Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Bogus Windows Security Alert; Locked Out Of Admin Tools


  • This topic is locked This topic is locked
26 replies to this topic

#1 mike_77

mike_77

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:57 PM

Posted 17 December 2007 - 06:51 PM

Hello.

Saturday night I got a notice from my virus checker (Norton 2004) of a Trojan attack. I thought that it had been successfully blocked, but when I rebooted on Sunday I started getting the following popup about every 5 minutes (mispellings and all):

Windows Security Alert
Warning! Potential Spyware Operation!
Your computer is making unauthorized copies of your system and Internet files. Run full scan now to pervent any unathorised access to your files! Click YES to download spyware remover...

I also discovered that I am locked out of many administrative applications (e.g. task manager)

I followed the instructions in the Preparations Guide before posting to this forum, but I am still getting the popup and I am still locked out of administrative applications. I have pasted my HijackThis log below.

A few other notes which I hope are helpful:

I ran Adware 2007 5 times; it reported over 310 infections the first time and indicated that it had repaired them. However, the 3rd, 4th, and 5th times I ran it, it showed 118 infections each time, even though it indicated that it had repaired them each time. Also after running Adware, I started getting an error message each time I shut down stating that that reg.exe had failed to initialize with the following error code: 0xc0000142. Now, intermittantly on restart, Windows stalls at a blue screen with the Windows logo and "Please wait..." It eventually it gets past this and loads.

One of the virus checkers recommended in the Preparation Guide (I believe it was Housecall) indicated that I had worm_nucrp.gen and java_bytever.dl

BitDefender listed me as infected with a variety of trojan viruses:
Trojan.Downloader.WinAntivirus.A
Trojan.Exploit.Byteverify.V
Trojan.Downloader.Java.Agent.A
Trojan.Java.Downloader.D
Java.Trojan.Exploit.Bytverify
Generic.Malware.SDYd!wdld.D7CFDC9B
Java.Trojan.Femad.A
Java.Trojan.Femad.B
Trojan.Revop.E
Trojan.Exploit.Byteverify.AC
Trojan.Agent.AGEG
DeepScan:Generic.Malware.SDYBd!wdld.FDAB348E
Generic.Qhost.16934822

Clearly, I'm a mess. I will be extremely grateful if someone can guide me out of this. (Or maybe I should just chuck the whole PC...)

Mike

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:06:56 PM, on 12/17/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\proper.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe
C:\Program Files\MEDIC\bin\sprtcmd.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Road Runner High Speed Online
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\proper.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O2 - BHO: (no name) - {D27987B8-7244-4DE0-AE10-39B826B492F1} - C:\WINDOWS\system32\bronto.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [MEDIC] "C:\Program Files\MEDIC\bin\sprtcmd.exe" /P MEDIC
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Undefined] C:\WINDOWS\system32\winter.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Undefined] C:\WINDOWS\system32\winter.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: infos.exe
O4 - Global Startup: autos.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} - http://supportsoft.adelphia.net/sdccommon/...ad/tgctlins.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/downloads/tgctlcm.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/as...rl/LSSupCtl.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/as...rl/SymAData.cab
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1136510436515
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - https://www.peryourhealth.com/viewer/active...tivexviewer.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/as...rl/SymAData.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup...er/imloader.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\wowfx.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Microsoft security update service (msupdate) - Unknown owner - c:\windows\system32\..\svchost.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - IntelŪ Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 13441 bytes

Edited by mike_77, 18 December 2007 - 04:12 PM.


BC AdBot (Login to Remove)

 


#2 mike_77

mike_77
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:57 PM

Posted 18 December 2007 - 12:34 AM

Addendum: I also ran Spybot as outlined in the Preparation Guide. After running it a few times (and rebooting between each scan) I got the same 5 problems detected each time. As with some of the other scanners, Spybot indicated that the problems were fixed, but each would reappear with each subsequent scan.

Whee.

Thanks in advance for any suggestions.

Mike

Edited by mike_77, 18 December 2007 - 04:09 PM.


#3 mike_77

mike_77
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:57 PM

Posted 18 December 2007 - 04:08 PM

Addendum #2: Holy cow! Now Control Panel is not listed in either my Start Menu or in Windows Explorer. I can't get to it through My Computer either.

Spiraling downward....

Mike

Edited by mike_77, 18 December 2007 - 04:09 PM.


#4 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:03:57 PM

Posted 18 December 2007 - 05:53 PM

Hello mike_77,

I am SifuMike and I will be helping you. :thumbsup:

Download SDFix and save it to your Desktop.

Double click SDFix.exe and choose Install to extract it to its own folder on the Desktop. Please then reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual account.
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services or Registry Entries found then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt.
  • Finally copy and paste the contents of the results file Report.txt back onto the forum with a new HijackThis log

Edited by SifuMike, 18 December 2007 - 05:54 PM.

If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#5 mike_77

mike_77
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:57 PM

Posted 18 December 2007 - 07:02 PM

Hello, SifuMike. Thanks for the help.

I ran SDFix as you instructed (took a couple tries to get into SafeMode - I was too slow on the F8). The SDFix report and new HijackThis logs are below.

A few notes:
1) After the final reboot I got a Windows error which when I clicked on Send Error Report, it took me to a Microsoft webpage saying that I needed to download updates for Drive Letter Access (DLA) which was created by Sonic Solutions. I have never seen this before, and did not install the updates.
2) I then got a prompt to install Elite Protector which I aborted.
3) Next I got the following SpyBot notice (I denied the change):

Category: System Startup global entry
Change: Value Deleted
Entry: KernelFaultCheck
Old data: %systemroot%\system32\dumprep 0 -k

4) Next, Norton blocked an attempt by antivirus.exe to access the internet.
5) Finally, I am still getting the initial bogus Windows Security Alert.
I don't know if any of that is relevant, but I wanted to let you know.

Here are the logs; SDFix first:

SDFix: Version 1.118

Run by Gladys Morgan on Tue 12/18/2007 at 06:17 PM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\DOCUME~1\GLADYS~1\Desktop\SDFix

Safe Mode:
Checking Services:

Name:
Driver
msupdate

Path:
\??\C:\WINDOWS\system32\kernelw.sys
c:\windows\system32\..\svchost.exe

Driver - Deleted
msupdate - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\SYSTEM32\G6EF4.tmp.exe - Deleted
C:\WINDOWS\SYSTEM32\GDAF0.tmp.exe - Deleted
C:\WINDOWS\system32\system\msxml4.dll - Deleted
C:\WINDOWS\system32\system\msxml4r.dll - Deleted
C:\autorun.inf - Deleted
C:\winstall.exe - Deleted
C:\WINDOWS\svchost.exe - Deleted
C:\WINDOWS\system32\CONFIG\SYSTEM~1\APPLIC~1\INSTALL.DAT - Deleted



