a spoof emailer

[efiste2]

something on my PC is sending out spoof emails from my address, and i keep getting failed delivery messages back, can anyone tell me how to get rid of this or a program that i could use.

cheers

[Gecko]

Please download , unzip it to it's own folder.
Start HijackThis and select 'Do a system scan and save a logfile'
Now post the contents of the logfile back into this thread

[efiste2]

really sorry if i have asked the same question of you again gecko, but heres another logfile. whatever has happened i dont know but my PC is flying emails out everywhere as im getting failed delivery reports and replies from all sorts of addresses. and am considering rebooting my whole PC and changing my emailaddress. which is a drastic measure for me so i would really appreciate any help
Logfile of HijackThis v1.99.1
Scan saved at 13:39:18, on 28/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\LTSMMSG.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\WINDOWS\system32\CTSvcCDA.EXE
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Cloudmark\SpamNet\OE\snoe.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Norton AntiVirus\OPScan.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Steven\Local Settings\Temp\wzfc6c\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.wanadoo.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Wanadoo
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [LTSMMSG] LTSMMSG.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C84 Series" /O5 "LPT1:" /M "Stylus C84"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MediaFace Integration] C:\Program Files\Fellowes\MediaFACE 5.0\SetHook.exe
O4 - Startup: Speedtouch Connection.lnk = C:\Program Files\Thomson\SpeedTouch USB\stdialup.exe
O4 - Global Startup: Cloudmark Desktop for Outlook Express.lnk = ?
O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk/
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b31267.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex ... 0-3-30.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab
O16 - DPF: {BF6BBE9A-0656-4598-A0CD-32DAC03959B5} (Image Uploader 3.0 Control) - http://www.prints2u.com/wpp/prints2u//a ... loader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{66C3AF69-AFEF-4942-9F95-C025D1BC3EA7}: NameServer = 195.92.195.95 195.92.195.94
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter: text/html - (no CLSID) - (no file)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

[Gecko]

There is still nothing bad in you log.

Let's see what's getting started on bootup and check for a rootkit.

Please put Hijack this in it's own folder like this C:\hjt\hijackthis.exe

Start HijackThis and click the Open the misc tools section now put a check next to "List also minor sections (full)"
Now click the "Generate startup list log" the log file will be saved as C:\hjt\startuplist.txt

Next download extract it to your desktop.
Now run Rootkit Revealer, this will take forever to finish so just let it run.

When it's finished copy and paste Rootkit Revealer's report into this thread along with the C:\hjt\startuplist.txt report from Hijackthis.

[efiste2]

ok mate, really appreciate you sticking with me on this.

