Jump to content

Recommended Posts

I have a laptop that's been having issues.

The main issue is the WhiteSmoke Translator that's been installed on the machine. This, of course, is redirecting any web browser being used to go to invalid sites suggesting a variety of links to try.

To further the issues with this machine, none of the programs I tried to get rid of via add/remove programs can be removed.

The machine is not moving at a snails pace, but it is slower than what it was before these problems started happening.

I've taken the first steps outlined in the "I'm infected - What do I do now" thread.

Thank you in advance.

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26

Run by hope at 18:39:28 on 2011-11-07

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2814.1760 [GMT -5:00]

.

AV: Trend Micro AntiVirus *Enabled/Updated* {48929DFC-7A52-A34F-8351-C4DBEDBD9C50}

SP: Trend Micro AntiVirus *Enabled/Updated* {F3F37C18-5C68-ACC1-B9E1-FFA9963AD6ED}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\SLsvc.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\Trend Micro\BM\TMBMSRV.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files\SMINST\BLService.exe

C:\Program Files\CyberLink\Shared files\RichVideo.exe

C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\DRIVERS\xaudio.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\HP\QuickPlay\QPService.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe

C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

C:\Users\Guest\AppData\Local\Google\Update\GoogleUpdate.exe

C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE

C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3007394

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb

mURLSearchHooks: H - No File

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll

BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

TB: Microsoft Live Search Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll

TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File

TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe

mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe

mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe

mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe

mRun: [ufSeAgnt.exe] "c:\program files\trend micro\internet security\UfSeAgnt.exe"

mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent

StartupFolder: c:\users\hope\appdata\roaming\micros~1\windows\startm~1\programs\startup\launch~1.lnk - c:\program files\whitesmoketranslator\WSTrayDictMode.exe

uPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1)

mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

TCP: DhcpNameServer = 192.168.1.1 192.168.1.1

TCP: Interfaces\{51A7A5FE-9E5B-4D3D-9A95-15ADAC12112C} : DhcpNameServer = 192.168.1.1 192.168.1.1

TCP: Interfaces\{AB122883-4A54-4567-9963-55FEE5BE6270} : DhcpNameServer = 192.168.2.1 208.59.247.45 208.59.247.46

mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\hope\appdata\roaming\mozilla\firefox\profiles\6agpgsr1.default\

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

.

============= SERVICES / DRIVERS ===============

.

R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]

R2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\sminst\BLService.exe [2009-4-20 365952]

R2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [2008-12-29 50192]

R2 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [2008-12-29 36368]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-5-9 43040]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 GSRestartSvc;GSRestartSvc;"c:\programdata\geek squad\customizer\gsrestartsvc.exe" --> c:\programdata\geek squad\customizer\GSRestartSvc.exe [?]

S2 Norton Internet Security;Norton Internet Security;"c:\program files\norton internet security\engine\16.0.0.125\ccsvchst.exe" /s "norton internet security" /m "c:\program files\norton internet security\engine\16.0.0.125\dimaster.dll" /prefetch:1 --> c:\program files\norton internet security\engine\16.0.0.125\ccSvcHst.exe [?]

S2 TmProxy;Trend Micro Proxy Service;c:\program files\trend micro\internet security\TmProxy.exe [2011-10-9 677128]

S3 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2009-4-20 193840]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

.

=============== Created Last 30 ================

.

2011-11-07 23:24:34 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{e9a200ea-773f-4806-9ddc-2949541e6ace}\offreg.dll

2011-11-07 21:57:12 -------- d-----w- c:\users\hope\appdata\local\temp

2011-11-07 21:43:23 -------- d-----w- C:\ComboFix

2011-11-07 20:36:02 -------- d-----w- c:\programdata\Malwarebytes

2011-11-07 20:35:59 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-11-02 04:22:52 98816 ----a-w- c:\windows\sed.exe

2011-11-02 04:22:52 518144 ----a-w- c:\windows\SWREG.exe

2011-11-02 04:22:52 256000 ----a-w- c:\windows\PEV.exe

2011-11-02 04:22:52 208896 ----a-w- c:\windows\MBR.exe

2011-11-02 03:43:41 6668624 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{e9a200ea-773f-4806-9ddc-2949541e6ace}\mpengine.dll

2011-10-10 19:47:36 -------- d-----w- c:\users\hope\appdata\roaming\WhiteSmokeTranslator

2011-10-10 19:47:16 -------- d-----w- c:\program files\WhiteSmokeTranslator

2011-10-10 19:47:13 -------- d-----w- c:\program files\Conduit

2011-10-10 19:47:11 -------- d-----w- c:\users\hope\appdata\local\Conduit

2011-10-10 19:47:10 -------- d-----w- c:\program files\WhiteSmoke_Bar

2011-10-10 19:41:07 -------- d-----w- c:\users\hope\appdata\local\Avanquest_Software

2011-10-10 19:17:49 -------- d-----w- c:\users\hope\appdata\roaming\Avanquest

2011-10-10 19:17:22 -------- d-----w- c:\programdata\Avanquest

2011-10-10 19:17:22 -------- d-----w- c:\program files\Avanquest

2011-10-10 00:20:02 -------- d-----w- c:\programdata\STOPzilla!

2011-10-10 00:12:39 -------- d-----w- c:\programdata\Trend Micro

2011-10-10 00:10:45 -------- d-----w- c:\program files\Trend Micro

.

==================== Find3M ====================

.

2011-11-07 21:24:33 226280 ----a-w- c:\windows\system32\drivers\volsnap.sys

2011-11-02 03:42:49 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

.

============= FINISH: 18:40:31.95 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft® Windows Vista™ Home Premium

Boot Device: \Device\HarddiskVolume1

Install Date: 8/28/2009 3:43:53 AM

System Uptime: 11/7/2011 6:23:44 PM (0 hours ago)

.

Motherboard: Wistron | | 303C

Processor: AMD Turion Dual-Core RM-75 | Socket A | 2200/133mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 287 GiB total, 194.561 GiB free.

D: is FIXED (NTFS) - 11 GiB total, 1.823 GiB free.

E: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

.

==== Installed Programs ======================

.

Acrobat.com

Activation Assistant for the 2007 Microsoft Office suites

ActiveCheck component for HP Active Support Library

Adobe AIR

Adobe Flash Player 10 Plugin

Adobe Flash Player 11 ActiveX

Adobe Reader 9

Adobe Shockwave Player

Adobe Shockwave Player 11.5

Apple Application Support

Apple Mobile Device Support

Apple Software Update

Ask Toolbar

Atheros Driver Installation Program

Compatibility Pack for the 2007 Office system

Conexant HD Audio

CyberLink DVD Suite

CyberLink YouCam

Dell PC Suite

Download Updater (AOL LLC)

ESU for Microsoft Vista

HDAUDIO Soft Data Fax Modem with SmartCP

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

HP Active Support Library

HP Customer Experience Enhancements

HP Doc Viewer

HP DVD Play 3.7

HP Help and Support

HP Quick Launch Buttons 6.40 H2

HP Total Care Advisor

HP Total Care Setup

HP Update

HP User Guides 0118

HP Wireless Assistant

HPAsset component for HP Active Support Library

HPNetworkAssistant

Java Auto Updater

Java™ 6 Update 26

Java™ 6 Update 7

Juno Preloader

LabelPrint

LightScribe System Software 1.14.17.1

Malwarebytes' Anti-Malware version 1.51.2.1300

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Live Search Toolbar

Microsoft Office Excel MUI (English) 2007

Microsoft Office Home and Student 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office PowerPoint Viewer 2007 (English)

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word MUI (English) 2007

Microsoft Silverlight

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319

Microsoft Works

MobileMe Control Panel

Mozilla Firefox 7.0.1 (x86 en-US)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

muvee Reveal

My HP Games

NetWaiting

NetZero Preloader

Norton Internet Security

NVIDIA Drivers

Power2Go

PowerDirector

PVSonyDll

QuickTime

Realtek USB 2.0 Card Reader

Safari

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

SPORE Creature Creator Trial Edition

Synaptics Pointing Device Driver

Trend Micro AntiVirus

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Extended (KB2468871)

Update for Microsoft .NET Framework 4 Extended (KB2533523)

Update for Office 2007 (KB934528)

WhiteSmoke Bar Toolbar

WhiteSmokeTranslator

.

==== Event Viewer Messages From Past Week ========

.

11/7/2011 6:26:42 PM, Error: Service Control Manager [7023] - The wscsvc service terminated with the following error: The specified module could not be found.

11/7/2011 6:25:34 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: SRTSP SRTSPX

11/7/2011 6:25:34 PM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

11/7/2011 6:25:34 PM, Error: Service Control Manager [7000] - The Norton Internet Security service failed to start due to the following error: The system cannot find the path specified.

11/7/2011 6:25:34 PM, Error: Service Control Manager [7000] - The GSRestartSvc service failed to start due to the following error: The system cannot find the file specified.

11/7/2011 6:24:03 PM, Error: volmgr [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.

11/7/2011 4:55:00 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

11/7/2011 4:39:25 PM, Error: Service Control Manager [7034] - The XAudioService service terminated unexpectedly. It has done this 1 time(s).

11/2/2011 12:01:13 AM, Error: Service Control Manager [7034] - The Fix-It Utilities Process Monitor service terminated unexpectedly. It has done this 1 time(s).

11/1/2011 11:26:58 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.2.3 for the Network Card with network address 001F16E4741A has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).

11/1/2011 11:26:56 PM, Error: EventLog [6008] - The previous system shutdown at 9:40:09 PM on 10/29/2011 was unexpected.

.

==== End Of File ===========================

Link to post
Share on other sites

post-32477-1261866970.gif

Logs will be closed if you haven't replied within 3 days

Please don't attach the scans / logs for these tools, use "copy/paste".

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Please run a new MBAM scan being sure to update before scanning.

Post the scan results

Also please describe how your computer behaves at the moment.

Please don't attach the scans / logs, use "copy/paste".

Link to post
Share on other sites

After running the MalwareBytes scan I discovered:

- The laptop is now able to get to websites without a problem (using IE, Firefox, & Chrome) which is surprising considering the last time I attempted it five or so days ago, I couldn't get to any websites.