Folder C:\WINDOWS\system32\system - Removed

Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-18 18:26:51
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations"=str(7):"\x6264\4\xdfe8\21\x6e49\x7473\xfff0\xffffERSvc\0\xfff0\xffffACPI\0\0\xffe0\xffff\x6b76\6\32\0\x26a0\6\2\0\1Y\x6977\x646e\x7269M\xffe0\xffff%SystemRoot%\0S\xffe0\xffff\x6b76\2\26\0\x26e0\6\1\0\1\1\x534f\1\xa1a8\1\xffe0\xffffWindows_NT\0\0\0\0\xfff0\xffff\x348a\xcfb8\0\0\xc8f8\x1c3\xfff8\xffff\x3fc8\6\xffd0\xffff\x6b76\26\b\0\xec28\5\1\0\1\0\x5250\x434f\x5345\x4f53\x5f52\x5241\x4843\x5449\x4345\x5554\x4552\0\xffd8\xffff\x6b76\17\6\0\xced0\2\1\0\1\0\x5250\x434f\x5345\x4f53\x5f52\x454c\x4556L\xffe0\xffff\x6b76\ab\0\x28a8\6\1\0\1T\x4150\x4854\x5845T\xffd0\xffff\x6b76\24^\0\x63a8$\1\0\1\0\x5250\x434f\x5345\x4f53\x5f52\x4449\x4e45\x4954\x4946\x5245\0\0\xffa8\xffff{50127DC3-0F36-415E-A6CC-4CB3BE910B65}\0\x4147\x5943\x505f\b\0\x4548\6\xffd0\xffff\x6b76\22\n\0\x1ff0\6\1\0\1\0\x5250\x434f\x5345\x4f53\x5f52\x4552\x4956\x4953\x4e4f\0\0\0\xffe0\xffff\x6b76\4$\0\x2940\6\2\0\1o\x4554\x504dHa\xfff8\xffff\x4328\6\xffd0\xffff\x6b76\24\4\x80001\0\1\0\1\0\x554e\x424d\x5245\x4f5f\x5f46\x5250\x434f\x5345\x4f53\x5352\0\0\xff98\xffff.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH\0P\xffd0\xffff\x6b76\21\4\x8000\1\0\4\0\1\0\x626f\x6163\x6573\x6e69\x6573\x736e\x7469\x7669e\0\x1000\30\xffd8\xffff%SystemRoot%\TEMP\0\xffe0\xffff\x6b76\3$\0\x2988\6\2\0\1n\x4d54P\x6969\x6969\xffd8\xffff%SystemRoot%\TEMP\0\xffe0\xffff\x6b76\6f\0\x1a60\36\1\0\1\6\x5451\x414a\x4156\6\xffe8\xffff\x6b76\0B\0\x6208\23\1\0\0r\xffa0\xffff\x6b6e \x348a\xcfb8\xc8f8\x1c3\0\0\xeb20\5\0\0\0\0\xffff\xffff\xffff\xffff\3\0\x2460\6\x1e8\0\xffff\xffff\0\0\0\0>\0\f\0\4\0\t\0\x7845\x6365\x7475\x7669e03,\xffc8\xffff\x6b76\37\4\x8000\0\0\4\0\0010\x6441\x6964\x6974\x6e6f\x6c61\x7243\x7469\x6369\x6c61\x6f57\x6b72\x7265\x6854\x6572\x6461s\xffc8\xffff\x6b76\36\4\x8000\0\0\4\0\0010\x6441\x6964\x6974\x6e6f\x6c61\x6544\x616c\x6579\x5764\x726f\x656b\x5472\x7268\x6165\x7364E\xffd0\xffff\x6b76\25\f\0\x2700\6\3\0\1\1\x7250\x6f69\x6972\x7974\x7551\x6e61\x7574\x4d6d\x7461\x6972\xa278\1\xff98\xffff\x6b6e \x7ae0\xea1\x5327\x1c2\0\0\xeb20\5\0\0\0\0\xffff\xffff\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\0\0\0\0\0\0\0\0\5\0\24\0\x6946\x656c\x6552\x616e\x656d\x704f\x7265\x7461\x6f69\x736eer\xffd8\xffff\x6b76\r\4\x8000\x33c\0\4\0\1\0\x6956\x6564\x496f\x696e\x5474\x6d69e\0\xffe8\xffff\x36a0\6\x3720\6\x33c0\6\x3890\6\x78f8\36\xffa8\xffff\x6b6e \x6c6c\x48ee\xc3db\x1c7\0\0\xeb20\5\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x3570\6\x1e8\0\xffff\xffff\0\0\0\0*\0\xb4\0\6\0\6\0\x656b\x6e72\x6c65\0\xffa0\xffff\x6b6e \x7ae0\xea1\x5327\x1c2\0\0\xeb20\5\0\0\0\0\xffff\xffff\xffff\xffff\25\0\x31f8\6\x1e8\0\xffff\xffff\0\0\0\0\30\0,\0\a\0\t\0\x6e4b\x776f\x446e\x4c4c\x5b73\xe187\x5ba9\xe187\xffe0\xffff\x6b76\b\32\0\x2c68\6\1\0\1\x87e2\x6461\x6176\x6970\x3233\xffe0\xffffadvapi32.dll\0000\xffe0\xffff\x6b76\b\32\0\x2ca8\6\1\0\1\xe188\x6f63\x646d\x676c\x3233\xffe0\xffffcomdlg32.dll\0\xe188\xfff0\xffff\xfd88\36\xfdc0\36\x206d\xb81d\xffd8\xffff\x6b76\f,\0\x2d00\6\2\0\1\x8137\x6c44\x446c\x7269\x6365\x6f74\x7972\x3479\xe187\xffd0\xffff%SystemRoot%\system32\0\xffe0\xffff\x6b76\5\24\0\x2d50\6\1\0\1\xe187\x6467\x3369\x4332\xe187\xffe8\xffffgdi32.dll\0\xffe8\xfffflz32.dll\0"\xffe0\xffff\x6b76\b\32\0\x2da0\6\1\0\1\xe187\x6d69\x6761\x6865\x706c\xffe0\xffffimagehlp.dll\0\xe188\xffe0\xffff\x6b76\b\32\0\x2de0\6\1\0\1\xe187\x656b\x6e72\x6c65\x3233\xffe0\xffffkernel32.dll\0r\xffe0\xffff\x6b76\b\32\0\x2ea0\6\1\0\1\1\x6c6f\x6165\x7475\x3233\xffe0\xffff\x6b76\4\22\0\x2d68\6\1\0\1D\x7a6c\x3233k\\xffe0\xffff\x6b76\5\24\0\x2e60\6\1\0\1o\x6c6f\x33652,\xffe8\xffffole32.dll\0\xffe0\xffff\x6b76\b\32\0\x2f30\6\1\0\1\1\x6c6f\x6365\x766e\x3233\xfff8\xffff\x4438\6\xffe0\xffffoleaut32.dll\0\\xffe0\xffff\x6b76\b\32\0\x2ee0\6\1\0\1r\x6c6f\x6365\x696c\x3233\xffe0\xffffolecli32.dll\0H\xffe0\xffff\x6b76\b\32\0\x2fc8\6\1\0\1\1\x6c6f\x7465\x6b68\x3233\xfff0\xffff\