heres the rootkit file
HKLM\S-1-5-21-3899606530-1168993628-2020065868-1005\RemoteAccess\InternetProfile 25/11/2005 19:29 21 bytes Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed 28/10/2006 19:57 80 bytes Data mismatch between Windows API and raw hive data.
C:\Documents and Settings\Steven\Application Data\Microsoft\MSN Messenger\584994300\sqmdata15.sqm 28/10/2006 20:07 1.30 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Application Data\Microsoft\MSN Messenger\584994300\sqmnoopt15.sqm 28/10/2006 20:07 548 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Cookies\steven@forum[1].txt 28/10/2006 20:00 225 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Cookies\steven@forum[2].txt 28/10/2006 20:02 224 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\helppane___10210002F[2].js 17/10/2006 22:57 3.75 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\privmsg[1].htm 17/10/2006 13:05 55.83 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\menuitem_uk_em_1[1].xml 15/10/2006 18:46 402 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\menuitem_uk_em_2[1].xml 15/10/2006 18:46 402 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\menuitem_uk_em_3[1].xml 15/10/2006 18:46 402 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\menuitem_uk_em_4[1].xml 15/10/2006 18:46 402 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\menuitem_uk_em_5[1].xml 15/10/2006 18:46 402 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\menuitem_uk_mb_1[1].xml 15/10/2006 18:46 413 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\menuitem_uk_mb_2[1].xml 15/10/2006 18:46 402 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\menuitem_uk_mb_3[1].xml 15/10/2006 18:46 403 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\menuitem_uk_mb_4[1].xml 15/10/2006 18:46 399 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\menuitem_uk_pe_1[1].xml 15/10/2006 18:46 404 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\menuitem_uk_pe_2[1].xml 15/10/2006 18:46 398 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\menuitem_uk_pe_3[1].xml 15/10/2006 18:46 445 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\menuitem_uk_pe_4[1].xml 15/10/2006 18:46 431 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\menuitem_uk_wk_1[1].xml 15/10/2006 18:46 400 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\menuitem_uk_wk_2[1].xml 15/10/2006 18:46 404 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\menuitem_uk_wk_3[1].xml 15/10/2006 18:46 401 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\menuitem_uk_wk_4[1].xml 15/10/2006 18:46 405 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\MsgrConfig[1].xml 17/10/2006 22:57 25.29 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\schematizedstore[1].xml 17/10/2006 22:57 646 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\77RBPMK8\0000050178_000000000000000358042[1].gif 28/10/2006 20:02 258 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\77RBPMK8\CA5U9Y0P.htm 28/10/2006 20:01 4.32 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\77RBPMK8\HoTMaiL[1] 28/10/2006 20:03 13.93 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\77RBPMK8\HoTMaiL[1].htm 28/10/2006 20:03 76.56 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\77RBPMK8\hotmail___1000000003[2].css 28/10/2006 20:02 3.31 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\77RBPMK8\menuitem_uk_em_2[1].xml 28/10/2006 20:03 423 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\77RBPMK8\menuitem_uk_em_3[1].xml 28/10/2006 20:03 423 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\77RBPMK8\menuitem_uk_em_4[1].xml 28/10/2006 20:03 423 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\77RBPMK8\mo_logo[1].png 28/10/2006 20:02 723 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\77RBPMK8\MsgrConfig[1].xml 28/10/2006 20:02 28.14 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\77RBPMK8\privmsg[1].htm 28/10/2006 20:02 55.83 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\77RBPMK8\SK3310aff_sizes_234x60[1].swf 28/10/2006 20:02 16.43 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\0000008239_000000000000000236241[1].gif 28/10/2006 20:02 1.13 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\160_X_600_20K_[1].gif 28/10/2006 20:02 20.29 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\160x600_Lipo_Male_T_red_V1_1_MSN[1].swf 28/10/2006 20:03 12.49 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\3098657m[1].png 28/10/2006 20:03 4.47 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\3111608m[1].png 28/10/2006 20:03 3.69 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\809044866[1].htm 28/10/2006 20:03 4.91 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\ADSAdClient31[1].htm 28/10/2006 20:03 1.45 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\ADSAdClient31[2].htm 28/10/2006 20:03 1.44 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\ADSAdClient31[3].htm 28/10/2006 20:03 605 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\B2038150[1].4;sz=234x60;ord=858341746 28/10/2006 20:02 1.37 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\CACTMP5E.swf 28/10/2006 20:03 25.44 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\CAEPYLA7.htm 28/10/2006 20:00 4.36 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\heart_msnuk[1].png 28/10/2006 20:02 1.50 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\HoTMaiL[1].htm 28/10/2006 20:02 75.93 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\menuitem_uk_mb_1[1].xml 28/10/2006 20:08 417 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\menuitem_uk_mb_2[1].xml 28/10/2006 20:08 417 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\menuitem_uk_mb_3[1].xml 28/10/2006 20:08 416 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\menuitem_uk_mb_4[1].xml 28/10/2006 20:08 432 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\menuitem_uk_pe_1[1].xml 28/10/2006 20:08 466 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\menuitem_uk_pe_2[1].xml 28/10/2006 20:08 452 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\menuitem_uk_pe_3[1].xml 28/10/2006 20:08 430 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\menuitem_uk_pe_4[1].xml 28/10/2006 20:08 430 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\menuitem_uk_wk_1[1].xml 28/10/2006 20:08 422 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\menuitem_uk_wk_2[1].xml 28/10/2006 20:08 422 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\menuitem_uk_wk_3[1].xml 28/10/2006 20:08 418 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\8J7M1GI2\menuitem_uk_wk_4[1].xml 28/10/2006 20:08 422 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\KP2VCXI7\hotmail___1025000104[2].js 17/10/2006 22:57 33.53 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\O9EVGPIB\privmsg[1].htm 17/10/2006 13:05 19.39 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\O9EVGPIB\tabiconUK[1].png 15/10/2006 18:46 2.78 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\OZ6B2BQ1\hotmail___1000000003[2].css 17/10/2006 22:57 3.31 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\QP6VTBO2\3103457m[1].png 28/10/2006 20:03 2.54 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\QP6VTBO2\3114969m[1].png 28/10/2006 20:03 34.99 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\QP6VTBO2\ADSAdClient31[1].htm 28/10/2006 20:03 1.45 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\QP6VTBO2\ADSAdClient31[2].htm 28/10/2006 20:03 1.46 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\QP6VTBO2\B2039563[2].4;sz=728x90;ord=439960275 28/10/2006 20:03 3.93 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\QP6VTBO2\B2062607[2].4;sz=728x90;ord=1762740808 28/10/2006 20:02 3.85 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\QP6VTBO2\CAMESYFI.htm 28/10/2006 20:01 4.20 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\QP6VTBO2\helppane___10210002F[2].js 28/10/2006 20:02 3.75 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\QP6VTBO2\menuitem_uk_em_5[1].xml 28/10/2006 20:03 423 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\QP6VTBO2\MSN_safety_blue_tab[1].png 28/10/2006 20:02 1.32 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\QP6VTBO2\privmsg[1].htm 28/10/2006 20:00 55.84 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\QP6VTBO2\privmsg[1].php 28/10/2006 20:02 5.97 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\QP6VTBO2\privmsg[2].htm 28/10/2006 20:02 19.83 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\QP6VTBO2\tabiconUK[1].png 28/10/2006 20:02 32.75 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\S1MZWXM3\mo_logo[2].png 17/10/2006 22:57 1.51 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\S1MZWXM3\MSN_safety_blue_tab[1].png 17/10/2006 22:57 1.52 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\TOXVNING\3114588m[1].png 28/10/2006 20:03 1.78 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\TOXVNING\B2038150[1].htm 28/10/2006 20:02 3.81 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\TOXVNING\Bankaccount_23460_12k[1].swf 28/10/2006 20:08 13.57 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\TOXVNING\CA2DBHUY.htm 28/10/2006 20:02 4.11 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\TOXVNING\CAMJOHUR.bin 28/10/2006 20:03 21.33 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\TOXVNING\CAS5YJCL.bin 28/10/2006 20:03 3.00 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\TOXVNING\CAWL6R4L.swf 28/10/2006 20:02 7.20 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\TOXVNING\CAWY1L34.htm 28/10/2006 20:02 4.22 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\TOXVNING\hotmail___1025000104[2].js 28/10/2006 20:02 33.53 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\TOXVNING\icon_messenger0[1].gif 28/10/2006 20:02 381 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\TOXVNING\menuitem_uk_em_1[1].xml 28/10/2006 20:03 423 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\TOXVNING\schematizedstore[1].xml 28/10/2006 20:02 646 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\TOXVNING\schematizedstore[2].xml 28/10/2006 20:08 646 bytes Hidden from Windows API.
C:\WINDOWS\Prefetch\MSNMSGR.EXE-366A1A81.pf 28/10/2006 20:02 47.12 KB Hidden from Windows API.


and here is the startup list. i hope o have got the right data for you

StartupList report, 28/10/2006, 19:40:02
StartupList version: 1.52.2
Started from : C:\hjt\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
* Showing rarely important sections
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\LTSMMSG.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\WINDOWS\system32\CTSvcCDA.EXE
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Cloudmark\SpamNet\OE\snoe.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\hjt\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\Steven\Start Menu\Programs\Startup]
Speedtouch Connection.lnk = C:\Program Files\Thomson\SpeedTouch USB\stdialup.exe

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Cloudmark Desktop for Outlook Express.lnk = ?