- I attempted to remove the WhiteSmoke Translator toolbar via add/remove programs, but still am unable to do so. So, if anything, there's still a problem with being allowed to do that.

MalwareBytes log follows:

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 8168

Windows 6.0.6002 Service Pack 2

Internet Explorer 9.0.8112.16421

11/15/2011 12:59:23 PM

mbam-log-2011-11-15 (12-59-23).txt

Scan type: Quick scan

Objects scanned: 211164

Time elapsed: 3 minute(s), 48 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Link to post
Share on other sites

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Download ComboFix from one of these locations:

Link 1

Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
  • Double click on ComboFix.exe & follow the prompts.
    Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
    Note: If you have XP SP3, use the XP SP2 package.
    If Vista or Windows 7, skip the Recovery Console part
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

RC1.png

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

RC2-1.png

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

Link to post
Share on other sites

When I booted up the laptop to start this process, I got an error that Windows did not shut down correctly, and the system was going to have to be restored from the last known valid point. When it came back up, the MalwareBytes I had installed earlier was gone.

I was able to run ComboFix after the laptop came back up, though. When I started ComboFix, it asked me to disable the anti-virus, however, that is not an option. The Trend Micro trial version has run out and the options to disable and/or remove the anti-virus are not available. From what I can tell, the AV is not running, but it still appears in the system tray as a grayed out icon (hovering over it shows a message to call Best Buy to activate the AV).

The ComboFix log is below:

ComboFix 11-11-15.01 - hope 11/15/2011 15:39:36.3.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2814.1868 [GMT -5:00]

Running from: c:\users\Guest\Desktop\ComboFix.exe

AV: Trend Micro AntiVirus *Enabled/Updated* {48929DFC-7A52-A34F-8351-C4DBEDBD9C50}

SP: Trend Micro AntiVirus *Enabled/Updated* {F3F37C18-5C68-ACC1-B9E1-FFA9963AD6ED}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((( Files Created from 2011-10-15 to 2011-11-15 )))))))))))))))))))))))))))))))

.

.

2011-11-15 20:48 . 2011-11-15 20:48 -------- d-----w- c:\users\hope\AppData\Local\temp

2011-11-15 20:48 . 2011-11-15 20:48 -------- d-----w- c:\users\Treigh\AppData\Local\temp

2011-11-15 20:48 . 2011-11-15 20:48 -------- d-----w- c:\users\Owner\AppData\Local\temp

2011-11-15 20:48 . 2011-11-15 20:48 -------- d-----w- c:\users\Guest\AppData\Local\temp

2011-11-15 20:48 . 2011-11-15 20:48 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-11-15 20:33 . 2011-11-15 20:33 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{7BD97C18-1EB5-48CF-99C0-2D4EECA45F9E}\offreg.dll

2011-11-15 20:33 . 2011-10-07 03:48 6668624 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{7BD97C18-1EB5-48CF-99C0-2D4EECA45F9E}\mpengine.dll

2011-11-15 17:51 . 2011-11-15 17:51 -------- d-----w- c:\users\hope\AppData\Roaming\Malwarebytes

2011-11-07 20:48 . 2011-11-07 20:48 -------- d-----w- c:\users\Guest\AppData\Local\Apple Computer

2011-11-07 20:38 . 2011-11-07 20:38 -------- d-----w- c:\users\Guest\AppData\Roaming\Malwarebytes

2011-11-07 20:36 . 2011-11-07 20:36 -------- d-----w- c:\programdata\Malwarebytes

2011-11-07 20:35 . 2011-11-15 23:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-11-02 03:46 . 2011-11-02 03:46 -------- d-----w- c:\users\Guest\AppData\Local\Mozilla

2011-10-18 16:36 . 2011-09-06 13:30 2043392 ----a-w- c:\windows\system32\win32k.sys

2011-10-18 16:36 . 2011-07-29 16:01 293376 ----a-w- c:\windows\system32\psisdecd.dll

2011-10-18 16:36 . 2011-07-29 16:01 217088 ----a-w- c:\windows\system32\psisrndr.ax

2011-10-18 16:36 . 2011-07-29 16:00 57856 ----a-w- c:\windows\system32\MSDvbNP.ax

2011-10-18 16:36 . 2011-07-29 16:00 69632 ----a-w- c:\windows\system32\Mpeg2Data.ax

2011-10-18 16:36 . 2011-09-14 10:51 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat

2011-10-18 16:35 . 2011-08-25 16:15 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll

2011-10-18 16:35 . 2011-08-25 16:14 563712 ----a-w- c:\windows\system32\oleaut32.dll

2011-10-18 16:35 . 2011-08-25 16:14 238080 ----a-w- c:\windows\system32\oleacc.dll

2011-10-18 16:35 . 2011-08-25 13:31 4096 ----a-w- c:\windows\system32\oleaccrc.dll

2011-10-18 14:37 . 2011-10-18 14:37 -------- d-----w- c:\users\Guest\AppData\Roaming\Avanquest

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-11-07 21:24 . 2009-10-06 01:27 226280 ----a-w- c:\windows\system32\drivers\volsnap.sys

2011-11-02 03:42 . 2011-06-21 04:14 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-09-29 06:53 . 2011-10-10 19:52 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

2010-01-20 15:34 1197448 ---ha-w- c:\program files\Ask.com\GenericAskToolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-01-20 1197448]

.

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-01-20 1197448]

.

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-17 1049896]

"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2008-09-24 468264]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]

"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-12-14 47904]

"UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2008-12-29 983168]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]

.

c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

.

c:\users\hope\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Launch WhiteSmokeTranslator.lnk - c:\program files\WhiteSmokeTranslator\WSTrayDictMode.exe [2011-9-5 2068480]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

R2 GSRestartSvc;GSRestartSvc;c:\programdata\Geek Squad\Customizer\GSRestartSvc.exe [x]

R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe [x]

R2 TmProxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [2008-12-29 677128]

R3 AQFileRestore;AQFileRestore;c:\windows\system32\DRIVERS\AQFileRestore.sys [x]

R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-04-03 193840]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

S2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\SMINST\BLService.exe [2008-10-06 365952]

S2 tmevtmgr;tmevtmgr;c:\windows\system32\DRIVERS\tmevtmgr.sys [2008-12-29 50192]

S2 tmpreflt;tmpreflt;c:\windows\system32\DRIVERS\tmpreflt.sys [2008-12-29 36368]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-05-09 43040]

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2008-06-09 17:14 451872 ---ha-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

.

Contents of the 'Scheduled Tasks' folder

.

2011-08-29 c:\windows\Tasks\HPCeeScheduleForOwner.job

- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2009-04-20 18:34]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3007394

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html

TCP: DhcpNameServer = 192.168.1.1 192.168.1.1

FF - ProfilePath - c:\users\hope\AppData\Roaming\Mozilla\Firefox\Profiles\6agpgsr1.default\

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-11-15 15:48

Windows 6.0.6002 Service Pack 2 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Norton Internet Security]

"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Completion time: 2011-11-15 15:51:16

ComboFix-quarantined-files.txt 2011-11-15 20:51

ComboFix2.txt 2011-11-07 21:57

ComboFix3.txt 2011-11-02 04:43

.

Pre-Run: 211,385,233,408 bytes free

Post-Run: 211,225,489,408 bytes free

.

- - End Of File - - BED4063E213F4C817206CD1303BF6B85

Link to post
Share on other sites

I should have been clear earlier when I mentioned removing software via add/remove: I cannot remove anything that way. Not even the ask.com toolbar.

I was just going to try it again since you asked, but I got an "Illegal operation attempted on a registry key that has been marked for deletion" error when I clicked on the Control Panel option. I tried loading up some other stuff, but the same error message kept popping up. I rebooted the laptop, and that seems to have fixed the issue. Still strange, though.

WhiteSmoke is still in the program list, but it doesn't seem to be interfering with web browsing anymore.

Link to post
Share on other sites

You have a file I can't find any info on.

Please go to http://www.virustotal.com/, click on Browse, and upload the following file for analysis:

c:\windows\system32\DRIVERS\AQFileRestore.sys

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.

If virustotal is too busy you can try these.

http://virusscan.jotti.org

http://www.kaspersky.com/scanforvirus.html

Link to post
Share on other sites

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:

Click Start > Run type Notepad click OK.

This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

KillAll::

File::
c:\program files\WhiteSmokeTranslator\WSTrayDictMode.exe

Folder::
c:\program files\WhiteSmokeTranslator
c:\program files\Ask.com

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;

2.Click Save As... Change the directory to your desktop;

3.Change the Save as type to "All Files";

4.Type in the file name: CFScript

5.Click Save ...

CFScriptB-4.gif

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

Link to post
Share on other sites

I will not be able to check the c:\windows\system32\DRIVERS\AQFileRestore.sys file until I get home from work. I have the laptop with me here at work, but I cannot connect to the Internet.

I ran the ComboFix as you instructed and the laptop is now in a continuous loop where the ComboFix DOS command screen pops up, shows an "Access denied" error, and the screen closes. I'd say this loops through about 150 times a minute. I've rebooted once and shut down/waited five minutes once, and the error came back both times. I tried stopping the process via the task manager, but that didn't work either.

Just to be clear, a ComboFix log was never produced, so there's nothing for me to post.

I'll keep working on getting this looping error to stop.

Link to post
Share on other sites

Welp, this has been interesting!

I shut the machine off and let it sit for five minutes before starting it up again. When it came up, I selected a different Windows user than I had been using and ComboFix looked like it may have completed as it should have. It produced quite a long log, which is posted below.