x39f8\6\x3a48\6\x43c0\6\xffe0\xffffolecnv32.dll\0P\xffe0\xffff\x6b76\b\32\0\x2f70\6\1\0\1o\x6c6f\x7365\x7276\x3233\xffe0\xffffolesvr32.dll\0000\xffe0\xffff\x6b76\a\30\0\x30a0\6\1\0\1\1\x6873\x6c65\x336c2\xffe8\xffffurl.dll\0\xd310\1\xffe0\xffffolethk32.dll\0u\xffe8\xffffPosix\0\0","\x6268\x6e69\x3000\6\x1000\0\0\0\0\0\0\0\0\0\0\0\xffe0\xffff\x6b76\6\26\0\x3040\6\1\0\1l\x7072\x7263\x3474\\xffe0\xffffrpcrt4.dll\0Net\xffe0\xffff\x6b76\6\26\0\x3080\6\1\0\1\1\x7275\x6d6c\x6e6f\1\xffe0\xffffurlmon.dll\0\1\xd3a0\1\xffe0\xffffshell32.dll\0Sv\xffe0\xffff\x6b76\3\20\0\x2fb0\6\1\0\1a\x7275l\nH\xffe0\xffff\x6b76\a\30\0\x3100\6\1\0\1\1\x6576\x7372\x6f69n\xffe0\xffffversion.dll\0\xd3a0\1\b\0\x6f50\6\xffe0\xffff\x6b76\6\26\0\x3148\6\1\0\1P\x7375\x7265\x3233o\xffe0\xffffuser32.dll\0ect\xffe0\xffff\x6b76\a\30\0\x3188\6\1\0\1\1\x6c77\x6164\x33702\xffe0\xffffwldap32.dll\0\xd3a0\1\xfff0\xffffmsps2\0\xffe0\xffff\x6b76\a\30\0\x31d8\6\1\0\1r\x6977\x696e\x656et\xffe0\xffffwininet.dll\0fN\xffa8\xffff\x2c48\6\x2c88\6\x2cd8\6\x2d30\6\x2d80\6\x2dc0\6\x2e20\6\x2e40\6\x2e00\6\x2ec0\6\x2e78\6\x2f50\6\x2f00\6\x3020\6\x2f90\6\x30c0\6\x3060\6\x3128\6\x30e0\6\x31b8\6\x3168\6\xff98\xffff\x6b6e \x8880\xb5b5\xeb84\x1c4\0\0\xeb20\5\1\0\0\0\x6e08.\xffff\xffff\16\0\x25d0\27\x1e8\0\xffff\xffff&\0\0\0000\0004\0\b\0\21\0\x654d\x6f6d\x7972\x4d20\x6e61\x6761\x6d65\x6e65terf\xffd0\xffff\x6b76\27\4\x8000\0\0\4\0\1a\x6c43\x6165\x5072\x6761\x4665\x6c69\x4165\x5374\x7568\x6474\x776fn\xffd0\xffff\x6b76\26\4\x8000\0\0\4\0\0010\x6944\x6173\x6c62\x5065\x6761\x6e69\x4567\x6578\x7563\x6974\x65766\xffd8\xffff\x6b76\20\4\x8000\0\0\4\0\1\r\x614c\x6772\x5365\x7379\x6574\x436d\x6361\x6568\xffd0\xffff\x6b76\21\4\x8000\0\0\4\0\1n\x6f4e\x506e\x6761\x6465\x6f50\x6c6f\x7551\x746faet\\xffd8\xffff\x6b76\20\4\x8000\0\0\4\0\1r\x6f4e\x506e\x6761\x6465\x6f50\x6c6f\x6953\x657a\xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1O\x6150\x6567\x5064\x6f6f\x516c\x6f75\x61740\xffe0\xffff\x6b76\b\xe8\0\x37a0\6\3\0\1\0\x6341\x6f50\x696c\x7963\xffd8\xffff\x6b76\r\4\x8000\0\0\4\0\1\r\x6150\x6567\x5064\x6f6f\x536c\x7a69eS\xffd0\xffff\x6b76\24\4\x8000\0\0\4\0\1n\x6553\x6f63\x646e\x654c\x6576\x446c\x7461\x4361\x6361\x6568t\\xffd8\xffff\x6b76\17\4\x80000\0\4\0\1\20\x6553\x7373\x6f69\x566e\x6569\x5377\x7a69e\xffd8\xffff\x6b76\v\4\x8000\x3000\f\4\0\1O\x7953\x7473\x6d65\x6150\x6567sme\xffd8\xffff\x6b76\v4\0\x34b0\6\a\0\1 \x6150\x6967\x676e\x6946\x656csk \xffc8\xffffC:\pagefile.sys 768 1536\0\0\xffd8\xffff\x6b76\17\4\x8000\4\0\4\0\1\1\x6553\x7373\x6f69\x506e\x6f6f\x536c\x7a69e\b\0\x4518\6\xffd0\xffff\x6b76\30\4\x8000\0\0\4\0\1\0\x6850\x7379\x6369\x6c61\x6441\x7264\x7365\x4573\x7478\x6e65\x6973\x6e6f\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\6\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\6\xfff0\xffff\x2910\6\x1830\27\x44e8\6\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1\x87e2\x7954\x6570\x5373\x7075\x6f70\x7472\x6465\x7e86\xffd8\xffff\x6b76\t\b\0\x20e8\6\1\0\1#\x6944\x6572\x7463\x726f\x9079$\xb60d\x92e\xfff0\xffff\x37a0\a\x8fa0\36\x3990\a\xff98\xffff\x6b6e \x8f90\x378e\x41cd\x1c8\0\0\x3250\6\0\0\0\0\xffff\xffff\xffff\xffff\f\0\x69a8\36\x1e8\0\xffff\xffff\0\0\0\0.\0B\0\0\0\22\0\x7250\x6665\x7465\x6863\x6150\x6172\x656d\x6574\x7372\0\0\0\xffa8\xffff\x6b6e \x1d7c\x38e1\x41cd\x1c8\0\0\xeb20\5\0\0\0\0\xffff\xffff\xffff\xffff\5\0\x2b78\6\x1e8\0\xffff\xffff\0\0\0\0"\0\xe8\0\t\0\5\0\x6f50\x6577r\0\xffd0\xffff\x6b76\21L\0\x36d0\6\3\0\1\6\x6341\x7250\x636f\x7365\x6f73\x5072\x6c6f\x6369\xe079\20\x8478\21\xffb0\xffff\1\0\0\0\0\0\3\0\x86a0\1\x86a0\1\x86a0\1\x3228\0\2\0\x86a0\1\x86a0\1\x86a0\1\x3c28\0\3\0\x86a0\1\x86a0\1\x86a0\1\x5028\0\1\0\xffd0\xffff\x6b76\21L\0\x3750\6\3\0\1\0\x6344\x7250\x636f\x7365\x6f73\x5072\x6c6f\x6369y\0\0\0\xffb0\xffff\1\0\3\0\0\0\3\0\x86a0\1\x86a0\1\x86a0\1\x140a\0\2\0\x86a0\1\x86a0\1\x86a0\1\x2814\0\3\0\x86a0\1\x86a0\1\x86a0\1\x4614\0\1\0\xff10\xffff\1\0\4\0\3\0\20\0\0\0\3\0\0\0\0\0\1\0\0\0\1\0\x19b4\xba6b\0\0\1\0\0\0\0\0002\x4858\2\0\4\0\2\0\1\0\xae0\31\0\0\3\0\1\0\3\0\0\0\4\xc000\1\0\4\0\1\0\n\0\0\0\3\0\1\1\1\0\0\0\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\0\xfb71\x7c90\xf234\6\xe1fe\x7c90\xf2f4\6\0\0\x6400d\0\0\4\xc000\0\0\0\0\xffe0\xffff\x6b76\b\xe8\0\x38b0\6\3\0\1\0\x6344\x6f50\x696c\x7963\xff10\xffff\1\0\4\0\3\0\20\0\0\0\3\0\0\0\0\0\1\0\0\0\1\0\xf000\0\0\0\0\0\0\0\0\0\x332-\4\0\4\0\2\0\1\00077\0\0\3\0\1\0\3\0\0\0\4\xc000\1\0\4\0\1\0\n\0\0\0\3\0\1\1\1\0\0\0\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\3\0\0\x12c\0\x1d01\xba6b\x1920\xba6b\x5eec\x8056\x1990\xba6b\x258\0\x6400d\0\0\4\xc000\0\0\0\0\xffa8\xffff\x6b6e \xd190\xed5e\x538c\x1c2\0\0\xeb20\5\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x2f20\6\x1e8\0\xffff\xffff\0\0\0\0\36\0:\0\n\0\3\0\x4653C\0\0\xffd8\xffff\x6b76\17 \0\x3a20\6\1\0\1\0\x7250\x676f\x6172\x466d\x6c69\x7365\x6944r\xffd8\xffffC:\Program Files\0\0\xffd8\xffff\x6b76\16:\0\x3a70\6\1\0\1\0\x6f43\x6d6d\x6e6f\x6946\x656c\x4473\x7269\0\xffc0\xffffC:\Program Files\Common Files\0\xffa0\xffff\x6b6e \x32ee\x3710\x41cd\x1c8\0\0\xeb20\5\0\0\1\0\xffff\xffff\xff00\x8001\6\0\x3ec8\6\x1e8\0\xffff\xffff\f\0\0\0\20\0\x21e\0\v\0\n\0\x7553\x5362\x7379\x6574\x736dtro\xffe0\xffff\x6b76\5\2\x8000\0\0\2\0\1\1\x6544\x7562\xd767\1\xffe0\xffff\x6b76\5B\0\x3b50\6\2\0\1\x87e2\x6d4b\x646f\xce65\x6f48\xffb8\xffff%SystemRoot%\system32\win32k.sys\0e\xffe0\xffff\x6b76\b\16\0\x2fe8\6\a\0\1\xa262\x704f\x6974\x6e6f\x6c61\xffe0\xffff\x6b76\5@\0\x3bd8\6\2\0\0010\x6f50\x6973x0\xffb8\xffff%SystemRoot%\system32\psxss.exe\0rr\xfff0\xffffVGA\0ms\b\0\x4c38\6\xffe0\xffff\x6b76\b\36\0\x3c58\6\a\0\1e\x6552\x7571\x7269\x6465\xffd8\xffffDebug\0Windows\0\0for\xffe0\xffff\x6b76\a\x21e\0\x3ca0\6\2\0\1l\x6957\x646e\x776fs\xfdd8\xffff%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16\0erf\xffe0\xffff\x3b10\6\x3b30\6\x3b98\6\x3bb8\6\x3c38\6\x3c80\6\0\0\xffa8\xffff\x6b6e \x8940\xea4\x5327\x1c2\0\0\x2e8\0\0\0\0\0\xffff\xffff\xffff\xffff\3\0\x3f80\6\x1e8\0\xffff\xffff\0\0\0\0\20\0\22\0000\0\5\0\x6553\x7574pM\xffe0\xffff\x6b76\a\f\0\x31a8\6\1\0\1S\x6f70\x6e69\x6574r\xffe0\xffff\x6b76\5\b\0\x3c20\6\1\0\1\\x6976\x6564ov\xfff0\xffff\x3f40\6\x3f60\6\x3f90\6\xffe0\xffff\x6b76\b\22\0\x3fb0\6\1\0\1v\x656b\x6279\x616f\x6472\xffe8\xffffSTANDARD\0,\xffd8\xffff\x6b76\n\4\x8000\1\0\4\0\1\0\x6544\x7562\x4667\x616c\x7367\0\0\0\xfff0\xffff\x4950\6\x49c8\6\xff47\x7ce8\x6268\x6e69\x4000\6\x1000\0\0\0\0\0\0\0\0\0\0\0\xffd8\xffff\x6b76\n.\0\x9310\v\1\0\1\x78bb\x6544\x6976\x6563\x6544\x63732\x3463\xc6c4\xffd0\xffff\x6b76\23@\0\x9358\v\1\0\1\x2a86\x6f4c\x6163\x6974\x6e6f\x6e49\x6f66\x6d72\x7461\x6f69\x276e\x2928\x2b2a\xffd8\xffff\x6b76\f\4\x8000\1\0\4\0\1\x5fb1\x654e\x7478\x6e49\x7473\x6e61\x6563\x686c\0\xffe0\xffff\x6b76\6\4\x8000\1\0\4\0\1\0\x654c\x6167\x7963&\b\0\x2140&\xffe8\xffff\x686c\1\xc4e8$\x2f1c\x634b\x4e8*\x2f1c\x634b\xffe8\xffff\x686c\1\xcd18$\x2f1c\x634b\xd18*\x2f1c\x634b\xffe8\xffff\x686c\1\x4aa8\0\x2140&\x4aa8\0\x2140&\xffe8\xffff\x686c\2\xb1f0\24\x4e64\x29c4\x3758\r\xe918\xb548\xffe8\xffff\x686c\1\x2f18\2\x8014\x3fcf\x3f18\2\x8014\x3fcf\xffd8\xffff\x686c\2\x40b0\2\xdf2e\x1e99\x4750\2\xe324\xf3ec\x5750\2\xe324\xf3ec\0\0\0\0\xffe8\xffff\x686c\1\xc2a8$#\0\xcc884\x273c\x71a2\b\0\x3130\x3332\xffe8\xffff\x686c\1\x2a18,\xa530\x30c\x8a182\xa530\x30c\xffe8\xffff\x686c\1\x2b40,\xa530\x30c\x8b402\xa530\x30c\xffe8\xffff\x686c\1\x2908,\xa530\x30c\x89082\xa530\x30c\xffe8\xffff\x686c\1\xd450$\x2140&\x1450*\x2140&\xffe8\xffff\x686c\1\x9a28\e\xc03a\1\xda28 \xc03a\1\xfff0\xffff\1\xa28\0\6\xdd01\1\xffa0\xffff\x6b6e \xc4e0\x5950\x5327\x1c2\0\0\xdc40\4\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xbc78\4\x1e8\0\xffff\xffff\0\0\0\0\24\0\4\0\1\0\n\0\x7473\x5f69\x6963\x642e\x6c6c\0\0\0\xffa0\xffff\x6b6e \xf2c0\x5990\x5327\x1c2\0\0\xdc40\4\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x2710\6\x1e8\0\xffff\xffff\0\0\0\0\24\0\4\0\3\0\f\0\x6977\x7361\x7265\x6376\x642e\x6c6c\0\0\xffa8\xffff\x6b6e \xb940\x5984\x5327\x1c2\0\0\xdc40\4\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x2870\6\x1e8\0\xffff\xffff\0\0\0\0\24\0\4\0\4\0\b\0\x6977\x7361\x2e66\x7861\xffd8\xffff\x6b76\n\4\x8000\1\0\4\0\1\2\x6544\x7562\x4667\x616c\x7367\5\x3710\f\xffe8\xffff\x6b76\0>\0\x4dd0\6\1\0\0p\xfff0\xffff\x4678\6\x46e8\6\x4768\6\xffa0\xffff\x6b6e \x5e90\xbc60\x538c\x1c2\0\0\xdc40\4\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xcff8\4\x1e8\0\xffff\xffff\0\0\0\0\24\0\4\0\5\0\f\0\x6977\x7661\x6469\x6f65\x642e\x6c6c\0\0\xffa0\xffff\x6b6e \x3aa0\x59a0\x5327\x1c2\0\0\xdc40\4\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x2e98\6\x1e8\0\xffff\xffff\0\0\0\0\24\0\4\0\6\0\v\0\x6977\x7661\x7375\x2e64\x6c64l\0\0\xffd8\xffff\x6b76\n\4\x8000\1\0\4\0\1\0\x6544\x7562\x4667\x616c\x7367\0\0\0\xffc0\xffff\x686c\a\x7cf8\27\x89e6\xb69b\x4210\6\x6559\xefaa\x8178.\x88e1\x9b20\x4270\6\xa7da\x5d33\x42d0\6\x191d\xa91c\x4378\6\xecda\x950f\x43d8\6\x4e3d\x7ace\xffa8\xffff\x6b6e \x8880\xb5b5\xeb84\x1c4\0\0\xdbe0\4\4\0\0\0\x9d30.\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\34\0\0\0\0\0\0\0\2\0\6\0\x7645\x6e65\x7374L\xffa0\xffff\x6b6e \xf8\xde86\x924b\x1c7\0\0\x44a0\6\4\0\0\0\x13d0\23\xffff\xffff\2\0\xdcc8\4\x1e8\0\xffff\xffffN\0\0\0$\0N\0\0\0\t\0\x6f43\x6e6e\x6365\x6574dp\0i\xffe0\xffff\x6b76\4N\0\x4578\6\1\0\1f\x5547\x4449is\xffa8\xffff{A28BBADE-64B6-11D2-A231-00C04FA31809}\0og\0\xffd0\xffff\x6b76\22\4\x8000*\0\1\0\1d\x614c\x6e75\x6863\x7041\x6c70\x6369\x7461\x6f69\x736et\0D\xff88\xffff\x6b6e \x8940\xea4\x5327\x1c2\0\0\x44f8\6\0\0\0\0\xffff\xffff\xffff\xffff\3\0\x4368\6\x1e8\0\xffff\xffff\0\0\0\0\b\0V\0\4\0&\0\x447b\x3331\x3345\x3246\x2d35\x3631\x3838\x342d\x4135\x2d30\x3739\x3334\x372d\x3935\x4245\x3533\x4443\x3946\x7d41\0\xffe0\xffff\x6b76\4H\0\x4698\6\1\0\1\0\x614e\x656d\0\0\xffb0\xffffMicrosoft Scanner and Camera Wizard\0\0\0\xffe0\xffff\x6b76\4V\0\x4708\6\1\0\1\0\x6544\x6373\0\0\xffa0\xffffDownload pictures from a camera or scanner\0\0\0\0\xffe0\xffff\x6b76\4 \0\x4788\6\1\0\1\0\x6349\x6e6f\0\0\xffd8\xffffwiaacmgr.exe,-2\0\0\0\xfff0\xffff\xc770*\xc790*\xc7b0*\xffa0\xffff\x6b6e \x8940\xea4\x5327\x1c2\0\0\x44a0\6\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x48c8\6\x1e8\0\xffff\xffff\0\0\0\0$\0N\0\1\0\f\0\x6944\x6373\x6e6f\x656e\x7463\x6465DC\xffe0\xffff\x6b76\4N\0\x4840\6\1\0\1a\x5547\x4449ay\xffa8\xffff{143E4E83-6497-11D2-A231-00C04FA31809}\0nt\0\xffd0\xffff\x6b76\22\4\x8000*\0\1\0\1p\x614c\x6e75\x6863\x7041\x6c70\x6369\x7461\x6f69\x736etap\xfff0\xffff\x4820\6\x4898\6\0\0\xfff0\xffff\x4a98\6\x4b08\6\x4b88\6\b\0\x79db\xb39b\xffa0\xffff\x6b6e \x8880\xb5b5\xeb84\x1c4\0\0\x44a0\6\4\0\0\0\xa828.\xffff\xffff\2\0\x3ff0\6\x1e8\0\xffff\xffffN\0\0\0$\0N\0\2\0\n\0\x6353\x6e61\x7542\x7474\x6e6felp\xffe0\xffff\x6b76\4N\0\x4970\6\1\0\1i\x5547\x44498u\xffa8\xffff{A6C5A715-8C6E-11D2-977A-0000F87A926F}\0bio\xffd0\xffff\x6b76\22\4\x8000*\0\1\0\1\0\x614c\x6e75\x6863\x7041\x6c70\x6369\x7461\x6f69\x736e\0\0\0\xffd8\xffff\x686c\2\x4d78\6\xbfb8\x60aa\x4e58\6\xf5a6\x60aa\x5e58\6\xf5a6\x60aa\x5be0\6\x339c\x20c8\xff88\xffff\x6b6e \x8940\xea4\x5327\x1c2\0\0\x48f0\6\0\0\0\0\xffff\xffff\xffff\xffff\3\0\x48d8\6\x1e8\0\xffff\xffff\0\0\0\0\b\0V\0\3\0&\0\x447b\x3331\x3345\x3246\x2d35\x3631\x3838\x342d\x4135\x2d30\x3739\x3334\x372d\x3935\x4245\x3533\x4443\x3946\x7d41\0\xffe0\xffff\x6b76\4H\0\x4ab8\6\1\0\1\0\x614e\x656d\0\0\xffb0\xffffMicrosoft Scanner and Camera Wizard\0\0\0\xffe0\xffff\x6b76\4V\0\x4b28\6\1\0\1\0\x6544\x6373\0\0\xffa0\xffffDownload pictures from a camera or scanner\0\0\0\0\xffe0\xffff\x6b76\4 \0\x4ba8\6\1\0\1\0\x6349\x6e6f\0\0\xffd8\xffffwiaacmgr.exe,-2\0\0\0\xfff0\xffff\xf648*\xf680*\xf6d0*\xffa0\xffff\x6b6e \xcf5e\x4d3d\x2126\x1c7\0\0\x44a0\6\2\0\0\0\xe9d0\25\xffff\xffff\2\0\x4ce8\6\x1e8\0\xffff\xffffL\0\0\0$\0N\0\3\0\r\0\x5453\x5049\x6f72\x7978\x7645\x6e65t\0\xffe0\xffff\x6b76\4N\0\x4c60\6\1\0\1\0\x5547\x4449\0\0\xffa8\xffff{d711f81f-1f0d-422d-8641-927d1b93e5e5}\0\0\0\0\xffd0\xffff\x6b76\22\4\x8000*\0\1\0\1\0\x614c\x6e75\x6863\x7041\x6c70\x6369\x7461\x6f69\x736e\0\0\0\xfff0\xffff\x4c40\6\x4cb8\6\0\0\xffa8\xffff\x6b6e \x8880\xb5b5\xeb84\x1c4\0\0\xdbe0\4\2\0\0\0\x49f8\6\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\16\0\0\0\0\0\0\0\3\0\a\0\x6f4c\x6767\x6e69g\xffd8\xffff\x686c\2\x7658\6\x9798\1\x7a98\6\x9cd0\1\x8a98\6\x9cd0\1\x5cf8\6\xe077\xb54b\xffa8\xffff\x6b6e \x8940\xea4\x5327\x1c2\0\0\x4cf8\6\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x4e38\6\x1e8\0\xffff\xffff\0\0\0\0\n\0>\0\0\0\6\0\x5453\x4349\x494c \xffb8\xffffStill Image Client Application\0AM\0\xffe0\xffff\x6b76\5\4\x80004\0\1\0\0014\x654c\x6576ll\xfff0\xffff\x4350\6\x4e18\6\0\0\xfff0\xffff5.1\0\x17c0\20\xffa8\xffff\x6b6e \x8940\xea4\x5327\x1c2\0\0\x4cf8\6\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x4f30\6\x1e8\0\xffff\xffff\0\0\0\0\n\0>\0\1\0\6\0\x5453\x4d49\x4e4fc\xffe8\xffff\x6b76\0>\0\x4ec8\6\1\0\0\0\xffb8\xffffStill Image Monitoring Process\0s\0M\xffe0\xffff\x6b76\5\4\x80004\0\1\0\1d\x654c\x6576l\0\xfff0\xffff\x4eb0\6\x4f10\6\0\0\xffe8\xffff\x686c\1\x8928\6\x448d\x95f\x9928\6\x448d\x95f\xffa0\xffff\x6b6e \x8880\xb5b5\xeb84\x1c4\0\0\x2e8\0\3\0\0\0\x64f0\6\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff&\0\0\0\0\0\0\0002\0\17\0\x7953\x7473\x6d65\x6552\x6f73\x7275\x6563s\xffe0\xffff\x6b76\4\16\0\x4fd8\6\1\0\1o\x6945\x6173ro\xffe8\xffffPCFlat\0ice\xfff0\xffff\t\0\0\0\x5657\x6622\x6268\x6e69\x5000\6\x1000\0\0\0\0\0\0\0\0\0\0\0\xff98\xffff\x6b6e \x8940\xea4\x5327\x1c2\0\0\x4f58\6\0\0\0\0\xffff\xffff\xffff\xffff\5\0\x5ea0\6\x1e8\0\xffff\xffff\0\0\0\0\f\0\x8e8\0\0\0\22\0\x7341\x6973\x6e67\x656d\x746e\x724f\x6564\x6972\x676eYST\xffe0\xffff\x6b76\3\16\0\x50a8\6\1\0\1r\x7349arm\xffe8\xffffPCFlat\0en \xffe0\xffff\x6b76\6\x4a8\0\x50e0\6\n\0\0010\x4350\x6c46\x74610\xfb50\xffff\x4a8\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\1\1$\0\x100\0\0\0\0\0\0\0\x500\0\0\0\xffff\0\0\0\x108\0\0\0\0\0\0\0\x140\0\0\0\x17f\0\0\0\x108\0\0\0\0\0\0\0\x200\0\0\0\x2ff\0\0\0\x108\0\0\0\0\0\0\0\x300\0\0\0\x36f\0\0\0\x108\0\0\0\0\0\0\0\x378\0\0\0\x37a\0\0\0\x108\0\0\0\0\0\0\0\x2e8\0\0\0\x2ff\0\0\0\x108\0\0\0\0\0\0\0\x1f0\0\0\0\x1f8\0\0\0\x108\0\0\0\0\0\0\0\x3b0\0\0\0\x3cf\0\0\0\x108\0\0\0\0\0\0\0\x3e8\0\0\0\x3ff\0\0\0\x108\0\0\0\0\0\0\0\x1ce\0\0\0\x1cf\0\0\0\x108\0\0\0\0\0\0\0\x100\0\0\0\x3ff\0\0\0\x200\0\0\0\17\0\17\0\0\0\0\0\0\0\0\0\x208\0\0\0\r\0\r\0\0\0\0\0\0\0\0\0\x208\0\0\0\f\0\f\0\0\0\0\0\0\0\0\0\x208\0\0\0\t\0\t\0\0\0\0\0\0\0\0\0\x208\0\0\0\b\0\b\0\0\0\0\0\0\0\0\0\x208\0\0\0\a\0\a\0\0\0\0\0\0\0\0\0\x208\0\0\0\v\0\v\0\0\0\0\0\0\0\0\0\x208\0\0\0\n\0\n\0\0\0\0\0\0\0\0\0\x208\0\0\0\2\0\2\0\0\0\0\0\0\0\0\0\x208\0\0\0\5\0\5\0\0\0\0\0\0\0\0\0\x208\0\0\0\3\0\3\0\0\0\0\0\0\0\0\0\x208\0\0\0\4\0\4\0\0\0\0\0\0\0\0\0\x208\0\0\0\16\0\16\0\0\0\0\0\0\0\0\0\x208\0\0\0\6\0\6\0\0\0\0\0\0\0\0\0\x208\0\0\0\f\0\f\0\0\0\0\0\0\0\0\0\x208\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\x208\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\x300\0\0\0\0\0\0\0\0\20\0\0\xffff\xffaf\0\0\x308\0\0\0\0\0\0\0\0\17\0\0\xffff\17\0\0\x308\0\0\0\0\0\0\0\0\b\0\0\xffff\v\0\0\x308\0\0\0\0\0\0\0\0\b\0\0\xffff\17\0\0\x308\0\0\0\0\0\0\0\0\b\0\0\xffff\xfff7\0\0\x400\0\0\0\6\0\17\0\0\0\0\0\0\0\0\0\x408\0\0\0\3\0\4\0\0\0\0\0\0\0\0\0\x408\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0,0\xffe0\xffff\x6b76\3\x8e8\0\x55b0\6\n\0\1K\x4350I,"\xf710\xffff\x8e8\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\1\1F\0\x100\0\0\0\0\0\0\0\xfc00\0\0\0\xfcff\0\0\0\x108\0\0\0\0\0\0\0\xf800\0\0\0\xf8ff\0\0\0\x108\0\0\0\0\0\0\0\xf400\0\0\0\xf4ff\0\0\0\x108\0\0\0\0\0\0\0\xf000\0\0\0\xf0ff\0\0\0\x108\0\0\0\0\0\0\0\xec00\0\0\0\xecff\0\0\0\x108\0\0\0\0\0\0\0\xe800\0\0\0\xe8ff\0\0\0\x108\0\0\0\0\0\0\0\xe400\0\0\0\xe4ff\0\0\0\x108\0\0\0\0\0\0\0\xe000\0\0\0\xe0ff\0\0\0\x108\0\0\0\0\0\0\0\xdc00\0\0\0\xdcff\0\0\0\x108\0\0\0\0\0\0\0\xd800\0\0\0\xd8ff\0\0\0\x108\0\0\0\0\0\0\0\xd400\0\0\0\xd4ff\0\0\0\x108\0\0\0\0\0\0\0\xd000\0\0\0\xd0ff\0\0\0\x108\0\0\0\0\0\0\0\xcc00\0\0\0\xccff\0\0\0\x108\0\0\0\0\0\0\0\xc800\0\0\0\xc8ff\0\0\0\x108\0\0\0\0\0\0\0\xc400\0\0\0\xc4ff\0\0\0\x108\0\0\0\0\0\0\0\xc000\0\0\0\xc0ff\0\0\0\x108\0\0\0\0\0\0\0\xbc00\0\0\0\