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

LTSMMSG = LTSMMSG.exe
NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
nwiz = nwiz.exe /installquiet
ezShieldProtector for Px = C:\WINDOWS\System32\ezSP_Px.exe
SpeedTouch USB Diagnostics = "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
EPSON Stylus C84 Series = C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C84 Series" /O5 "LPT1:" /M "Stylus C84"
ccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
iTunesHelper = "C:\Program Files\iTunes\iTunesHelper.exe"
BluetoothAuthenticationAgent = rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
MediaFace Integration = C:\Program Files\Fellowes\MediaFACE 5.0\SetHook.exe

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = %SystemRoot%\system32\ie4uinit.exe

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
StubPath = C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
NAV Helper - C:\Program Files\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}

--------------------------------------------------

Enumerating Task Scheduler jobs:

MP Scheduled Scan.job
Norton AntiVirus - Scan my computer - Steven.job

--------------------------------------------------

Enumerating Download Program Files:

[Checkers Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\msgrchkr.dll
CODEBASE = http://messenger.zone.msn.com/binary/ms ... b31267.cab

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\system32\Macromed\Director\SwDir.dll
CODEBASE = http://fpdownload.macromedia.com/get/sh ... tor/sw.cab

[EPUImageControl Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\EPUWALcontrol.dll
CODEBASE = http://tools.ebayimg.com/eps/wl/activex ... 0-3-30.cab

[MessengerStatsClient Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\messengerstatsclient.dll
CODEBASE = http://messenger.zone.msn.com/binary/Me ... b31267.cab

[MsnMessengerSetupDownloadControl Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MsnMessengerSetupDownloader.ocx
CODEBASE = http://messenger.msn.com/download/MsnMe ... loader.cab

[Image Uploader 3.0 Control]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\ImageUploader3.ocx
CODEBASE = http://www.prints2u.com/wpp/prints2u//a ... loader.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx
CODEBASE = http://fpdownload.macromedia.com/get/fl ... wflash.cab

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #4: C:\WINDOWS\system32\wshbth.dll

--------------------------------------------------

Enumerating Windows NT/2000/XP services

Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Automatic LiveUpdate Scheduler: "C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" (autostart)
Computer Browser: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Bluetooth Support Service: %SystemRoot%\system32\svchost.exe -k bthsvcs (autostart)
Symantec Event Manager: "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe" (autostart)
Symantec Settings Manager: "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe" (autostart)
Creative Service for CDROM Access: C:\WINDOWS\system32\CTSvcCDA.EXE (autostart)
Cryptographic Services: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
DCOM Server Process Launcher: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)
DHCP Client: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
DNS Client: %SystemRoot%\System32\svchost.exe -k NetworkService (autostart)
Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Event Log: %SystemRoot%\system32\services.exe (autostart)
Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Server: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Workstation: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
TCP/IP NetBIOS Helper: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
MicroGuard Copy Protection: \??\C:\WINDOWS\system32\drivers\mgnt.sys (autostart)
Norton AntiVirus Auto-Protect Service: "C:\Program Files\Norton AntiVirus\navapsvc.exe" (autostart)
Norton AntiVirus Firewall Monitor Service: "C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe" (autostart)
NVIDIA Driver Helper Service: %SystemRoot%\System32\nvsvc32.exe (autostart)
PfModNT: \??\C:\WINDOWS\system32\drivers\PfModNT.sys (autostart)
Plug and Play: %SystemRoot%\system32\services.exe (autostart)
IPSEC Services: %SystemRoot%\System32\lsass.exe (autostart)
Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)
Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)
Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
ScriptBlocking Service: C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe (autostart)
Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Secdrv: System32\DRIVERS\secdrv.sys (autostart)
Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Symantec Network Drivers Service: "C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe" (autostart)
Symantec SPBBCSvc: "C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe" (autostart)
Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
System Restore Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Windows Image Acquisition (WIA): %SystemRoot%\System32\svchost.exe -k imgsvc (autostart)
SVKP: \??\C:\WINDOWS\system32\SVKP.sys (autostart)
Symantec Core LC: C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (autostart)
symlcbrd: \??\C:\WINDOWS\System32\drivers\symlcbrd.sys (autostart)
Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Windows User Mode Driver Framework: C:\WINDOWS\System32\wdfmgr.exe (autostart)
Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
WebClient: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
Windows Defender Service: "C:\Program Files\Windows Defender\MsMpEng.exe" (autostart)
Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
WMDM PMSP Service: C:\WINDOWS\system32\MsPMSPSv.exe (autostart)
Security Center: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)


--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

--------------------------------------------------
End of report, 13,261 bytes
Report generated in 0.125 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

[Gecko]

You have a number of active-X files that are hidden from windows.

Please download extract it to your desktop but do not run it yet.

Please copy the below to Notepad and save it to your desktop so you can refer to it in safe mode.

Reboot in to Safe mode:
Restart Windows after you see the BIOS screen and before Windows starts to load.
Start tapping the F8 key. The Windows Advanced Options Menu appears.
Use the Arrow key to ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' is enabled. Also make sure that Display the contents of System Folders' is checked. Remember to reset these when done.

Next click Start > Run and paste the below into the text box and press enter:
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5

A window will pop up, delete all the folders and all files in this window except desktop.ini & index.dat

Click Start > Run and paste the below into the text box and press enter:
C:\Documents and Settings\Steven\Local Settings\Temp
A window will pop up, delete all the folders and all files in this window.

If there are any files that you cannot delete start KillBox, and browse to the file you want to delete by clicking on the folder icon.
Put a check next to 'Delete on reboot' click on the red X, click yes to delete file on reboot
Click no to reboot now. Now do the same for each of the files/folders you want to delete
on the last one click yes to reboot now.

After the reboot run Rootkit Revealer again and post the new report back into this thread.