ComboFix 11-11-15.01 - hope 11/15/2011 18:49:47.4.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2814.1741 [GMT -5:00]

Running from: c:\users\Guest\Desktop\ComboFix.exe

Command switches used :: c:\users\Guest\Desktop\CFScript.txt

AV: Trend Micro AntiVirus *Enabled/Updated* {48929DFC-7A52-A34F-8351-C4DBEDBD9C50}

SP: Trend Micro AntiVirus *Enabled/Updated* {F3F37C18-5C68-ACC1-B9E1-FFA9963AD6ED}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"c:\program files\WhiteSmokeTranslator\WSTrayDictMode.exe"

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files\Ask.com

c:\program files\Ask.com\cobrand.ico

c:\program files\Ask.com\config.xml

c:\program files\Ask.com\favicon.ico

c:\program files\Ask.com\GenericAskToolbar.dll

c:\program files\Ask.com\mupcfg.xml

c:\program files\Ask.com\SaUpdate.exe

c:\program files\Ask.com\UpdateTask.exe

c:\program files\WhiteSmokeTranslator

c:\program files\WhiteSmokeTranslator\CheckLockedWsDictFiles.exe

c:\program files\WhiteSmokeTranslator\Dictionary48x48.ico

c:\program files\WhiteSmokeTranslator\eng.traineddata

c:\program files\WhiteSmokeTranslator\FuncServer_WDC_x64.exe

c:\program files\WhiteSmokeTranslator\html\english\common\iepngfix\blank.gif

c:\program files\WhiteSmokeTranslator\html\english\common\iepngfix\checkerboard.gif

c:\program files\WhiteSmokeTranslator\html\english\common\iepngfix\helix.gif

c:\program files\WhiteSmokeTranslator\html\english\common\iepngfix\iepngfix.htc

c:\program files\WhiteSmokeTranslator\html\english\common\iepngfix\iepngfix.html

c:\program files\WhiteSmokeTranslator\html\english\common\iepngfix\opacity.png

c:\program files\WhiteSmokeTranslator\html\english\common\js\common.js

c:\program files\WhiteSmokeTranslator\html\english\common\js\pngfix.js

c:\program files\WhiteSmokeTranslator\html\english\common\js\prototype.js

c:\program files\WhiteSmokeTranslator\html\english\common\js\xmlhttp.js

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Background\ajax-loader.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Background\bottom_bg.png

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Background\bottom_left_corner.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Background\bottom_left_corner.png

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Background\bottom_right_corner.png

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Background\down_arrow.png

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Background\drop_down_input_box.png

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Background\empty.jpg

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Background\input_bg.png

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Background\left_input.png

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Background\loading_dictionary.swf

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Background\resize.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Background\result_area_top_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Background\result_area_top_bg_.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Background\right_input.png

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Background\search_strip_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Background\search_strip_bg2.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\combo_left.png

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\combo_right.png

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\dictionary_disabled.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\dictionary_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\dictionary_press.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\dictionary_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\do_disabled.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\down_arrow.png

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\go_disabled.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\go_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\go_press.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\go_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\idioms_disabled.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\idioms_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\idioms_press.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\idioms_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\input_left.png

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\thesaurus_disabled.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\thesaurus_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\thesaurus_press.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\thesaurus_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\translate_normal.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\translate_pressed.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\translate_rollover.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\translation_disabled.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\translation_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\translation_press.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\Buttons\translation_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_bar_close_down.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_bar_close_down_.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_bar_close_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_bar_close_over_.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_bar_close_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_bar_close_up_.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_bar_max_down.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_bar_max_down_.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_bar_max_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_bar_max_over_.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_bar_max_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_bar_max_up_.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_bar_max2_down.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_bar_max2_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_bar_max2_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_bar_min_down.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_bar_min_down_.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_bar_min_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_bar_min_over_.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_bar_min_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_bar_min_up_.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_bar_re_down.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_bar_re_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_bar_re_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_strip.png

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_strip_right_corner.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\caption_strip_right_corner.png

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\logo.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\captionbar\logo.png

c:\program files\WhiteSmokeTranslator\html\english\dict\img\popup\screen_bg.png

c:\program files\WhiteSmokeTranslator\html\english\dict\img\popup\screen_bg_bottom.png

c:\program files\WhiteSmokeTranslator\html\english\dict\img\popup\screen_bg_top.png

c:\program files\WhiteSmokeTranslator\html\english\dict\img\popup\screen_captionbar_press.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\popup\screen_captionbar_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\img\spacer.gif

c:\program files\WhiteSmokeTranslator\html\english\dict\index.html

c:\program files\WhiteSmokeTranslator\html\english\dict\js\common.js

c:\program files\WhiteSmokeTranslator\html\english\dict\js\Contextmenu.js

c:\program files\WhiteSmokeTranslator\html\english\dict\js\dictInterface.js

c:\program files\WhiteSmokeTranslator\html\english\dict\js\index.html

c:\program files\WhiteSmokeTranslator\html\english\dict\js\jquery-1.3.2.min.js

c:\program files\WhiteSmokeTranslator\html\english\dict\js\jquery.combobox.js

c:\program files\WhiteSmokeTranslator\html\english\dict\js\jquery.js

c:\program files\WhiteSmokeTranslator\html\english\dict\js\prototype.js

c:\program files\WhiteSmokeTranslator\html\english\dict\js\xmlhttp.js

c:\program files\WhiteSmokeTranslator\html\english\dict\style\combobox.css

c:\program files\WhiteSmokeTranslator\html\english\dict\style\Contextmenu.css

c:\program files\WhiteSmokeTranslator\html\english\dict\style\dictionary.css

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Background\ajax-loader.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Background\bottom_bg.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Background\bottom_left_corner.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Background\corner_bottom_left.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Background\corner_bottom_right.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Background\corner_top_left.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Background\corner_top_right.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Background\down_arrow.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Background\empty.jpg

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Background\input_bg.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Background\left_input.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Background\loading_dictionary.swf

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Background\resize.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Background\right_input.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Background\search_strip_bg3.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Buttons\dictionary_disabled.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Buttons\dictionary_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Buttons\dictionary_press.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Buttons\dictionary_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Buttons\down_arrow.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Buttons\go_disabled.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Buttons\go_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Buttons\go_press.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Buttons\go_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Buttons\idioms_disabled.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Buttons\idioms_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Buttons\idioms_press.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Buttons\idioms_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Buttons\thesaurus_disabled.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Buttons\thesaurus_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Buttons\thesaurus_press.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Buttons\thesaurus_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Buttons\translate_normal.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Buttons\translate_pressed.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Buttons\translate_rollover.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Buttons\translation_disabled.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Buttons\translation_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Buttons\translation_press.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\Buttons\translation_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\captionbar\caption_bar_close_down.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\captionbar\caption_bar_close_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\captionbar\caption_bar_close_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\captionbar\caption_bar_max_down.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\captionbar\caption_bar_max_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\captionbar\caption_bar_max_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\captionbar\caption_bar_min_down.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\captionbar\caption_bar_min_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\captionbar\caption_bar_min_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\captionbar\caption_dictionary_off.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\captionbar\caption_dictionary_press.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\captionbar\caption_dictionary_roll_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\captionbar\caption_strip.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\captionbar\caption_strip_right_corner.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\captionbar\caption_strip_right_corner.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\captionbar\caption_translation_off.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\captionbar\caption_translation_press.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\captionbar\caption_translation_roll_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\captionbar\logo.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\popup\screen_bg.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\popup\screen_bg_bottom.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\popup\screen_bg_top.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\popup\screen_captionbar_press.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\popup\screen_captionbar_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\img\spacer.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\index.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\js\common.js

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\js\Contextmenu.js

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\js\dictInterface.js

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\js\jquery.combobox.js

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\js\jquery.js

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\js\prototype.js

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\js\xmlhttp.js

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\style\combobox.css

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\style\Contextmenu.css

c:\program files\WhiteSmokeTranslator\html\english\dictClientDic\style\dictionary.css

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\content\demo\demo.swf

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\faq.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\firewall.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\autocorrect.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\backtomain.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\body_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\bottom_strip.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\cs_01.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\demo_button_over.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\demo_button_up.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\enrichmentondemand.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\everywhere.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\explore_01.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\faq_bullet.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\faq_bullet_new.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\faq_button_over.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\faq_button_up.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\grammarexp.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\guide_button_over.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\guide_button_up.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\make_changes_to_text.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\next.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\prev.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\questions_tbl.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\settings-general.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\settings-shortcut.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\spacer.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\tech_button_over.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\tech_button_up.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\us_ws_01.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\us_ws_02.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\us_ws_03.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\us_wsdict_any.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\use_wsdict_in.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\userguide_bullet.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\userguide_bullet2.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\userguide_subbullet.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\whitesmoke_templates.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\writingStyles.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\img\wsnotifierpicture.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\index.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\js\iepngfix\blank.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\js\iepngfix\checkerboard.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\js\iepngfix\helix.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\js\iepngfix\iepngfix.htc

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\js\iepngfix\iepngfix.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\js\iepngfix\opacity.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\js\iframeInterface.js

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\js\objectSwap.js

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\style\help.css

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\style\user_guide.css

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\technical.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\userguide-p1.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\userguide-p11.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\userguide-p12.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\userguide-p13.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\userguide-p14.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\userguide-p2.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\userguide-p3.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\userguide-p4.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\userguide-p5.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\userguide-p6.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\userguide-p7.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\userguide-p8.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\userguide-p9.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\content\userguide.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\ajax-loader.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\body_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\bottom_bg.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\bottom_left_corner.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\bottom_right_corner.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\bottom_strip.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\button_f2.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\buttonf2.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\buy_button.jpg

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\expired.jpg

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\inside_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\left_column_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\loading_dictionary.swf

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\logo.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\logo_in.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\noconnection.jpg

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\pen.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\pen_h.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\result_area_top_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\scrbox_bottom.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\scrbox_left.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\scrbox_left_bottom.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\scrbox_left_top.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\scrbox_right.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\scrbox_right_bottom.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\scrbox_right_top.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\scrbox_top.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\screen_title.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\search_strip_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\title_strip_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\title_strip_left.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\title_strip_right.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\Background\top_strip.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\captionbar\caption_bar_close_down.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\captionbar\caption_bar_close_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\captionbar\caption_bar_close_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\captionbar\caption_bar_max_down.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\captionbar\caption_bar_max_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\captionbar\caption_bar_max_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\captionbar\caption_bar_min_down.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\captionbar\caption_bar_min_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\captionbar\caption_bar_min_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\captionbar\caption_bar_re_down.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\captionbar\caption_bar_re_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\captionbar\caption_bar_re_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\captionbar\caption_strip.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\captionbar\caption_strip_right_corner.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\img\captionbar\logo.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\index.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\js\common.js

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\js\iepngfix\blank.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\js\iepngfix\checkerboard.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\js\iepngfix\helix.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\js\iepngfix\iepngfix.htc

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\js\iepngfix\iepngfix.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\js\iepngfix\opacity.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\js\iframeInterface.js

