkkwhep.sys

c:\windows\TEMP\35.tmp

c:\windows\TEMP\36.tmp

F:\Autorun.inf

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_6TO4

-------\Service_6to4

-------\Service_gfvv

((((((((((((((((((((((((( Files Created from 2010-12-19 to 2011-01-19 )))))))))))))))))))))))))))))))

.

2011-01-19 16:44 . 2011-01-19 16:44 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

2011-01-13 16:00 . 2011-01-13 16:00 -------- d-----w- c:\program files\Yontoo Layers Client

2011-01-13 16:00 . 2011-01-13 16:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Tarma Installer

2011-01-13 16:00 . 2011-01-13 16:00 -------- d-----w- c:\windows\system32\%APPDATA%

2011-01-13 11:58 . 2011-01-13 11:58 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache

2010-12-22 19:20 . 2010-11-02 15:17 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys

2010-12-22 19:19 . 2010-10-11 14:59 45568 -c----w- c:\windows\system32\dllcache\wab.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-01-19 18:23 . 2009-04-24 15:08 0 ----a-w- c:\documents and settings\Mary Beth Taormina\Local Settings\Application Data\WavXMapDrive.bat

2010-11-18 18:12 . 2008-04-25 21:27 81920 ----a-w- c:\windows\system32\isign32.dll

2010-11-09 14:52 . 2008-04-25 16:16 249856 ----a-w- c:\windows\system32\odbc32.dll

2010-11-08 15:30 . 2010-11-08 15:30 568664 ----a-w- c:\program files\GoogleEarthPluginSetup.exe

2010-11-06 00:26 . 2008-04-25 16:16 916480 ----a-w- c:\windows\system32\wininet.dll

2010-11-06 00:26 . 2008-04-25 16:16 43520 ----a-w- c:\windows\system32\licmgr10.dll

2010-11-06 00:26 . 2008-04-25 16:16 1469440 ------w- c:\windows\system32\inetcpl.cpl

2010-11-03 12:25 . 2008-04-25 16:16 385024 ----a-w- c:\windows\system32\html.iec

2010-11-02 15:17 . 2008-04-25 16:16 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys

2010-10-28 13:13 . 2008-04-25 16:16 290048 ----a-w- c:\windows\system32\atmfd.dll

2010-10-26 13:27 . 2008-04-25 16:16 1862272 ----a-w- c:\windows\system32\win32k.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}]

2010-12-20 18:09 191488 ------w- c:\program files\Yontoo Layers Client\YontooIEClient.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnabledUnlockedFDEIconOverlay]

@="{022F2F51-CDDA-4873-8A29-72C66C808A3F}"

[HKEY_CLASSES_ROOT\CLSID\{022F2F51-CDDA-4873-8A29-72C66C808A3F}]

2009-11-07 05:07 297808 ----a-w- c:\windows\system32\mscoree.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UninitializedFdeIconOverlay]

@="{661963C1-99A1-44e7-A671-1CF3768AE9D4}"

[HKEY_CLASSES_ROOT\CLSID\{661963C1-99A1-44e7-A671-1CF3768AE9D4}]

2009-11-07 05:07 297808 ----a-w- c:\windows\system32\mscoree.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-08-27 1044480]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-01-11 141336]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-01-11 173592]

"Persistence"="c:\windows\system32\igfxpers.exe" [2009-01-11 141336]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-08-06 182808]

"ChangeTPMAuth"="c:\program files\Wave Systems Corp\Common\ChangeTPMAuth.exe" [2008-08-21 184320]

"WavXMgr"="c:\program files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe" [2008-08-22 145408]

"SecureUpgrade"="c:\program files\Wave Systems Corp\SecureUpgrade.exe" [2008-08-28 656696]

"EmbassySecurityCheck"="c:\program files\Wave Systems Corp\EMBASSY Security Setup\EMBASSYSecurityCheck.exe" [2008-08-28 91448]

"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-05-23 128296]

"NWTRAY"="NWTRAY.EXE" [2002-03-12 28672]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"Adobe Version Cue CS2"="c:\program files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" [2005-04-04 856064]

"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-23 620152]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]

"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2005-11-21 45056]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-09-24 49152]

"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2009-05-21 1501064]

"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2009-05-26 1468296]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000003}\_SC_Acrobat.exe [2009-11-12 295606]

Adobe Acrobat Synchronizer.lnk - c:\program files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-23 734872]

Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

AutoUpdate Monitor.lnk - c:\program files\Sophos\AutoUpdate\ALMon.exe [2009-7-1 245760]

Launch Whitesmoke Translator.lnk - c:\qoobox\Quarantine\C\Program Files\Whitesmoke Translator\WSTrayDictMode.exe.vir [2011-1-13 671744]

Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"CompatibleRUPSecurity"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService]

@="service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]

2008-12-03 02:41 3882312 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SophosAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Program Files\\Adobe\\Adobe Version Cue CS2\\bin\\VersionCueCS2.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\notes\\framework\\rcp\\eclipse\\plugins\\com.ibm.rcp.base_6.2.1.20090925-1604\\win32\\x86\\notes2.exe"=

R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [3/16/2009 9:35 PM 24064]

R1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\dddsk.sys [8/2/2010 12:56 PM 22312]

R1 SAVOnAccessControl;SAVOnAccessControl;c:\windows\system32\drivers\savonaccesscontrol.sys [4/24/2009 10:14 AM 111232]

R1 SAVOnAccessFilter;SAVOnAccessFilter;c:\windows\system32\drivers\savonaccessfilter.sys [4/24/2009 10:14 AM 38912]

R2 Lotus Notes Diagnostics;Lotus Notes Diagnostics;c:\notes\nsd.exe -svcinvoke -ini "c:\notes\notes.ini" --> c:\notes\nsd.exe -svcinvoke -ini c:\notes\notes.ini [?]