[efiste2]

did exaclty as you said mate...............there were no files that i couldnt delete normally so i didnt need killbox.

heres the last rootkit results

HKLM\S-1-5-21-3899606530-1168993628-2020065868-1005\RemoteAccess\InternetProfile 25/11/2005 18:29 21 bytes Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed 29/10/2006 12:46 80 bytes Data mismatch between Windows API and raw hive data.
C:\Documents and Settings\Steven\Cookies\steven@ads.pwcr[1].txt 29/10/2006 12:24 468 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Cookies\steven@ads.pwcr[2].txt 29/10/2006 12:59 556 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Cookies\steven@bs.serving-sys[1].txt 28/10/2006 17:52 121 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Cookies\steven@bs.serving-sys[2].txt 29/10/2006 12:57 121 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Cookies\steven@mb[2].txt 29/10/2006 13:01 85 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Cookies\steven@myspace[1].txt 29/10/2006 13:01 137 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Cookies\steven@rsownersclub.co[1].txt 29/10/2006 12:57 181 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Cookies\steven@rsownersclub.co[2].txt 29/10/2006 12:18 183 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Cookies\steven@serving-sys[1].txt 29/10/2006 12:23 464 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Cookies\steven@serving-sys[2].txt 29/10/2006 12:59 463 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Cookies\steven@statcounter[1].txt 17/10/2006 19:14 95 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Cookies\steven@statcounter[2].txt 29/10/2006 12:55 189 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Cookies\steven@www.cglfc[1].txt 29/10/2006 12:55 170 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Cookies\steven@www.cglfc[2].txt 28/10/2006 17:51 171 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Cookies\steven@www.makinggirlsrun[1].txt 29/10/2006 13:01 114 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Cookies\steven@www.xrstyle.co[1].txt 29/10/2006 12:18 211 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Steven\Cookies\steven@www.xrstyle.co[2].txt 29/10/2006 12:55 210 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z 29/10/2006 13:01 0 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\0mdsb2JgbA9ECgUAGwEfWSlVL2ljb24vMC84MDAwIAABAAAAAP075ps=[1].jpg 29/10/2006 13:01 2.39 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\100033713_ac0fd46475_s[1].jpg 29/10/2006 13:01 5.15 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\100033763_d8f449d404_s[1].jpg 29/10/2006 13:01 5.40 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\319103_FCD237DC-1A0D-4E19-B876-424EF36142D6[1].js 29/10/2006 12:58 8.88 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\andyxrt_siggy[1].jpg 29/10/2006 12:52 24.08 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\apt[1].gif 29/10/2006 13:01 110.58 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\B00005B4BI.01._AA50_[1].jpg 29/10/2006 12:59 1.62 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\beasteyes[1].jpg 29/10/2006 12:52 3.39 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\button_lead_foot_ro[1].gif 29/10/2006 12:52 1.46 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\button_show_n_shine[1].gif 29/10/2006 12:52 1.41 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\button_shuck_jive_ro[1].gif 29/10/2006 12:52 1.31 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\CA4F9NXL.htm 29/10/2006 13:00 10.06 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\CA8JOTC5.htm 29/10/2006 12:59 2.18 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\CACDU7GH.swf 29/10/2006 12:57 41.44 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\CAK1K7WR.swf 29/10/2006 12:58 33.56 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\calvin[1].jpg 29/10/2006 12:53 16.00 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\CASLQBSL.htm 29/10/2006 13:01 3.47 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\cellpic3[1].gif 29/10/2006 12:50 257 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\Copyofoxfordreflection[1].jpg 29/10/2006 12:54 11.95 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\D2B6FDB8-B4B6-4C70-A21A-A7486A4F8EB5[1].swf 29/10/2006 12:57 28.02 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\desktop.ini 29/10/2006 12:49 67 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\dooralign002[1].jpg 29/10/2006 12:53 15.17 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\dot[1].gif 29/10/2006 12:57 43 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\dukes_l_button_ro[1].gif 29/10/2006 12:52 1.19 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\dukes_mb_button[1].gif 29/10/2006 12:52 1.50 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\ebBannerServing_168390[1].js 29/10/2006 12:57 18.46 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\ebBannerServing_168390[2].js 29/10/2006 12:58 18.46 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\flashwrite_1_2[1].js 29/10/2006 12:57 801 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\folder_announce[1].gif 29/10/2006 12:52 307 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\folder_big[1].gif 29/10/2006 12:59 677 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\folder_hot[1].gif 29/10/2006 12:50 1.15 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\folder_lock[1].gif 29/10/2006 12:50 333 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\folder_lock[2].gif 29/10/2006 12:52 333 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\folder_new[1].gif 29/10/2006 12:59 336 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\folder_sticky[1].gif 29/10/2006 12:52 344 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\fordrs[1].jpg 29/10/2006 12:56 14.59 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\forumdisplay[1].htm 29/10/2006 12:56 78.83 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\gamercardForumsImagesheet[1].gif 29/10/2006 13:01 5.09 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\gc_repstars_external_20[1].gif 29/10/2006 13:01 345 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\graphics1[1].jpg 29/10/2006 12:53 16.60 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\guitarist[1].gif 29/10/2006 13:00 1.25 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\hb[1].gif 29/10/2006 13:00 1.00 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\IanUnderhoodTiny[1].jpg 29/10/2006 12:53 3.57 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\icon12[1].gif 29/10/2006 12:56 227 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\icon4[1].gif 29/10/2006 12:57 1019 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\icon5[1].gif 29/10/2006 12:56 219 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\icon7[1].gif 29/10/2006 12:57 1.03 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\icon9[1].gif 29/10/2006 12:56 222 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\icon_aim[1].gif 29/10/2006 13:00 753 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\icon_latest_reply[1].gif 29/10/2006 12:50 135 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\icon_lol[1].gif 29/10/2006 12:52 336 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\icon_mini_groups[1].gif 29/10/2006 12:50 222 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\icon_mini_groups[2].gif 29/10/2006 12:52 222 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\icon_mini_login[1].gif 29/10/2006 12:52 233 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\icon_mini_no_message[1].gif 29/10/2006 12:59 232 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\icon_mini_search[1].gif 29/10/2006 12:50 237 