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\js\index.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\js\welcomeInterface.js

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\style\activation.css

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\style\welcome.css

c:\program files\WhiteSmokeTranslator\html\english\dictClientHelp\style\welcomescreen.css

c:\program files\WhiteSmokeTranslator\html\english\dictClientRegistration\img\back.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientRegistration\img\banner.jpg

c:\program files\WhiteSmokeTranslator\html\english\dictClientRegistration\img\body_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientRegistration\img\captionbar\caption_bar_close_down.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientRegistration\img\captionbar\caption_bar_close_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientRegistration\img\captionbar\caption_bar_close_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientRegistration\img\captionbar\caption_strip.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientRegistration\img\captionbar\logo.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientRegistration\img\congra.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientRegistration\img\continue_button_click.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientRegistration\img\continue_button_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientRegistration\img\continue_button_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientRegistration\img\continue_button_up.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientRegistration\img\down.jpg

c:\program files\WhiteSmokeTranslator\html\english\dictClientRegistration\img\f2.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientRegistration\img\intro.jpg

c:\program files\WhiteSmokeTranslator\html\english\dictClientRegistration\img\welcome.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientRegistration\index.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientRegistration\js\regInterface.js

c:\program files\WhiteSmokeTranslator\html\english\dictClientRegistration\style\registration.css

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\css\index.css

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\Background\left_bg.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\Background\logo.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\Background\main_bg.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\Background\right_bg.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\Background\tabcontent_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\Background\Thumbs.db

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\Buttons\cancel_disabled.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\Buttons\cancel_down.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\Buttons\cancel_over.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\Buttons\cancel_up.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\Buttons\save_disabled.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\Buttons\save_down.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\Buttons\save_over.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\Buttons\save_up.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\Buttons\tab_connection_off.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\Buttons\tab_connection_on.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\Buttons\tab_content_off.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\Buttons\tab_content_on.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\Buttons\tab_general_off.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\Buttons\tab_general_on.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\Buttons\tab_info_off.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\Buttons\tab_info_on.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\Buttons\tab_shortcut_off.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\Buttons\tab_shortcut_on.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\Buttons\tab_template.psd

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\captionbar\caption_bar_close_down.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\captionbar\caption_bar_close_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\img\captionbar\caption_bar_close_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\index.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\js\iepngfix\blank.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\js\iepngfix\checkerboard.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\js\iepngfix\helix.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\js\iepngfix\iepngfix.htc

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\js\iepngfix\iepngfix.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\js\iepngfix\opacity.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientSettings\js\settingsInterface.js

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\img\Background\attic\use_ws_bgNEW.PNG

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\img\Background\translator-welcome-final.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\img\Background\translator-welcome-final.jpg

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\img\Background\translator-welcome-final.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\img\Background\use_ws_bgNEW.jpg

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\img\Background\use_ws_bgNEW.PNG

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\img\buy_button.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\img\caption_bar_close_down.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\img\caption_bar_close_over.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\img\caption_bar_close_up.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\img\captionbar\arrow_white.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\img\captionbar\caption_strip.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\img\captionbar\left_bot_chunk.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\img\captionbar\right_bot_chunk.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\img\captionbar\white_x_button.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\img\close_button.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\img\close_button_down.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\img\expired_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\img\expired_bg.jpg

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\img\expired_bg.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\img\expired_bg2.png

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\img\translator-expired.jpg

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\img\UserGuide_Translator.jpg

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\js\iframeInterface.js

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\style\welcome.css

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\welcome_all.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\content\welcome_expired.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\index.html

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\js\welcomeInterface.js

c:\program files\WhiteSmokeTranslator\html\english\dictClientWelcome\style\welcomescreen.css

c:\program files\WhiteSmokeTranslator\html\english\floatingButton\blue-Q-rollover.gif

c:\program files\WhiteSmokeTranslator\html\english\floatingButton\blue-rollover.gif

c:\program files\WhiteSmokeTranslator\html\english\floatingButton\blue-X-rollover.gif

c:\program files\WhiteSmokeTranslator\html\english\floatingButton\blue.gif

c:\program files\WhiteSmokeTranslator\html\english\floatingButton\index.html

c:\program files\WhiteSmokeTranslator\html\english\floatingButton\red&blue.gif

c:\program files\WhiteSmokeTranslator\html\english\floatingButton_howto\img\Background\howto_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\floatingButton_howto\img\spacer.gif

c:\program files\WhiteSmokeTranslator\html\english\floatingButton_howto\index.html

c:\program files\WhiteSmokeTranslator\html\english\floatingButton_howto\js\iepngfix\blank.gif

c:\program files\WhiteSmokeTranslator\html\english\floatingButton_howto\js\iepngfix\checkerboard.gif

c:\program files\WhiteSmokeTranslator\html\english\floatingButton_howto\js\iepngfix\helix.gif

c:\program files\WhiteSmokeTranslator\html\english\floatingButton_howto\js\iepngfix\iepngfix.htc

c:\program files\WhiteSmokeTranslator\html\english\floatingButton_howto\js\iepngfix\iepngfix.html

c:\program files\WhiteSmokeTranslator\html\english\floatingButton_howto\js\iepngfix\opacity.png

c:\program files\WhiteSmokeTranslator\html\english\floatingButton_howto\js\index.js

c:\program files\WhiteSmokeTranslator\html\english\floatingButton_howto\style\style.css

c:\program files\WhiteSmokeTranslator\html\english\floatingMenu\index.html

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\ajax-loader.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\base_fade_px.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\bg_bottom.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\blue_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\blue_bg_.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\blue_bottom_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\blue_dark_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\blue_dark_bg_.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\blue_top_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\blue_top_bg_.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\bottom_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\bottom_grey_strip.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\bottom_left_corner.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\bottom_left_corner.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\bottom_left_corner_old.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\bottom_left_corner6.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\bottom_right_corner.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\bottom_right_corner.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\bottom_right_corner_old.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\bottom_right_corner6.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\bottombar_px.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\buttons_separator.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\buttons_tray_bottom_px.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\buttons_tray_px.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\cascade.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\collapse.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\context_bl2.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\context_br2.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\context_dot.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\context_menu_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\context_sub_menu_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\context_submenu.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\context_submenu_dis.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\context_tl2.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\context_tr2.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\Copy of notice_right_top_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\corner_bottom_left.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\corner_bottom_right.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\corner_top_left.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\corner_top_right.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\down_arrow.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\dpreloader.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\dpreloader_left_bottom_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\dpreloader_left_top_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\dpreloader_right_bottom_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\dpreloader_right_top_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\drop_down_input_box.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\edit_footer_left.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\edit_footer_px.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\edit_footer_right.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\edit_header_left.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\edit_header_px.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\edit_header_right.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\edit_sidefade.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\empty.jpg

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\epreloader_left_bottom_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\epreloader_left_top_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\epreloader_right_bottom_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\epreloader_right_top_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\feather.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\input_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\inputline_fade_px.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\left_input.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\left_input_old.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\loading_dictionary.swf

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\main_background.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\notice_checkbox_checked.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\notice_checkbox_unchecked.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\notice_close_down.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\notice_close_over.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\notice_close_up.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\notice_left_bottom_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\notice_left_top_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\notice_right_bottom_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\notice_right_top_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\resize.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\resize_gripper.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\resize_gripper.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\result_area_top_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\result_area_top_bg_.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\right_input.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\right_input_old.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\search_strip_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\search_strip_bg2.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\sideinfoblankimage.jpg

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\spacer.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\spacer_.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\strike_blue.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\strike_green.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\strike_green2.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\strike_purple.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\strike_red.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\summaryline_left_corner.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\summaryline_px.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\summaryline_right_corner.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\Thumbs.db

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\ticket.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\top_grey_strip.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Background\wslogo.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\Autocorrect-btn-press.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\Autocorrect-btn-roll-over.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\Autocorrect-btn.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\Autocorrect-close-press.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\Autocorrect-close-rollover.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\Autocorrect-close.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\Autocorrect-open-press.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\Autocorrect-open-rollover.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\Autocorrect-open.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\autocorrect_arrow_down.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\autocorrect_arrow_roll.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\autocorrect_arrow_roll2.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\autocorrect_arrow_roll3.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\autocorrect_arrowclose_roll.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\autocorrect_disabled.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\autocorrect_down.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\autocorrect_over.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\autocorrect_up.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\bottombar_buynow_down.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\bottombar_buynow_roll.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\bottombar_buynow_up.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\bottombar_tellfriend_down.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\bottombar_tellfriend_roll.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\bottombar_tellfriend_up.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\close_down.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\close_over.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\close_up.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\input_left.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\menuline_dictionary_down.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\menuline_dictionary_down.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\menuline_dictionary_roll.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\menuline_dictionary_roll.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\menuline_dictionary_up.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\menuline_dictionary_up.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\menuline_edit_down.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\menuline_edit_roll.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\menuline_edit_up.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\menuline_englishlessons_down.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\menuline_englishlessons_roll.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\menuline_englishlessons_up.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\menuline_menu_down.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\menuline_menu_down.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\menuline_menu_roll.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\menuline_menu_roll.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\menuline_menu_up.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\menuline_menu_up.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\menuline_templates_down.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\menuline_templates_down.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\menuline_templates_roll.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\menuline_templates_roll.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\menuline_templates_up.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\menuline_templates_up.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\new_autocorrect_down.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\new_autocorrect_nofocus.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\notice_userguide_press.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\notice_userguide_up.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\redo_disabled.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\redo_down.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\redo_roll.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\redo_up.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\smallclosebutton.gif

Link to post
Share on other sites

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\summaryline_apply_down.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\summaryline_apply_down.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\summaryline_apply_roll.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\summaryline_apply_roll.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\summaryline_apply_up.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\summaryline_apply_up.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\summaryline_check_down.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\summaryline_check_down.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\summaryline_check_roll.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\summaryline_check_roll.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\summaryline_check_up.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\summaryline_check_up.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\undo_disabled.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\undo_down.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\undo_roll.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\undo_up.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\x.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\x.jpg