R2 SAVAdminService;Sophos Anti-Virus status reporter;c:\program files\Sophos\Sophos Anti-Virus\SAVAdminService.exe [11/4/2009 7:12 AM 80936]

R2 SAVService;Sophos Anti-Virus;c:\program files\Sophos\Sophos Anti-Virus\SavService.exe [4/24/2009 10:14 AM 98304]

R2 vpnagent;Cisco AnyConnect VPN Agent;c:\program files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe [5/5/2010 8:59 PM 583360]

R3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k5132.sys [3/16/2009 9:35 PM 144480]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [11/8/2010 10:30 AM 136176]

S4 SophosBootDriver;SophosBootDriver;c:\windows\system32\drivers\SophosBootDriver.sys [4/24/2009 10:14 AM 14976]

.

Contents of the 'Scheduled Tasks' folder

2011-01-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-08 15:30]

2011-01-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-08 15:30]

2010-09-07 c:\windows\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job

- c:\program files\Microsoft IntelliPoint\ipoint.exe [2009-05-26 19:16]

2010-09-07 c:\windows\Tasks\Microsoft_Hardware_Launch_IType_exe.job

- c:\program files\Microsoft IntelliType Pro\itype.exe [2009-05-21 18:25]

2011-01-19 c:\windows\Tasks\Scan for Potentially Unwanted Applications 12pm and 6pm.job

- c:\program files\Sophos\Sophos Anti-Virus\BackgroundScanClient.exe [2009-04-24 15:14]

2011-01-19 c:\windows\Tasks\SDMsgUpdate (SD).job

- c:\progra~1\SMARTD~1\Messages\SDNotify.exe [2009-08-11 11:29]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.bing.com/?pc=ZUGO&form=ZGAPHP

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = <local>

uInternet Settings,ProxyServer = http=127.0.0.1:8075

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - c:\progra~1\MIF269~1\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\Mary Beth Taormina\Application Data\Mozilla\Firefox\Profiles\pnp1ru6h.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.vcu.edu

FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=ZUGO&form=ZGAADF&q=

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Yontoo Layers: plugin@yontoo.com - %profile%\extensions\plugin@yontoo.com

FF - Ext: Search Toolbar: searchtoolbar@zugo.com - %profile%\extensions\searchtoolbar@zugo.com

.

- - - - ORPHANS REMOVED - - - -

HKCU-Run-usxxxxxxxx.exe - c:\usxxxxxxxx.exe\usxxxxxxxx.exe

AddRemove-Corel Remove Program - e:\corel\AppMan\Setup\remove.exe

AddRemove-Search Toolbar - c:\program files\Search Toolbar\SearchToolbarUninstall.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-01-19 13:23

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Sophos Message Router]

"ImagePath"="\"c:\program files\Sophos\Remote Management System\RouterNT.exe\" -service -name Router -ORBListenEndpoints iiop://:8193/ssl_port=8194"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(720)

c:\windows\system32\WININET.dll

c:\windows\system32\NETWIN32.DLL

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(780)

c:\windows\system32\WININET.dll

- - - - - - - > 'Explorer.exe'(5836)

c:\windows\system32\WININET.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\notes\nsd.exe

c:\notes\ntmulti.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\program files\Sophos\Remote Management System\ManagementAgentNT.exe

c:\program files\Sophos\AutoUpdate\ALsvc.exe

c:\program files\Sophos\Remote Management System\RouterNT.exe

c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

c:\windows\system32\SearchIndexer.exe

c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

c:\windows\system32\NWTRAY.EXE

c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

c:\program files\iPod\bin\iPodService.exe

.

**************************************************************************

.

Completion time: 2011-01-19 13:28:46 - machine was rebooted

ComboFix-quarantined-files.txt 2011-01-19 18:28

Pre-Run: 259,591,467,008 bytes free

Post-Run: 260,945,887,232 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 0F3FCCAECC56130F5572DF963E37C521

LDTate · January 20, 2011

:lol:

Please don't attach the scans / logs from these scans, use "copy/paste".

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

Note: Close all browsers before running ATF Cleaner: IE, FireFox, etc.

Please download ATF Cleaner by Atribune.

Download - ATF Cleaner

piabads · January 21, 2011

ComboFix 11-01-20.03 - MBT 01/21/2011 6:51.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3582.2044 [GMT -5:00]

Running from: c:\documents and settings\MBT\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\MBT\Desktop\CFScript.txt

AV: Sophos Anti-Virus *Disabled/Updated* {3F13C776-3CBE-4DE9-8BF6-09E5183CA2BD}

* Created a new restore point

.

((((((((((((((((((((((((( Files Created from 2010-12-21 to 2011-01-21 )))))))))))))))))))))))))))))))

.

2011-01-19 16:44 . 2011-01-19 16:44 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

2011-01-13 16:00 . 2011-01-13 16:00 -------- d-----w- c:\program files\Yontoo Layers Client

2011-01-13 16:00 . 2011-01-13 16:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Tarma Installer

2011-01-13 16:00 . 2011-01-13 16:00 -------- d-----w- c:\windows\system32\%APPDATA%

2011-01-13 11:58 . 2011-01-13 11:58 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache

2010-12-22 19:20 . 2010-11-02 15:17 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys

2010-12-22 19:19 . 2010-10-11 14:59 45568 -c----w- c:\windows\system32\dllcache\wab.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-01-21 12:01 . 2009-04-24 15:08 0 ----a-w- c:\documents and settings\MBT\Local Settings\Application Data\WavXMapDrive.bat