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\icon_mini_search[2].gif 29/10/2006 12:52 237 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\icon_minipost[1].gif 29/10/2006 12:50 122 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\icon_profile[1].gif 29/10/2006 12:50 801 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\icon_wink[1].gif 29/10/2006 12:50 170 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\icon_wink[2].gif 29/10/2006 12:54 170 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\icon_wink[3].gif 29/10/2006 12:59 170 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\icon_www[1].gif 29/10/2006 12:50 733 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\icon_yim[1].gif 29/10/2006 12:54 799 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\invisible[1].gif 29/10/2006 12:57 43 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\k2_36[1].png 29/10/2006 12:55 41.54 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\layout[1].css 29/10/2006 12:55 4.95 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\logo[1].gif 29/10/2006 12:49 8.50 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\logo_bs_100x50[1].gif 29/10/2006 12:57 1.27 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\logor[1].gif 29/10/2006 12:55 4.98 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\melua[1].jpg 29/10/2006 12:57 14.11 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\menu_open[1].gif 29/10/2006 12:56 279 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\menu_open[2].gif 29/10/2006 12:57 279 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\mode_threaded[1].gif 29/10/2006 12:56 562 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\mopartits[1].gif 29/10/2006 12:54 30.26 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\multipage[1].gif 29/10/2006 12:56 567 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\multipage[2].gif 29/10/2006 12:57 247 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\myres[1].jpg 29/10/2006 12:57 6.23 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\navbits_finallink[1].gif 29/10/2006 12:57 308 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\newhouse074resize6hu[1].jpg 29/10/2006 12:54 21.21 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\olddoor20[1].jpg 29/10/2006 12:53 52.82 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\post_old[1].gif 29/10/2006 12:56 522 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\printer[1].gif 29/10/2006 12:56 1.05 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\REDIRURL=;ord=47171[2] 29/10/2006 12:59 4.21 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\reputation_pos[1].gif 29/10/2006 12:56 501 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\rolleyes[1].gif 29/10/2006 12:57 1.03 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\rsgrin[1].gif 29/10/2006 12:56 152 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\rsocbannerad001[1][1].jpg 29/10/2006 12:56 85.25 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\show_ads[2].js 29/10/2006 12:57 6.88 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\showthread[1].htm 29/10/2006 12:57 36.03 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\showthread[2].htm 29/10/2006 12:58 65.11 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\smiliesri6[1].gif 29/10/2006 13:00 27.65 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\sortasc[1].gif 29/10/2006 12:56 561 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\Spots003[1].jpg 29/10/2006 12:51 18.12 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\tatusync1avatar[1].jpg 29/10/2006 12:52 15.07 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\thread_lock[1].gif 29/10/2006 12:57 240 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\update[1].js 29/10/2006 12:55 813 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\urchin[2].js 29/10/2006 12:57 18.14 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\vbulletin_menu[1].js 29/10/2006 12:57 15.78 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\viewtopic[1].htm 29/10/2006 12:54 43.66 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\0BGZQP8Z\XRDSIG3A[1].jpg 29/10/2006 12:52 42.99 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\01_new_1[1].jpg 29/10/2006 12:52 29.50 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\108130936_502121f8c6_s[1].jpg 29/10/2006 13:01 3.66 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\1292515463449ff9eef3e24[1].gif 29/10/2006 13:01 2.51 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\1433132681451107224c7d2[1].jpg 29/10/2006 13:00 2.15 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\1498204706444b5e6b5d80a[1].jpg 29/10/2006 12:50 1.75 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\152442873_3b5f0ba0ac_s[1].jpg 29/10/2006 13:01 2.72 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\1557471806444aa9aee05b3[1].gif 29/10/2006 12:52 1.60 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\2005A-vi[1].jpg 29/10/2006 12:54 21.00 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\585531_383[1].jpg 29/10/2006 12:53 39.20 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\63698181_e2ca6b21ca_m[1].jpg 29/10/2006 12:54 20.93 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\ATEAMSIG[1].jpg 29/10/2006 13:00 19.04 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\avapoo[1].jpg 29/10/2006 12:56 2.56 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\B000BTIU52.01._AA50_[1].jpg 29/10/2006 12:57 1.70 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\B000H5TIA6.01._AA50_[1].jpg 29/10/2006 12:58 1.82 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\bigbad[1].jpg 29/10/2006 13:01 24.25 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\bigcry[1].gif 29/10/2006 12:59 1.92 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\breakthru[1].gif 29/10/2006 12:57 3.84 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\button_club_generals_ro[1].gif 29/10/2006 12:52 1.45 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\button_hazzard_garage[1].gif 29/10/2006 12:52 1.46 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\button_hazzard_garage_ro[1].gif 29/10/2006 12:52 1.46 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\button_models_ro[1].gif 29/10/2006 12:52 1.32 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\button_shuck_jive[1].gif 29/10/2006 12:52 1.31 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\CA6VCDUZ.swf 29/10/2006 12:58 28.31 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\CAYN45QN.htm 29/10/2006 12:58 8.09 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\CAZIKF3D.swf 29/10/2006 12:57 29.75 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\cellpic1[1].gif 29/10/2006 12:52 246 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\cellpic3[1].gif 29/10/2006 12:57 250 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\charger051resizeta2[1].jpg 29/10/2006 12:54 14.33 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\cheers[1].gif 29/10/2006 12:56 202 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\civil1old-vi[1].jpg 29/10/2006 12:54 10.72 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\collapse_thead[1].gif 29/10/2006 12:56 580 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\coyote[1].jpg 29/10/2006 12:52 31.31 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\crossdomain[1].xml 29/10/2006 13:01 205 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\devil-child2[1].jpg 29/10/2006 12:57 11.37 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\dscf0075resizeai2[1].jpg 29/10/2006 12:54 17.15 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\dukes_e_button[1].gif 29/10/2006 12:52 1.26 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\fastford[1].gif 