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Buttons\x_hover.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_bar_close_down.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_bar_close_down_old.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_bar_close_over.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_bar_close_over_old.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_bar_close_up.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_bar_close_up_old.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_bar_max_down.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_bar_max_down_old.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_bar_max_over.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_bar_max_over_old.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_bar_max_up.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_bar_max_up_old.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_bar_max2_down.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_bar_max2_over.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_bar_min_down.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_bar_min_over.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_bar_min_up.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_bar_re_down.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_bar_re_down_old.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_bar_re_over.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_bar_re_over_old.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_bar_re_up.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_bar_re_up_old.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_bottom_px.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_bottom_px_old.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_px.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_px_old.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_strip.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_strip.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_strip_right_corner.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_strip_right_corner.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_strip_right_corner_old.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_strip_right_corner6.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_strip_right_corner6.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\caption_strip_under_buttons.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\Copy (2) of logo.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\Copy of logo.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\executive.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\logo.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\logo.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\logo_old.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\logo_without 2008.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\captionbar\Thumbs.db

c:\program files\WhiteSmokeTranslator\html\english\gui\img\close.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\dictionary\bottom_left.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\dictionary\bottom_right.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\dictionary\closeButton.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\dictionary\fadeborder.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\dictionary\load.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\dictionary\Thumbs.db

c:\program files\WhiteSmokeTranslator\html\english\gui\img\dictionary\title.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\dictionary\top_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\dictionary\top_left.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\dictionary\top_right.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichment\bottom_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichment\bottom_left.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichment\bottom_right.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichment\explanation.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichment\fadeborder.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichment\horizontal_border.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichment\qmark.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichment\qmark_old.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichment\Thumbs.db

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichment\title.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichment\title.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichment\title_synonyms.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichment\top_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichment\top_left.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichment\top_right.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichments\bottom_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichments\bottom_left.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichments\bottom_right.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichments\delete_btn.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichments\fadeborder.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichments\qmark.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichments\Thumbs.db

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichments\title.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichments\top_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichments\top_left.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\enrichments\top_right.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\grammar\bottom_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\grammar\bottom_left.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\grammar\bottom_right.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\grammar\explanation.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\grammar\fadeborder.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\grammar\grammarexpclosebutton.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\grammar\qmark.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\grammar\Thumbs.db

c:\program files\WhiteSmokeTranslator\html\english\gui\img\grammar\title.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\grammar\top_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\grammar\top_left.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\grammar\top_right.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Menu\help_over.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Menu\help_up.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Menu\menu_bottom.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Menu\settings_over.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Menu\settings_up.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Menu\submenu.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Menu\Thumbs.db

c:\program files\WhiteSmokeTranslator\html\english\gui\img\open.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\review-section\close.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\review-section\closedy2.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\review-section\content-review.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\review-section\down-content.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\review-section\li-content.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\review-section\open.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\review-section\opencq8.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\review-section\right-content.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\review-section\right-shadow.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\review-section\shdow.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\review-section\show-report.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\review-section\up-shdow.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\scale\horizontalLine.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\scale\horizontalLine_old.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\scale\scale1.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\scale\scale2.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\scale\scale3.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\scale\scale4.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\scale\scale5.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\scale\Thumbs.db

c:\program files\WhiteSmokeTranslator\html\english\gui\img\screens\button_no_down.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\screens\button_no_up.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\screens\button_yes_down.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\screens\button_yes_up.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\screens\ico_analyze.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\screens\ico_complete.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\screens\ico_connection.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\screens\ico_expired.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\screens\loading_window.swf

c:\program files\WhiteSmokeTranslator\html\english\gui\img\screens\screen_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\screens\screen_bg_bottom.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\screens\screen_bg_top.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\screens\screen_bg_top_left.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\screens\screen_bg_top_px.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\screens\screen_bg_top_right.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\screens\screen_captionbar_press.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\screens\screen_captionbar_up.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\screens\screen_getitnow_press.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\screens\screen_getitnow_up.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\screens\screen_ok_press.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\screens\screen_ok_press.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\screens\screen_ok_up.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\screens\screen_ok_up.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\screens\Thumbs.db

c:\program files\WhiteSmokeTranslator\html\english\gui\img\spacer.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\img\spelling\add_to_dictionary_btn.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\spelling\bottom_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\spelling\bottom_left.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\spelling\bottom_right.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\spelling\fadeborder.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\spelling\qmark.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\spelling\Thumbs.db

c:\program files\WhiteSmokeTranslator\html\english\gui\img\spelling\title.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\spelling\top_bg.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\spelling\top_left.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\spelling\top_right.png

c:\program files\WhiteSmokeTranslator\html\english\gui\img\Thumbs.db

c:\program files\WhiteSmokeTranslator\html\english\gui\index.html

c:\program files\WhiteSmokeTranslator\html\english\gui\js\appInterface.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\builder.pack.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\common.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\Contextmenu.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\controls.pack.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\dictionaryContextMenu.class.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\dragdrop.pack.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\effects.pack.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\enrichmentContextMenu.class.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\enrichmentsContextMenu.class.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\final.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\gmonitor.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\grammarCache.class.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\grammarContextMenu.class.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\iepngfix\blank.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\js\iepngfix\checkerboard.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\js\iepngfix\helix.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\js\iepngfix\iepngfix.htc

c:\program files\WhiteSmokeTranslator\html\english\gui\js\iepngfix\iepngfix.html

c:\program files\WhiteSmokeTranslator\html\english\gui\js\iepngfix\opacity.png

c:\program files\WhiteSmokeTranslator\html\english\gui\js\jqModal.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\jquery-1.2.6.pack.NotUSED.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\jquery-1.3.2.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\jquery-1.3.2.min.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\jquery.ba-throttle-debounce.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\jquery.jeegoocontext.min.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\monitor.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\NonPackedVersion\builder.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\NonPackedVersion\controls.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\NonPackedVersion\dragdrop.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\NonPackedVersion\effects.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\NonPackedVersion\prototype.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\NonPackedVersion\slider.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\NonPackedVersion\sound.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\prototype.pack.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\scriptaculous.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\slider.pack.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\sound.pack.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\spellingContextMenu.class.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\summary.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\supersleight.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\switchcontent.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\tooltip.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\unittest.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\ws_content_manager.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\ws_functions.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\ws_links.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\x.gif

c:\program files\WhiteSmokeTranslator\html\english\gui\js\xmlhttp.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\ypSlideOutMenus.js

c:\program files\WhiteSmokeTranslator\html\english\gui\js\ypSlideOutMenusContext.js

c:\program files\WhiteSmokeTranslator\html\english\gui\style\combobox.css

c:\program files\WhiteSmokeTranslator\html\english\gui\style\Contextmenu.css

c:\program files\WhiteSmokeTranslator\html\english\gui\style\Copy of indexnew.css

c:\program files\WhiteSmokeTranslator\html\english\gui\style\dictionary.css

c:\program files\WhiteSmokeTranslator\html\english\gui\style\enrichment.css

c:\program files\WhiteSmokeTranslator\html\english\gui\style\enrichments.css

c:\program files\WhiteSmokeTranslator\html\english\gui\style\grammar.css

c:\program files\WhiteSmokeTranslator\html\english\gui\style\indexnew.css

c:\program files\WhiteSmokeTranslator\html\english\gui\style\jeegoo.css

c:\program files\WhiteSmokeTranslator\html\english\gui\style\jqModal.css

c:\program files\WhiteSmokeTranslator\html\english\gui\style\screens.css

c:\program files\WhiteSmokeTranslator\html\english\gui\style\spelling.css

c:\program files\WhiteSmokeTranslator\html\english\help\content\content\demo\demo.swf

c:\program files\WhiteSmokeTranslator\html\english\help\content\faq.html

c:\program files\WhiteSmokeTranslator\html\english\help\content\firewall.html

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\autocorrect.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\backtomain.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\body_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\bottom_strip.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\cs_01.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\demo_button_over.png

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\demo_button_up.png

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\enrichmentondemand.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\everywhere.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\explore_01.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\faq_bullet.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\faq_bullet_new.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\faq_button_over.png

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\faq_button_up.png

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\grammarexp.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\guide_button_over.png

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\guide_button_up.png

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\make_changes_to_text.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\next.png

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\prev.png

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\questions_tbl.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\settings-general.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\settings-shortcut.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\spacer.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\tech_button_over.png

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\tech_button_up.png

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\us_ws_01.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\us_ws_02.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\us_ws_03.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\us_wsdict_any.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\use_wsdict_in.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\userguide_bullet.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\userguide_bullet2.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\userguide_subbullet.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\whitesmoke_templates.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\writingStyles.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\img\wsnotifierpicture.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\index.html

c:\program files\WhiteSmokeTranslator\html\english\help\content\js\iepngfix\blank.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\js\iepngfix\checkerboard.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\js\iepngfix\helix.gif

c:\program files\WhiteSmokeTranslator\html\english\help\content\js\iepngfix\iepngfix.htc

c:\program files\WhiteSmokeTranslator\html\english\help\content\js\iepngfix\iepngfix.html

c:\program files\WhiteSmokeTranslator\html\english\help\content\js\iepngfix\opacity.png

c:\program files\WhiteSmokeTranslator\html\english\help\content\js\iframeInterface.js

c:\program files\WhiteSmokeTranslator\html\english\help\content\js\objectSwap.js

c:\program files\WhiteSmokeTranslator\html\english\help\content\style\help.css

c:\program files\WhiteSmokeTranslator\html\english\help\content\style\user_guide.css

c:\program files\WhiteSmokeTranslator\html\english\help\content\technical.html

c:\program files\WhiteSmokeTranslator\html\english\help\content\userguide-p1.html

c:\program files\WhiteSmokeTranslator\html\english\help\content\userguide-p11.html

c:\program files\WhiteSmokeTranslator\html\english\help\content\userguide-p12.html

c:\program files\WhiteSmokeTranslator\html\english\help\content\userguide-p13.html

c:\program files\WhiteSmokeTranslator\html\english\help\content\userguide-p14.html

c:\program files\WhiteSmokeTranslator\html\english\help\content\userguide-p2.html

c:\program files\WhiteSmokeTranslator\html\english\help\content\userguide-p3.html

c:\program files\WhiteSmokeTranslator\html\english\help\content\userguide-p4.html

c:\program files\WhiteSmokeTranslator\html\english\help\content\userguide-p5.html

c:\program files\WhiteSmokeTranslator\html\english\help\content\userguide-p6.html

c:\program files\WhiteSmokeTranslator\html\english\help\content\userguide-p7.html

c:\program files\WhiteSmokeTranslator\html\english\help\content\userguide-p8.html

c:\program files\WhiteSmokeTranslator\html\english\help\content\userguide-p9.html

c:\program files\WhiteSmokeTranslator\html\english\help\content\userguide.html

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\ajax-loader.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\body_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\bottom_bg.png

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\bottom_border.png

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\bottom_left_corner.png

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\bottom_right_corner.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\bottom_right_corner.png

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\bottom_strip.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\button_f2.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\buttonf2.png

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\buy_button.jpg

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\expired.jpg

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\inside_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\left_border.png

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\left_bottom_corner.png

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\left_column_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\loading_dictionary.swf

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\logo.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\logo_in.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\noconnection.jpg

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\pen.png

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\pen_h.png

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\result_area_top_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\right_border.png

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\right_bottom_corner.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\right_bottom_corner.png

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\right_column_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\scrbox_bottom.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\scrbox_left.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\scrbox_left_bottom.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\scrbox_left_top.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\scrbox_right.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\scrbox_right_bottom.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\scrbox_right_top.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\scrbox_top.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\screen_title.png

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\search_strip_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\title_strip_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\title_strip_left.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\title_strip_right.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\Background\top_strip.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\captionbar\caption_bar_close_down.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\captionbar\caption_bar_close_over.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\captionbar\caption_bar_close_up.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\captionbar\caption_bar_max_down.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\captionbar\caption_bar_max_over.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\captionbar\caption_bar_max_up.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\captionbar\caption_bar_min_down.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\captionbar\caption_bar_min_over.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\captionbar\caption_bar_min_up.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\captionbar\caption_bar_re_down.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\captionbar\caption_bar_re_over.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\captionbar\caption_bar_re_up.gif

c:\program files\WhiteSmokeTranslator\html\english\help\img\captionbar\caption_strip.png

c:\program files\WhiteSmokeTranslator\html\english\help\img\captionbar\caption_strip_right_corner.png

c:\program files\WhiteSmokeTranslator\html\english\help\img\captionbar\logo.png

c:\program files\WhiteSmokeTranslator\html\english\help\index.html

c:\program files\WhiteSmokeTranslator\html\english\help\js\common.js

c:\program files\WhiteSmokeTranslator\html\english\help\js\iepngfix\blank.gif

c:\program files\WhiteSmokeTranslator\html\english\help\js\iepngfix\checkerboard.gif

c:\program files\WhiteSmokeTranslator\html\english\help\js\iepngfix\helix.gif

c:\program files\WhiteSmokeTranslator\html\english\help\js\iepngfix\iepngfix.htc

c:\program files\WhiteSmokeTranslator\html\english\help\js\iepngfix\iepngfix.html

c:\program files\WhiteSmokeTranslator\html\english\help\js\iepngfix\opacity.png

c:\program files\WhiteSmokeTranslator\html\english\help\js\iframeInterface.js

c:\program files\WhiteSmokeTranslator\html\english\help\js\index.html

c:\program files\WhiteSmokeTranslator\html\english\help\js\welcomeInterface.js

c:\program files\WhiteSmokeTranslator\html\english\help\style\activation.css

c:\program files\WhiteSmokeTranslator\html\english\help\style\welcome.css

c:\program files\WhiteSmokeTranslator\html\english\help\style\welcomescreen.css

c:\program files\WhiteSmokeTranslator\html\english\notifier\img\close_button.png

c:\program files\WhiteSmokeTranslator\html\english\notifier\img\notifier_main_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\notifier\index.html

c:\program files\WhiteSmokeTranslator\html\english\notifier\start.html

c:\program files\WhiteSmokeTranslator\html\english\registration\img\body_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\registration\img\captionbar\caption_bar_close_down.gif

c:\program files\WhiteSmokeTranslator\html\english\registration\img\captionbar\caption_bar_close_over.gif

c:\program files\WhiteSmokeTranslator\html\english\registration\img\captionbar\caption_bar_close_up.gif

c:\program files\WhiteSmokeTranslator\html\english\registration\img\captionbar\caption_strip.png

c:\program files\WhiteSmokeTranslator\html\english\registration\img\captionbar\logo.png

c:\program files\WhiteSmokeTranslator\html\english\registration\img\congra.png

c:\program files\WhiteSmokeTranslator\html\english\registration\img\continue_button_click.gif

c:\program files\WhiteSmokeTranslator\html\english\registration\img\continue_button_over.gif

c:\program files\WhiteSmokeTranslator\html\english\registration\img\continue_button_up.gif

c:\program files\WhiteSmokeTranslator\html\english\registration\img\intro.jpg

c:\program files\WhiteSmokeTranslator\html\english\registration\img\welcome.png

c:\program files\WhiteSmokeTranslator\html\english\registration\index.html

c:\program files\WhiteSmokeTranslator\html\english\registration\js\regInterface.js

c:\program files\WhiteSmokeTranslator\html\english\registration\style\registration.css

c:\program files\WhiteSmokeTranslator\html\english\settings\css\index.css

c:\program files\WhiteSmokeTranslator\html\english\settings\img\Background\left_bg.png

c:\program files\WhiteSmokeTranslator\html\english\settings\img\Background\logo.png

c:\program files\WhiteSmokeTranslator\html\english\settings\img\Background\main_bg.png

c:\program files\WhiteSmokeTranslator\html\english\settings\img\Background\right_bg.png

c:\program files\WhiteSmokeTranslator\html\english\settings\img\Background\tabcontent_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\settings\img\Background\Thumbs.db

c:\program files\WhiteSmokeTranslator\html\english\settings\img\Buttons\cancel_disabled.png

c:\program files\WhiteSmokeTranslator\html\english\settings\img\Buttons\cancel_down.png

c:\program files\WhiteSmokeTranslator\html\english\settings\img\Buttons\cancel_over.png

c:\program files\WhiteSmokeTranslator\html\english\settings\img\Buttons\cancel_up.png

c:\program files\WhiteSmokeTranslator\html\english\settings\img\Buttons\save_disabled.png

c:\program files\WhiteSmokeTranslator\html\english\settings\img\Buttons\save_down.png

c:\program files\WhiteSmokeTranslator\html\english\settings\img\Buttons\save_over.png

c:\program files\WhiteSmokeTranslator\html\english\settings\img\Buttons\save_up.png

c:\program files\WhiteSmokeTranslator\html\english\settings\img\Buttons\tab_connection_off.png

c:\program files\WhiteSmokeTranslator\html\english\settings\img\Buttons\tab_connection_on.png

c:\program files\WhiteSmokeTranslator\html\english\settings\img\Buttons\tab_content_off.png

c:\program files\WhiteSmokeTranslator\html\english\settings\img\Buttons\tab_content_on.png

c:\program files\WhiteSmokeTranslator\html\english\settings\img\Buttons\tab_general_off.png

c:\program files\WhiteSmokeTranslator\html\english\settings\img\Buttons\tab_general_on.png

c:\program files\WhiteSmokeTranslator\html\english\settings\img\Buttons\tab_info_off.png

c:\program files\WhiteSmokeTranslator\html\english\settings\img\Buttons\tab_info_on.png

c:\program files\WhiteSmokeTranslator\html\english\settings\img\Buttons\tab_shortcut_off.png

c:\program files\WhiteSmokeTranslator\html\english\settings\img\Buttons\tab_shortcut_on.png

c:\program files\WhiteSmokeTranslator\html\english\settings\img\Buttons\tab_template.psd

c:\program files\WhiteSmokeTranslator\html\english\settings\img\captionbar\caption_bar_close_down.gif

c:\program files\WhiteSmokeTranslator\html\english\settings\img\captionbar\caption_bar_close_over.gif

c:\program files\WhiteSmokeTranslator\html\english\settings\img\captionbar\caption_bar_close_up.gif

c:\program files\WhiteSmokeTranslator\html\english\settings\index.html

c:\program files\WhiteSmokeTranslator\html\english\settings\js\iepngfix\blank.gif

c:\program files\WhiteSmokeTranslator\html\english\settings\js\iepngfix\checkerboard.gif

c:\program files\WhiteSmokeTranslator\html\english\settings\js\iepngfix\helix.gif

c:\program files\WhiteSmokeTranslator\html\english\settings\js\iepngfix\iepngfix.htc

c:\program files\WhiteSmokeTranslator\html\english\settings\js\iepngfix\iepngfix.html

c:\program files\WhiteSmokeTranslator\html\english\settings\js\iepngfix\opacity.png

c:\program files\WhiteSmokeTranslator\html\english\settings\js\settingsInterface.js