29/10/2006 13:02 37.64 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\feed[1].png 29/10/2006 13:01 764 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\folder_big[1].gif 29/10/2006 12:50 677 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\folder_lock_new[1].gif 29/10/2006 12:50 459 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\folder_lock_new[2].gif 29/10/2006 12:52 459 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\folder_locked_big[1].gif 29/10/2006 12:50 673 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\folder_new_hot[1].gif 29/10/2006 12:50 1.13 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\folder_sticky[1].gif 29/10/2006 12:50 344 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\fpi[1].js 29/10/2006 13:01 2.09 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\goldmember[1].gif 29/10/2006 13:00 1020 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\hihi[1].gif 29/10/2006 12:56 251 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\icon1[1].gif 29/10/2006 12:57 307 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\icon7[1].gif 29/10/2006 12:56 236 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\icon_aim[1].gif 29/10/2006 12:54 753 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\icon_confused[1].gif 29/10/2006 12:54 171 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\icon_email[1].gif 29/10/2006 12:53 820 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\icon_latest_reply[1].gif 29/10/2006 12:52 135 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\icon_latest_reply[2].gif 29/10/2006 12:59 135 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\icon_mini_faq[1].gif 29/10/2006 12:50 219 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\icon_mini_faq[2].gif 29/10/2006 12:52 219 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\icon_mini_faq[3].gif 29/10/2006 12:59 219 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\icon_mini_profile[1].gif 29/10/2006 12:52 236 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\icon_mini_profile[2].gif 29/10/2006 12:59 236 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\icon_minipost[1].gif 29/10/2006 12:52 122 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\icon_newest_reply[1].gif 29/10/2006 12:59 133 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\icon_question[1].gif 29/10/2006 12:53 248 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\icon_razz[1].gif 29/10/2006 12:57 176 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\icon_rolleyes[1].gif 29/10/2006 12:57 485 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\icon_smile[1].gif 29/10/2006 12:53 174 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\im_msn[1].gif 29/10/2006 12:56 1.01 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\jrstl0[1].png 29/10/2006 12:56 113.26 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\JS[1].htm 29/10/2006 12:57 1.02 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\JS[2].htm 29/10/2006 12:59 301 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\logo_phpBB[1].gif 29/10/2006 12:50 12.10 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\logors[1].jpg 29/10/2006 12:56 33.22 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\lovesilxq6[1].png 29/10/2006 12:54 4.96 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\Magners[1].jpg 29/10/2006 12:56 3.27 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\mode_hybrid[1].gif 29/10/2006 12:56 588 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\navbits_start[1].gif 29/10/2006 12:56 1004 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\navbits_start[2].gif 29/10/2006 12:57 217 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\p[1].swf 29/10/2006 13:01 20.26 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\paperclip[1].gif 29/10/2006 12:57 305 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\pf2[1].swf 29/10/2006 13:00 10.31 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\photo booth (80x80)[1].gif 29/10/2006 12:59 18.32 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\Position_62_0[1].js 29/10/2006 12:57 12.59 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\post_new[1].gif 29/10/2006 12:57 314 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\printer[1].gif 29/10/2006 12:57 1.05 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\privacy[1].gif 29/10/2006 12:57 156 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\quote[1].gif 29/10/2006 12:57 2.06 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\REDIRURL=;ord=19017[1] 29/10/2006 12:57 11 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\REDIRURL=;ord=60868[2] 29/10/2006 12:58 516 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\reply[1].gif 29/10/2006 12:53 1.65 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\SassyRsSiggy500x150[1].jpg 29/10/2006 13:00 18.67 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\scale_img[1].jpg 29/10/2006 12:58 2.05 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\showthread[1].htm 29/10/2006 12:57 70.13 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\sideshot[1].jpg 29/10/2006 12:54 13.33 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\spacer[1].gif 29/10/2006 12:50 43 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\sticky[1].gif 29/10/2006 12:56 521 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\sticky[2].gif 29/10/2006 12:57 212 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\tardbish3ci[1].jpg 29/10/2006 13:00 22.03 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\thread[1].gif 29/10/2006 12:56 1.10 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\thread_hot[1].gif 29/10/2006 12:56 1.08 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\thread_hot[2].gif 29/10/2006 12:57 166 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\thread_lock[1].gif 29/10/2006 12:56 1.13 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\vbulletin_global[1].js 29/10/2006 12:56 17.92 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\vbulletin_global[2].js 29/10/2006 12:57 36.41 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\viewforum[1].htm 29/10/2006 12:51 73.96 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\viewforum[2].htm 29/10/2006 12:55 76.31 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\viewforum[3].htm 29/10/2006 13:02 137.23 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\viewtopic[1].htm 29/10/2006 12:53 46.55 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\viewtopic[2].htm 29/10/2006 12:55 31.08 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\25AP4LSZ\whosonline[1].gif 29/10/2006 12:50 929 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561 29/10/2006 13:00 0 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\100033280_03267030f7_s[1].jpg 29/10/2006 13:02 5.23 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\100033618_709143eee4_s[1].jpg 29/10/2006 13:01 4.35 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\150420379744d3b66399aae[1].gif 29/10/2006 13:00 589 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\210923221644d75ce34160f[1].jpg 29/10/2006 13:00 4.31 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\8147829304516e2c003bc7[1].gif 29/10/2006 13:00 4.26 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\angel[1].gif 29/10/2006 13:00 929 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\anna-kournikova_13[1].jpg 29/10/2006 13:00 94.88 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\CACR63EC.jpg 29/10/2006 13:01 19.38 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\CAFMTKHZ.swf 29/10/2006 12:59 7.02 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\desktop.ini 29/10/2006 12:59 67 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\dj[1].gif 