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Background\bg_center_bottom.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Background\bg_center_up.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Background\bg_gray.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Background\bg_gray_sides.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Background\bottom_left.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Background\bottom_right.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Background\bottom_right_corner.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Background\bottom_right_corner.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Background\logo.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Background\start_bullet.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Background\template_list_caption.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Background\template_title_logo.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Background\template_title_logo.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Buttons\apply_disabled.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Buttons\apply_down.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Buttons\apply_down.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Buttons\apply_over.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Buttons\apply_over.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Buttons\apply_up.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Buttons\apply_up.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Buttons\cancel_disabled.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Buttons\cancel_down.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Buttons\cancel_down.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Buttons\cancel_over.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Buttons\cancel_over.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Buttons\cancel_up.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Buttons\cancel_up.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Buttons\suggest_disabled.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Buttons\suggest_down.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Buttons\suggest_over.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\Buttons\suggest_up.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\captionbar\caption_bar_close_down.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\captionbar\caption_bar_close_over.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\captionbar\caption_bar_close_up.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\captionbar\caption_bar_max_down.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\captionbar\caption_bar_max_over.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\captionbar\caption_bar_max_up.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\captionbar\caption_bar_min_down.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\captionbar\caption_bar_min_over.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\captionbar\caption_bar_min_up.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\captionbar\caption_bar_re_down.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\captionbar\caption_bar_re_over.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\captionbar\caption_bar_re_up.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\captionbar\left_corner.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\captionbar\right_corner.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\captionbar\Thumbs.db

c:\program files\WhiteSmokeTranslator\html\english\templates\img\screens\button_no_down.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\screens\button_no_up.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\screens\button_yes_down.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\screens\button_yes_up.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\screens\ico_analyze.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\screens\ico_complete.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\screens\ico_connection.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\screens\ico_expired.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\screens\loading_window.swf

c:\program files\WhiteSmokeTranslator\html\english\templates\img\screens\screen_bg.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\screens\screen_bg_bottom.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\screens\screen_bg_top.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\screens\screen_bg_top_left.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\screens\screen_bg_top_px.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\screens\screen_bg_top_right.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\screens\screen_captionbar_press.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\screens\screen_captionbar_up.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\screens\screen_getitnow_press.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\screens\screen_getitnow_up.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\screens\screen_ok_press.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\screens\screen_ok_up.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\spacer.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\tree\ajax-loader.gif

c:\program files\WhiteSmokeTranslator\html\english\templates\img\tree\cascade.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\tree\collapse.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\tree\folder.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\tree\loading_dictionary.swf

c:\program files\WhiteSmokeTranslator\html\english\templates\img\tree\template.png

c:\program files\WhiteSmokeTranslator\html\english\templates\img\tree\Thumbs.db

c:\program files\WhiteSmokeTranslator\html\english\templates\index.html

c:\program files\WhiteSmokeTranslator\html\english\templates\js\Contextmenu.js

c:\program files\WhiteSmokeTranslator\html\english\templates\js\prototype.js

c:\program files\WhiteSmokeTranslator\html\english\templates\js\templatesCache.class.js

c:\program files\WhiteSmokeTranslator\html\english\templates\js\templatesInterface.js

c:\program files\WhiteSmokeTranslator\html\english\templates\js\xmlhttp.js

c:\program files\WhiteSmokeTranslator\html\english\templates\style\Contextmenu.css

c:\program files\WhiteSmokeTranslator\html\english\templates\style\index.css

c:\program files\WhiteSmokeTranslator\html\english\templates\style\screens.css

c:\program files\WhiteSmokeTranslator\html\english\welcome\content\img\Background\splash.gif

c:\program files\WhiteSmokeTranslator\html\english\welcome\content\img\Background\splash.jpg

c:\program files\WhiteSmokeTranslator\html\english\welcome\content\img\Background\use_ws_bgNEW.PNG

c:\program files\WhiteSmokeTranslator\html\english\welcome\content\img\buy_button.gif

c:\program files\WhiteSmokeTranslator\html\english\welcome\content\img\captionbar\arrow_white.gif

c:\program files\WhiteSmokeTranslator\html\english\welcome\content\img\captionbar\caption_strip.png

c:\program files\WhiteSmokeTranslator\html\english\welcome\content\img\captionbar\left_bot_chunk.gif

c:\program files\WhiteSmokeTranslator\html\english\welcome\content\img\captionbar\right_bot_chunk.gif

c:\program files\WhiteSmokeTranslator\html\english\welcome\content\img\captionbar\white_x_button.gif

c:\program files\WhiteSmokeTranslator\html\english\welcome\content\img\close_button.gif

c:\program files\WhiteSmokeTranslator\html\english\welcome\content\img\close_button_down.gif

c:\program files\WhiteSmokeTranslator\html\english\welcome\content\img\expired_bg.gif

c:\program files\WhiteSmokeTranslator\html\english\welcome\content\js\iframeInterface.js

c:\program files\WhiteSmokeTranslator\html\english\welcome\content\style\welcome.css

c:\program files\WhiteSmokeTranslator\html\english\welcome\content\welcome_all.html

c:\program files\WhiteSmokeTranslator\html\english\welcome\content\welcome_expired.html

c:\program files\WhiteSmokeTranslator\html\english\welcome\index.html

c:\program files\WhiteSmokeTranslator\html\english\welcome\js\welcomeInterface.js

c:\program files\WhiteSmokeTranslator\html\english\welcome\style\welcomescreen.css

c:\program files\WhiteSmokeTranslator\Microsoft.VC80.CRT.manifest

c:\program files\WhiteSmokeTranslator\msvcp80.dll

c:\program files\WhiteSmokeTranslator\msvcr80.dll

c:\program files\WhiteSmokeTranslator\settings.ini

c:\program files\WhiteSmokeTranslator\TCCons.dll

c:\program files\WhiteSmokeTranslator\TCCons_x64.dll

c:\program files\WhiteSmokeTranslator\tessdll.dll

c:\program files\WhiteSmokeTranslator\tessdll_x64.dll

c:\program files\WhiteSmokeTranslator\Uninst.exe

c:\program files\WhiteSmokeTranslator\WCapture.dll

c:\program files\WhiteSmokeTranslator\WCapture_x64.dll

c:\program files\WhiteSmokeTranslator\WCaptureMoz\chrome.manifest

c:\program files\WhiteSmokeTranslator\WCaptureMoz\chrome\content\wcapturex.js

c:\program files\WhiteSmokeTranslator\WCaptureMoz\chrome\content\wcapturex.xul

c:\program files\WhiteSmokeTranslator\WCaptureMoz\chrome\content\WcxTrace.js

c:\program files\WhiteSmokeTranslator\WCaptureMoz\components\WCaptureXpcom.dll

c:\program files\WhiteSmokeTranslator\WCaptureMoz\components\WcxComm.xpt

c:\program files\WhiteSmokeTranslator\WCaptureMoz\install.rdf

c:\program files\WhiteSmokeTranslator\WCaptureX.dll

c:\program files\WhiteSmokeTranslator\WCaptureX_x64.dll

c:\program files\WhiteSmokeTranslator\WCustom.dll

c:\program files\WhiteSmokeTranslator\WCustom_x64.dll

c:\program files\WhiteSmokeTranslator\wcxChrome.crx

c:\program files\WhiteSmokeTranslator\WHook.dll

c:\program files\WhiteSmokeTranslator\WHook_x64.dll

c:\program files\WhiteSmokeTranslator\WMonitorX.dll

c:\program files\WhiteSmokeTranslator\WMonitorX_x64.dll

c:\program files\WhiteSmokeTranslator\WSRegistrationDictMode.exe

c:\program files\WhiteSmokeTranslator\WSTrayDictMode.exe

c:\program files\WhiteSmokeTranslator\WSTrayDictMode.exe.manifest

.

.

((((((((((((((((((((((((( Files Created from 2011-10-16 to 2011-11-16 )))))))))))))))))))))))))))))))

.

.

2011-11-16 00:50 . 2011-11-16 01:17 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{7BD97C18-1EB5-48CF-99C0-2D4EECA45F9E}\offreg.dll

2011-11-16 00:03 . 2011-11-16 00:03 -------- d-----w- c:\windows\system32\Service

2011-11-16 00:01 . 2011-11-16 01:18 -------- d-----w- c:\users\hope\AppData\Local\temp

2011-11-16 00:01 . 2011-11-16 00:50 -------- d-----w- c:\users\Guest\AppData\Local\temp

2011-11-16 00:01 . 2011-11-16 00:01 -------- d-----w- c:\users\Treigh\AppData\Local\temp

2011-11-16 00:01 . 2011-11-16 00:01 -------- d-----w- c:\users\Owner\AppData\Local\temp

2011-11-16 00:01 . 2011-11-16 00:01 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-11-15 20:33 . 2011-10-07 03:48 6668624 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{7BD97C18-1EB5-48CF-99C0-2D4EECA45F9E}\mpengine.dll

2011-11-15 17:51 . 2011-11-15 17:51 -------- d-----w- c:\users\hope\AppData\Roaming\Malwarebytes

2011-11-07 20:48 . 2011-11-07 20:48 -------- d-----w- c:\users\Guest\AppData\Local\Apple Computer

2011-11-07 20:38 . 2011-11-07 20:38 -------- d-----w- c:\users\Guest\AppData\Roaming\Malwarebytes

2011-11-07 20:36 . 2011-11-07 20:36 -------- d-----w- c:\programdata\Malwarebytes

2011-11-07 20:35 . 2011-11-15 23:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-11-02 03:46 . 2011-11-02 03:46 -------- d-----w- c:\users\Guest\AppData\Local\Mozilla

2011-10-18 16:36 . 2011-09-06 13:30 2043392 ----a-w- c:\windows\system32\win32k.sys

2011-10-18 16:36 . 2011-07-29 16:01 293376 ----a-w- c:\windows\system32\psisdecd.dll

2011-10-18 16:36 . 2011-07-29 16:01 217088 ----a-w- c:\windows\system32\psisrndr.ax

2011-10-18 16:36 . 2011-07-29 16:00 57856 ----a-w- c:\windows\system32\MSDvbNP.ax

2011-10-18 16:36 . 2011-07-29 16:00 69632 ----a-w- c:\windows\system32\Mpeg2Data.ax

2011-10-18 16:36 . 2011-09-14 10:51 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat

2011-10-18 16:35 . 2011-08-25 16:15 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll

2011-10-18 16:35 . 2011-08-25 16:14 563712 ----a-w- c:\windows\system32\oleaut32.dll

2011-10-18 16:35 . 2011-08-25 16:14 238080 ----a-w- c:\windows\system32\oleacc.dll

2011-10-18 16:35 . 2011-08-25 13:31 4096 ----a-w- c:\windows\system32\oleaccrc.dll

2011-10-18 14:37 . 2011-10-18 14:37 -------- d-----w- c:\users\Guest\AppData\Roaming\Avanquest

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-11-07 21:24 . 2009-10-06 01:27 226280 ----a-w- c:\windows\system32\drivers\volsnap.sys

2011-11-02 03:42 . 2011-06-21 04:14 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-09-29 06:53 . 2011-10-10 19:52 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-17 1049896]

"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2008-09-24 468264]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]

"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-12-14 47904]

"UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2008-12-29 983168]

.

c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

.

c:\users\hope\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Launch WhiteSmokeTranslator.lnk - c:\program files\WhiteSmokeTranslator\WSTrayDictMode.exe [N/A]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 GSRestartSvc;GSRestartSvc;c:\programdata\Geek Squad\Customizer\GSRestartSvc.exe [x]

R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe [x]

R2 TmProxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [2008-12-29 677128]

R3 AQFileRestore;AQFileRestore;c:\windows\system32\DRIVERS\AQFileRestore.sys [x]

R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-04-03 193840]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

S2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\SMINST\BLService.exe [2008-10-06 365952]

S2 tmevtmgr;tmevtmgr;c:\windows\system32\DRIVERS\tmevtmgr.sys [2008-12-29 50192]

S2 tmpreflt;tmpreflt;c:\windows\system32\DRIVERS\tmpreflt.sys [2008-12-29 36368]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-05-09 43040]

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2008-06-09 17:14 451872 ---ha-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

.