29/10/2006 13:00 5.13 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\drummer[1].gif 29/10/2006 13:00 2.44 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\ExternalGamerCardSkin[1].css 29/10/2006 13:01 1.92 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\folder_lock_new[1].gif 29/10/2006 12:59 459 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\folder_new_big[1].gif 29/10/2006 12:59 249 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\icon_mini_groups[1].gif 29/10/2006 12:59 222 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\icon_smokin[1].gif 29/10/2006 13:00 877 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\kitkat_final[1].jpg 29/10/2006 13:01 35.68 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\performanceford[1].gif 29/10/2006 12:59 45.08 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\post[1].gif 29/10/2006 12:59 1.59 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\Robbiedsigniture44[1].jpg 29/10/2006 13:00 21.89 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\temptrs[1].jpg 29/10/2006 13:00 24.72 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\text_group[1].htm 29/10/2006 13:01 3.93 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\webtrends[1].js 29/10/2006 13:01 14.49 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\434ZG561\xmlrpc[1].xml 29/10/2006 13:01 3.46 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF 29/10/2006 13:00 0 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\100033415_80d1b0a8b3_s[1].jpg 29/10/2006 13:02 5.57 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\152442874_a0457f12a6_s[1].jpg 29/10/2006 13:01 3.46 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\20812555154524661629f1a[1].jpg 29/10/2006 13:00 4.87 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\210817648744e5a4348f56c[1].jpg 29/10/2006 13:00 2.92 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\2141546461452c1ac69cab4[1].png 29/10/2006 13:00 2.59 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\boycott[1].jpg 29/10/2006 13:01 5.93 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\CAODQJKX.htm 29/10/2006 13:00 3.49 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\desktop.ini 29/10/2006 13:00 67 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\drupal[1].css 29/10/2006 13:01 11.30 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\hambomang[1].htm 29/10/2006 13:01 3.78 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\icon_email[1].gif 29/10/2006 13:00 820 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\icon_icq_add[1].gif 29/10/2006 13:00 724 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\jonnycopy[1].jpg 29/10/2006 13:00 24.47 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\logo[1].png 29/10/2006 13:01 1.73 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\menu-leaf[1].png 29/10/2006 13:01 194 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\Sig[1].jpg 29/10/2006 13:00 25.11 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\Sig[2].jpg 29/10/2006 13:00 23.75 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\signature2CustomCustom[1].jpg 29/10/2006 13:00 7.29 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\smallcos[1].jpg 29/10/2006 13:00 15.25 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\4H6BK9YF\wall[1].gif 29/10/2006 13:00 904 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\0767812123.01._AA50_[1].jpg 29/10/2006 12:59 1.51 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\0mdsb2JgbA9ECgUMGgEfWStSL2ljb24vMC84MDAwIAABAAAAAP0vqB0=[1].jpg 29/10/2006 13:01 2.19 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\100033351_c89c9be32c_s[1].jpg 29/10/2006 13:02 5.65 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\100_0987[1].jpg 29/10/2006 12:53 40.59 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\319104_F4661CD1-4275-46FD-A5F6-602E8D69BE4E[1].js 29/10/2006 12:57 9.61 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\319116_C65043F8-DE1C-4E7B-950D-0D68F4408625[1].js 29/10/2006 12:57 8.88 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\3524700534538df3e1e1e7[1].jpg 29/10/2006 13:01 2.00 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\585531_8[1].jpg 29/10/2006 12:53 12.16 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\6305165971.01._AA50_[1].jpg 29/10/2006 12:57 1.76 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\97470658144bd65c5d14bd[1].jpg 29/10/2006 12:50 4.25 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\advertisment[1].gif 29/10/2006 12:57 181 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\B00005V1WV.01._AA50_[1].jpg 29/10/2006 12:57 1.89 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\banner_ff[1].jpg 29/10/2006 12:56 101.55 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\belgium[1].gif 29/10/2006 13:01 2.21 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\biggrin[1].gif 29/10/2006 12:50 696 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\button_club_generals[1].gif 29/10/2006 12:52 1.45 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\button_flash_photos_ro[1].gif 29/10/2006 12:52 1.39 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\button_interViews[1].gif 29/10/2006 12:52 1.37 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\button_sign_up_ro[1].gif 29/10/2006 12:52 1.31 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\CA6FOLEN.htm 29/10/2006 12:59 3.46 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\CA8LIJW5.htm 29/10/2006 12:57 5.45 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\CAANOPQB.swf 29/10/2006 12:57 7.45 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\CAFMPKHH.jpg 29/10/2006 13:00 19.38 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\CAODYNGX.swf 29/10/2006 12:57 13.07 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\CAPS3MRD.swf 29/10/2006 12:58 11.98 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\CAQ3G92B.swf 29/10/2006 13:01 15.03 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\CAS521TU.swf 29/10/2006 12:57 17.63 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\CAS6PI53.htm 29/10/2006 12:58 2.22 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\CATCQHXF.gif 29/10/2006 12:59 10.97 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\CAU1A2YP.htm 29/10/2006 13:00 10.02 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\cellpic2[1].jpg 29/10/2006 12:50 480 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\cellpic3[1].gif 29/10/2006 12:52 257 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\ChrisSig[1].jpg 29/10/2006 12:56 160.89 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\clubmember[1].gif 29/10/2006 12:56 1.33 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\cooterswithcop2a[1].jpg 29/10/2006 12:54 9.55 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\dooralign001[1].jpg 29/10/2006 12:53 49.48 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\dukes_l_button[1].gif 29/10/2006 12:52 1.19 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\dukes_master_button[1].gif 29/10/2006 12:52 1.60 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\dukes_master_button_ro[1].gif 29/10/2006 12:52 1.60 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\dukes_mb_button_ro[1].gif 29/10/2006 12:52 1.50 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\ebBannerMain_62_11[1].js 29/10/2006 12:57 150.10 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\ebBannerMain_62_11[2].js 29/10/2006 12:58 150.10 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\ebInteractionTimeV55[1].swf 29/10/2006 12:57 713 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\error[1].htm 29/10/2006 13:01 5.66 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\event[1].png 29/10/2006 13:01 6.94 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\ExpBanner[1].js 29/10/2006 12:57 56.33 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\favicon[1].gif 29/10/2006 12:56 892 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\folder[1].gif 29/10/2006 12:50 344 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\folder_announce[1].gif 29/10/2006 12:50 307 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\folder_hot[1].gif 29/10/2006 12:52 1.15 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\folder_new_hot[1].gif 29/10/2006 12:52 1.13 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\folder_new_hot[2].gif 29/10/2006 12:59 1.13 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\formIE[1].css 29/10/2006 12:50 354 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\formIE[2].css 29/10/2006 12:59 354 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\forumdisplay[1].htm 29/10/2006 12:57 73.32 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\forums[1].htm 29/10/2006 12:55 61.25 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\general[1].gif 29/10/2006 12:53 134.74 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\ghey[1].gif 29/10/2006 13:00 649 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\google.co[1].htm 29/10/2006 12:49 3.82 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\gradient_thead[1].gif 29/10/2006 12:56 2.93 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\H1Pumpkin[1].gif 29/10/2006 12:57 18.40 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\icon1[1].gif 29/10/2006 12:56 1.01 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\icon_aim[1].gif 29/10/2006 12:52 753 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\icon_biggrin[1].gif 29/10/2006 12:57 172 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\icon_mini_members[1].gif 29/10/2006 12:52 223 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\icon_mini_members[2].gif 29/10/2006 12:59 223 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\icon_mini_message[1].gif 29/10/2006 12:50 232 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\icon_mini_message[2].gif 29/10/2006 12:52 232 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\icon_mini_profile[1].gif 29/10/2006 12:50 236 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\icon_pm[1].gif 29/10/2006 12:50 833 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\icon_profile[1].gif 29/10/2006 12:53 801 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\icon_quote[1].gif 29/10/2006 12:50 794 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\icon_rolleyes[1].gif 29/10/2006 12:52 485 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\icon_smile[1].gif 29/10/2006 12:50 174 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\im_yahoo[1].gif 29/10/2006 12:57 424 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\image5[1].jpg 29/10/2006 12:59 22.97 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\images[1].htm 29/10/2006 12:59 495 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\ImprovedColonel1[1].jpg 29/10/2006 12:53 24.35 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\JS[1].htm 29/10/2006 12:57 689 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\JS[2].htm 29/10/2006 12:58 1.02 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\JS[3].htm 29/10/2006 12:59 306 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\k_36[1].htm 29/10/2006 12:55 5.45 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\logo_phpBB[1].gif 29/10/2006 12:52 7.79 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\logof[1].gif 29/10/2006 12:55 837 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\logos[1].gif 29/10/2006 12:55 3.32 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\menu-collapsed[1].png 29/10/2006 13:01 108 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\mode_linear[1].gif 29/10/2006 12:56 609 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\nav_blue_buttons[1].htm 29/10/2006 12:52 5.91 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\Photo-0154[1].jpg 29/10/2006 13:00 14.48 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\reply[1].gif 29/10/2006 12:56 3.15 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\reply[2].gif 29/10/2006 12:57 2.91 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\reputation_highpos[1].gif 29/10/2006 12:56 500 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\rollover[1].js 29/10/2006 12:55 907 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\shocked[1].gif 29/10/2006 13:00 6.95 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\sig2-1[1].jpg 29/10/2006 13:01 19.33 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\spacer[1].gif 29/10/2006 12:53 43 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\spacer[2].gif 29/10/2006 13:00 43 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\t[1].png 29/10/2006 12:55 129 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\texas[1].gif 29/10/2006 12:54 3.72 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\thread[1].gif 29/10/2006 12:57 158 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\thread_hot_lock[1].gif 29/10/2006 12:57 248 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\thread_hot_new[1].gif 29/10/2006 12:56 1.04 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\thread_hot_new[2].gif 29/10/2006 12:57 167 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\thread_new[1].gif 29/10/2006 12:57 166 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\thumbsup[1].gif 29/10/2006 12:56 661 bytes Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\user_offline[1].gif 29/10/2006 12:56 1.00 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\vbulletin_md5[1].js 29/10/2006 12:56 9.32 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\vbulletin_menu[1].js 29/10/2006 12:56 12.98 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\viewforum[1].htm 29/10/2006 12:55 76.18 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\E385ITON\zak1s[1].jpg 29/10/2006 12:56 14.11 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\IVKJINAX\100033333_f03892f58a_s[1].jpg 29/10/2006 13:02 6.40 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\IVKJINAX\100033663_f5823d9064_s[1].jpg 29/10/2006 13:01 4.97 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\IVKJINAX\20060626-webjournal120x60e[1].gif 29/10/2006 13:01 6.58 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\IVKJINAX\36_b[1].jpg 29/10/2006 13:00 18.47 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\IVKJINAX\522b228740545c17ac9eb[1].jpg 29/10/2006 12:58 2.87 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\IVKJINAX\5822096034534aca1d7951[1].jpg 29/10/2006 13:01 2.04 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\IVKJINAX\585531_258[1].jpg 29/10/2006 12:53 10.09 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\IVKJINAX\660654_419[1].jpg 29/10/2006 12:54 10.70 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\IVKJINAX\660654_420[1].jpg 29/10/2006 12:54 7.47 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\IVKJINAX\autobanner[1].jpg 29/10/2006 12:57 44.61 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\IVKJINAX\B0000524EL.01._AA50_[1].jpg 29/10/2006 12:57 1.69 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\Temporary Internet Files\Content.IE5\IVKJINAX\bond[1].gif 29/10/2006 12:59 6.13 KB Hidden from Windows API.
C:\Documents and Settings\Steven\Local Settings\T

[Gecko]

I don't see any rootkits or anything else that could be the cause of the emails.

Have you tried running Norton in safe mode?

Can you post the header of one of these returned emails?
I would like to see if there is a difference in the sent from and return address.