Contents of the 'Scheduled Tasks' folder

.

2011-08-29 c:\windows\Tasks\HPCeeScheduleForOwner.job

- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2009-04-20 18:34]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3007394

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html

TCP: DhcpNameServer = 192.168.1.1 192.168.1.1

FF - ProfilePath - c:\users\hope\AppData\Roaming\Mozilla\Firefox\Profiles\6agpgsr1.default\

.

- - - - ORPHANS REMOVED - - - -

.

AddRemove-WhiteSmokeTranslator - c:\program files\WhiteSmokeTranslator\Uninst.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-11-15 20:20

Windows 6.0.6002 Service Pack 2 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Norton Internet Security]

"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\nvvsvc.exe

c:\windows\system32\nvvsvc.exe

c:\program files\Trend Micro\BM\TMBMSRV.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\program files\CyberLink\Shared files\RichVideo.exe

c:\program files\Trend Micro\Internet Security\SfCtlCom.exe

c:\windows\system32\DRIVERS\xaudio.exe

c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe

c:\program files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE

c:\program files\Hewlett-Packard\Shared\HpqToaster.exe

c:\windows\system32\wbem\unsecapp.exe

c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe

c:\program files\Synaptics\SynTP\SynTPHelper.exe

.

**************************************************************************

.

Completion time: 2011-11-15 20:25:00 - machine was rebooted

ComboFix-quarantined-files.txt 2011-11-16 01:24

ComboFix2.txt 2011-11-15 20:51

ComboFix3.txt 2011-11-07 21:57

ComboFix4.txt 2011-11-02 04:43

.

Pre-Run: 210,654,130,176 bytes free

Post-Run: 210,273,165,312 bytes free

.

- - End Of File - - 277E2BBFE2773D4A705BA67CBA36C56D

Link to post
Share on other sites

I went to http://www.virustotal.com/ and browsed for c:\windows\system32\DRIVERS\AQFileRestore.sys, but it was not listed.

I'm not having any problems with getting to any websites like before. I was able to update Java and remove the old version via add/remove programs as instructed.

To summarize, the WhiteSmoke Translator toolbar is still listed in add/remove programs and cannot be removed, and Trend Micro AV is still showing grayed out in the system tray, but not is not listed in add/remove programs.

Link to post
Share on other sites

We need to get a copy of it if it's still there.

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:

Click Start > Run type Notepad click OK.

This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

http://forums.malwarebytes.org/index.php?showtopic=99693

Collect::
c:\windows\system32\DRIVERS\AQFileRestore.sys

DDS::
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3007394
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;

2.Click Save As... Change the directory to your desktop;

3.Change the Save as type to "All Files";

4.Type in the file name: CFScript

5.Click Save ...

CFScriptB-4.gif

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

Link to post
Share on other sites

The ComboFix log is below. The laptop is still working ok so far, but those two issues listed above are still there.

ComboFix 11-11-15.01 - hope 11/16/2011 12:37:22.5.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2814.1709 [GMT -5:00]

Running from: c:\users\Guest\Desktop\ComboFix.exe

Command switches used :: c:\users\Guest\Desktop\CFScript.txt

AV: Trend Micro AntiVirus *Enabled/Updated* {48929DFC-7A52-A34F-8351-C4DBEDBD9C50}

SP: Trend Micro AntiVirus *Enabled/Updated* {F3F37C18-5C68-ACC1-B9E1-FFA9963AD6ED}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\system32\service

c:\windows\system32\service\15112011_TIS17_SfFniAU.log

.

.

((((((((((((((((((((((((( Files Created from 2011-10-16 to 2011-11-16 )))))))))))))))))))))))))))))))

.

.

2011-11-16 17:49 . 2011-11-16 18:08 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{7BD97C18-1EB5-48CF-99C0-2D4EECA45F9E}\offreg.dll

2011-11-16 17:47 . 2011-11-16 18:09 -------- d-----w- c:\users\hope\AppData\Local\temp

2011-11-16 17:47 . 2011-11-16 17:51 -------- d-----w- c:\users\Guest\AppData\Local\temp

2011-11-16 17:47 . 2011-11-16 17:47 -------- d-----w- c:\users\Treigh\AppData\Local\temp

2011-11-16 17:47 . 2011-11-16 17:47 -------- d-----w- c:\users\Owner\AppData\Local\temp

2011-11-16 17:47 . 2011-11-16 17:47 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-11-16 04:45 . 2011-11-16 04:45 -------- d-----w- c:\windows\Sun

2011-11-15 20:33 . 2011-10-07 03:48 6668624 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{7BD97C18-1EB5-48CF-99C0-2D4EECA45F9E}\mpengine.dll

2011-11-15 17:51 . 2011-11-15 17:51 -------- d-----w- c:\users\hope\AppData\Roaming\Malwarebytes

2011-11-15 17:40 . 2011-09-30 15:57 707584 ----a-w- c:\program files\Common Files\System\wab32.dll

2011-11-07 20:48 . 2011-11-07 20:48 -------- d-----w- c:\users\Guest\AppData\Local\Apple Computer

2011-11-07 20:38 . 2011-11-07 20:38 -------- d-----w- c:\users\Guest\AppData\Roaming\Malwarebytes

2011-11-07 20:36 . 2011-11-07 20:36 -------- d-----w- c:\programdata\Malwarebytes

2011-11-07 20:35 . 2011-11-15 23:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-11-02 03:46 . 2011-11-02 03:46 -------- d-----w- c:\users\Guest\AppData\Local\Mozilla

2011-10-18 16:36 . 2011-09-06 13:30 2043392 ----a-w- c:\windows\system32\win32k.sys

2011-10-18 16:36 . 2011-07-29 16:01 293376 ----a-w- c:\windows\system32\psisdecd.dll

2011-10-18 16:36 . 2011-07-29 16:01 217088 ----a-w- c:\windows\system32\psisrndr.ax

2011-10-18 16:36 . 2011-07-29 16:00 57856 ----a-w- c:\windows\system32\MSDvbNP.ax

2011-10-18 16:36 . 2011-07-29 16:00 69632 ----a-w- c:\windows\system32\Mpeg2Data.ax

2011-10-18 16:36 . 2011-09-14 10:51 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat

2011-10-18 16:35 . 2011-08-25 16:15 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll

2011-10-18 16:35 . 2011-08-25 16:14 563712 ----a-w- c:\windows\system32\oleaut32.dll

2011-10-18 16:35 . 2011-08-25 16:14 238080 ----a-w- c:\windows\system32\oleacc.dll

2011-10-18 16:35 . 2011-08-25 13:31 4096 ----a-w- c:\windows\system32\oleaccrc.dll

2011-10-18 14:37 . 2011-10-18 14:37 -------- d-----w- c:\users\Guest\AppData\Roaming\Avanquest

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-11-07 21:24 . 2009-10-06 01:27 226280 ----a-w- c:\windows\system32\drivers\volsnap.sys

2011-11-02 03:42 . 2011-06-21 04:14 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-10-03 10:06 . 2010-05-03 20:28 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-09-29 06:53 . 2011-10-10 19:52 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-17 1049896]

"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2008-09-24 468264]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]

"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-12-14 47904]

"UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2008-12-29 983168]

.

c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 GSRestartSvc;GSRestartSvc;c:\programdata\Geek Squad\Customizer\GSRestartSvc.exe [x]

R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe [x]

R2 TmProxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [2008-12-29 677128]

R3 AQFileRestore;AQFileRestore;c:\windows\system32\DRIVERS\AQFileRestore.sys [x]

R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-04-03 193840]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

S2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\SMINST\BLService.exe [2008-10-06 365952]

S2 tmevtmgr;tmevtmgr;c:\windows\system32\DRIVERS\tmevtmgr.sys [2008-12-29 50192]

S2 tmpreflt;tmpreflt;c:\windows\system32\DRIVERS\tmpreflt.sys [2008-12-29 36368]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-05-09 43040]

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2008-06-09 17:14 451872 ---ha-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

.

Contents of the 'Scheduled Tasks' folder

.

2011-08-29 c:\windows\Tasks\HPCeeScheduleForOwner.job

- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2009-04-20 18:34]

.

.

------- Supplementary Scan -------

.

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html

TCP: DhcpNameServer = 192.168.1.1 192.168.1.1

FF - ProfilePath - c:\users\hope\AppData\Roaming\Mozilla\Firefox\Profiles\6agpgsr1.default\

.

- - - - ORPHANS REMOVED - - - -

.

HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe

SafeBoot-Wdf01000.sys

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-11-16 13:09

Windows 6.0.6002 Service Pack 2 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Norton Internet Security]

"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\nvvsvc.exe

c:\windows\servicing\TrustedInstaller.exe

c:\windows\system32\nvvsvc.exe

c:\program files\Trend Micro\BM\TMBMSRV.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\program files\CyberLink\Shared files\RichVideo.exe

c:\program files\Trend Micro\Internet Security\SfCtlCom.exe

c:\windows\system32\DRIVERS\xaudio.exe

c:\windows\system32\wbem\unsecapp.exe

c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe

c:\program files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE

c:\program files\Hewlett-Packard\Shared\HpqToaster.exe

c:\program files\Synaptics\SynTP\SynTPHelper.exe

c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe

.

**************************************************************************

.

Completion time: 2011-11-16 13:15:06 - machine was rebooted

ComboFix-quarantined-files.txt 2011-11-16 18:15

ComboFix2.txt 2011-11-16 01:25

ComboFix3.txt 2011-11-15 20:51

ComboFix4.txt 2011-11-07 21:57

ComboFix5.txt 2011-11-16 17:35

.

Pre-Run: 208,403,009,536 bytes free

Post-Run: 208,669,290,496 bytes free

.

- - End Of File - - BB284FDEC459D7CC90F07AFD747AE704

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.