xbcff\0\0\0\x108\0\0\0\0\0\0\0\xb800\0\0\0\xb8ff\0\0\0\x108\0\0\0\0\0\0\0\xb400\0\0\0\xb4ff\0\0\0\x108\0\0\0\0\0\0\0\xb000\0\0\0\xb0ff\0\0\0\x108\0\0\0\0\0\0\0\xac00\0\0\0\xacff\0\0\0\x108\0\0\0\0\0\0\0\xa800\0\0\0\xa8ff\0\0\0\x108\0\0\0\0\0\0\0\xa400\0\0\0\xa4ff\0\0\0\x108\0\0\0\0\0\0\0\xa000\0\0\0\xa0ff\0\0\0\x108\0\0\0\0\0\0\0\x9c00\0\0\0\x9cff\0\0\0\x108\0\0\0\0\0\0\0\x9800\0\0\0\x98ff\0\0\0\x108\0\0\0\0\0\0\0\x9400\0\0\0\x94ff\0\0\0\x108\0\0\0\0\0\0\0\x9000\0\0\0\x90ff\0\0\0\x108\0\0\0\0\0\0\0\x8c00\0\0\0\x8cff\0\0\0\x108\0\0\0\0\0\0\0\x8800\0\0\0\x88ff\0\0\0\x108\0\0\0\0\0\0\0\x8400\0\0\0\x84ff\0\0\0\x108\0\0\0\0\0\0\0\x8000\0\0\0\x80ff\0\0\0\x108\0\0\0\0\0\0\0\x7c00\0\0\0\x7cff\0\0\0\x108\0\0\0\0\0\0\0\x7800\0\0\0\x78ff\0\0\0\x108\0\0\0\0\0\0\0\x7400\0\0\0\x74ff\0\0\0\x108\0\0\0\0\0\0\0\x7000\0\0\0\x70ff\0\0\0\x108\0\0\0\0\0\0\0\x6c00\0\0\0\x6cff\0\0\0\x108\0\0\0\0\0\0\0\x6800\0\0\0\x68ff\0\0\0\x108\0\0\0\0\0\0\0\x6400\0\0\0\x64ff\0\0\0\x108\0\0\0\0\0\0\0\x6000\0\0\0\x60ff\0\0\0\x108\0\0\0\0\0\0\0\x5c00\0\0\0\x5cff\0\0\0\x108\0\0\0\0\0\0\0\x5800\0\0\0\x58ff\0\0\0\x108\0\0\0\0\0\0\0\x5400\0\0\0\x54ff\0\0\0\x108\0\0\0\0\0\0\0\x5000\0\0\0\x50ff\0\0\0\x108\0\0\0\0\0\0\0\x4c00\0\0\0\x4cff\0\0\0\x108\0\0\0\0\0\0\0\x4800\0\0\0\x48ff\0\0\0\x108\0\0\0\0\0\0\0\x4400\0\0\0\x44ff\0\0\0\x108\0\0\0\0\0\0\0\x4000\0\0\0\x40ff\0\0\0\x108\0\0\0\0\0\0\0\x3c00\0\0\0\x3cff\0\0\0\x108\0\0\0\0\0\0\0\x3800\0\0\0\x38ff\0\0\0\x108\0\0\0\0\0\0\0\x3400\0\0\0\x34ff\0\0\0\x108\0\0\0\0\0\0\0\x3000\0\0\0\x30ff\0\0\0\x108\0\0\0\0\0\0\0\x2c00\0\0\0\x2cff\0\0\0\x108\0\0\0\0\0\0\0\x2800\0\0\0\x28ff\0\0\0\x108\0\0\0\0\0\0\0\x2400\0\0\0\x24ff\0\0\0\x108\0\0\0\0\0\0\0\x2000\0\0\0\x20ff\0\0\0\x108\0\0\0\0\0\0\0\x1c00\0\0\0\x1cff\0\0\0\x108\0\0\0\0\0\0\0\x1800\0\0\0\x18ff\0\0\0\x108\0\0\0\0\0\0\0\x1400\0\0\0\x14ff\0\0\0\x108\0\0\0\0\0\0\0\x1000\0\0\0\x10ff\0\0\0\x108\0\0\0\0\0\0\0\xc00\0\0\0\xcff\0\0\0\x108\0\0\0\0\0\0\0\x800\0\0\0\x8ff\0\0\0\x108\0\0\0\0\0\0\0\x500\0\0\0\xffff\xffff\0\0\x200\0\0\0\0\0\xffff\xffff\0\0\0\0\0\0\0\0\x300\0\0\0\0\0\0\0\0\20\0\0\xffff\xffaf\0\0\x308\0\0\0\0\0\0\0\0\17\0\0\xffff\17\0\0\x308\0\0\0\0\0\0\0\0\b\0\0\xffff\v\0\0\x308\0\0\0\0\0\0\0\0\b\0\0\xffff\17\0\0\x308\0\0\0\0\0\0\0\0\b\0\0\xffff\xfff7\0\0\x400\0\0\0\6\0\xff\0\0\0\0\0\0\0\0\0006,\xffe8\xffff\x4fb8\6\x5088\6\x50c0\6\x5590\6\x5eb8\6\xffe0\xffff\x6b76\6\16\0\x5ed8\6\1\0\1e\x4350\x434d\x4149o\xffe8\xffffPCFlat\0Ser\xffa0\xffff\x6b6e \x8940\xea4\x5327\x1c2\0\0\x4f58\6\0\0\0\0\xffff\xffff\xffff\xffff\v\0\x6178\6\x1e8\0\xffff\xffff\0\0\0\0\30\0\b\0\1\0\t\0\x7542\x5673\x6c61\x6575sren\xffe0\xffff\x6b76\4\b\0\x4ff0\6\3\0\1\\x4243\x7375rv\xffe0\xffff\x6b76\4\b\0\x5f90\6\3\0\1o\x6945\x6173Pe\xfff0\xffff\2\0\1\0\xd4b8\1\xfff0\xffff\n\0\0\0Se\xffe0\xffff\x6b76\b\b\0\x5fd0\6\3\0\1"\x6e49\x6574\x6e72\x6c61\xfff0\xffff\0\0\0\00000\xffe0\xffff\x6b76\3\b\0\x6020\6\3\0\1e\x7349asP\x6268\x6e69\x6000\6\x1000\0\0\0\0\0\0\0\0\0\0\0\xfff0\xffff\1\0\0\0Ob\xfff0\xffff\a\0\0\0\xdf40\1\xfff8\xffff\x6238\6\xffe0\xffff\x6b76\3\b\0\x5fa0\6\3\0\1r\x504dItC\xffe0\xffff\x6b76\4\b\0\x6088\6\3\0\1,\x504d\x4153,\\xfff0\xffff\v\0\0\0ic\xffe0\xffff\x6b76\6\b\0\x6130\6\3\0\1\1\x4350\x434d\x4149\1\xffe0\xffff\x6b76\5\b\0\x6030\6\3\0\1,\x754e\x7542s7\xffe0\xffff\x6b76\3\b\0\x60f8\6\3\0\0017\x4350I28\xfff0\xffff\5\0\1\0,0\xffe0\xffff\x6b76\3\b\0\x61a8\6\3\0\1\1\x4d56E\xee00\1\xfff8\xffff\x6ba0\6\xfff0\xffff\b\0\1\08,\xffd8\xffff\x6b76\f\b\0\x6168\6\3\0\1,\x7554\x6272\x436f\x6168\x6e6e\x6c6500\xfff0\xffff\4\0\0\0,0\xffd0\xffff\x5f50\6\x5f70\6\x5fb0\6\x5fe0\6\x6048\6\x6068\6\x60b8\6\x60d8\6\x6098\6\x6140\6\x6108\6\xfff0\xffff\6\0\0\0,0\xffe8\xffffRDPClip\0\xee20\17\xff98\xffff\x6b6e \x8940\xea4\x5327\x1c2\0\0\x4f58\6\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x6040\6\x1e8\0\xffff\xffff\0\0\0\0\6\0\x294\0\2\0\21\0\x6552\x6573\x7672\x6465\x6552\x6f73\x7275\x6563s00,\xffe0\xffff\x6b76\3\x294\0\x6258\6\b\0\0010\x7349a0,\xfd68\xffff\1\0\1\0\0\0\0\0(\0\x101\0\0\0\0\0\x100\0\x301\0\x42e8\0\0\0\b\0\x301\0\x4ae8\0\0\0\b\0\x301\0\x82e8\0\0\0\b\0\x301\0\x86e8\0\0\0\b\0\x301\0\x8ae8\0\0\0\b\0\x301\0\x8ee8\0\0\0\b\0\x301\0\x92e8\0\0\0\b\0\x301\0\x96e8\0\0\0\b\0\x301\0\x9ae8\0\0\0\b\0\x301\0\x9ee8\0\0\0\b\0\x301\0\xa2e8\0\0\0\b\0\x301\0\xa6e8\0\0\0\b\0\x301\0\xaae8\0\0\0\b\0\x301\0\xaee8\0\0\0\b\0\x301\0\xb6e8\0\0\0\b\0\x301\0\xbae8\0\0\0\b\0\x301\0\xbee8\0\0\0\b\0\x301\0\xc2e8\0\0\0\b\0\x301\0\xc6e8\0\0\0\b\0\x301\0\xcae8\0\0\0\b\0\x301\0\xcee8\0\0\0\b\0\x301\0\xd2e8\0\0\0\b\0\x301\0\xd6e8\0\0\0\b\0\x301\0\xdae8\0\0\0\b\0\x301\0\xdee8\0\0\0\b\0\x301\0\xe2e8\0\0\0\b\0\x301\0\xe6e8\0\0\0\b\0\x301\0\xeae8\0\0\0\b\0\x301\0\xeee8\0\0\0\b\0\x301\0\xf6ee\0\0\0\2\0\x301\0\xfaee\0\0\0\2\0\x301\0\xfeee\0\0\0\2\0\x302\0\3\0\3\0\xffff\xffff\x302\0\4\0\4\0\xffff\xffff\x302\0\16\0\16\0\xffff\xffff\x302\0\6\0\6\0\xffff\xffff\x302\0\f\0\f\0\xffff\xffff\x302\0\1\0\1\0\xffff\xffff\x303\0\xffff\xffbf\0\0\0@\xffd8\xffff\x686c\3\x5020\6\x5657\x6622\x5ef0\6\xabb2\x6865\x61d0\6\x5b47\xf6f6\x71d0\6\x5b47\xf6f6\xffa0\xffff\x6b6e \x67ea\x3feb\x182\x1c6\0\0\x2e8\0\f\0\0\0\x82a8\36\xffff\xffff\22\0\x7bd87\x1e8\0\xffff\xffff2\0\0\0<\0\x104\0003\0\17\0\x6554\x6d72\x6e69\x6c61\x5320\x7265\x6576r\xffc8\xffff\x6b76\36\4\x8000\17\0\4\0\1\0\x6946\x7372\x4374\x756f\x746e\x734d\x5167\x6550\x6b65\x5373\x656c\x7065\x6142\x4164\x7070\0\xffd0\xffff\x6b76\23\x104\0\x65e0\6\a\0\1\0\x6f4d\x6564\x736d\x5720\x7469\x2068\x6142\x2064\x5344R\0\0\xfef8\xffffMultiTech MultiModem MT2834\0MultiTech MultiModem MT2834ZDX\0MultiTech MT2834\0MultiTech MT2834ZDX\0MultiTech 2834\0MultiTech 2834ZDX\0\0\xffc8\xffff\x6b76\35\4\x8000\1\0\4\0\1\0\x734d\x5167\x6142\x4164\x7070\x6c53\x6565\x5470\x6d69\x4965\x4d6e\x6c69\x696c\x6573c\0\xffc8\xffff\x6b76\34\4\x8000\5\0\4\0\1\0\x744e\x4368\x756f\x746e\x734d\x5167\x6550\x6b65\x5373\x656c\x7065\x6142\x4164\x7070\0\0\xffd0\xffff\x6b76\24\4\x8000\0\0\4\0\1i\x5766\x6972\x6174\x6c62\x5465\x4353\x5043\x7265\x546d\x6261fl\xffd0\xffff\x6b76\24\4\x8000\0\0\4\0\1S\x6544\x656c\x6574\x6554\x706d\x6944\x7372\x6e4f\x7845\x7469tr\xffe0\xffff\x6b76\4\20\0\x61b8\6\1\0\1\x76bd\x614e\x656d\xcda7\x7f0a\xffd0\xffff\x6b76\21\4\x8000\0\0\4\0\1S\x6550\x5372\x7365\x6973\x6e6f\x6554\x706d\x6944rCar\xffd0\xffff\x6b76\22\4\x8000\1\0\4\0\1\20\x4466\x6e65\x5479\x4353\x6e6f\x656e\x7463\x6f69\x736e\20\x1050\20\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\x5350\x5354\x6441\x6576\x7472\x7369\x4b65\x855a\x75c0\xffd8\xffff\x6b76\16\b\0\x4e48\6\1\0\1\20\x7250\x646f\x6375\x5674\x7265\x6973\x6e6f\20\xffd8\xffff\x6b76\r\4\x8000\3\0\4\0\1\x4040\x7355\x4565\x6378\x6168\x676e\x4965\x404d\x4040\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\20\x5354\x7041\x4370\x6d6f\x6170t\x1528\20\xfff8\xffff\x6d18\6\xffd0\xffff\x6b76\27\4\x8000\0\0\4\0\1\x5a4d\x6449\x656c\x6957\x536e\x6174\x6974\x6e6f\x6f50\x6c6f\x6f43\x6e75\xa074\xffd8\xffff\x6b76\r\4\x8000\0\0\4\0\1\20\x5354\x7355\x7265\x6e45\x6261\x656c\x1564\20\xfff0\xffff\x84f0\6\x8548\6\xf24a\x1d2b\xffd8\xffff\x6b76\t\4\x8000\1\0\4\0\1n\x5354\x6e45\x6261\x656cdn.\0\xffe0\xffff\x6b76\4\4\x8000\3\0\4\0\1S\x7954\x6570te\xfff0\xffff\x67b8\6\x6970\6\x7838\6\xfff0\xffff\x6c28\6\x6c68\6\x9dbb\x2f90\xffd8\xffff\x6b76\17\4\x8000\1\0\4\0\1\0\x4166\x6c6c\x776f\x6f54\x6547\x4874\x6c65p\xffd8\xffff\x6b76\16\xd090\0\x6a00\6\3\0\1\6\x7041\x4370\x6d6f\x6170\x4374\x6361\x6568\6\xfff0\xffff\x6264\4\x8e28\36\x78b0\6\xfff0\xffff\x85d08\x8bc88\x3728?\xffa8\xffff\x6b6e \x8880\xb5b5\xeb84\x1c4\0\0\x6518\6\3\0\0\0\x6c88\6\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff6\0\0\0\0\0\0\0\0\0\6\0\x6441\x4964\x736ep\xffa0\xffff\x6b6e \x3cb0\x3c26\x538c\x1c2\0\0\x6a20\6\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x6990\6\x1e8\0\xffff\xffff\0\0\0\0\b\0\20\0\0\0\17\0\x6c43\x7069\x5220\x6465\x7269\x6365\x6f74r\xffa0\xffff\x6b6e \xd240\x3c2a\x538c\x1c2\0\0\x6a20\6\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x6b90\6\x1e8\0\xffff\xffff\0\0\0\0\b\0\22\0\1\0\20\0\x6f53\x6e75\x2064\x6552\x6964\x6572\x7463\x726f\xffe0\xffff\x6b76\4\22\0\x6b58\6\1\0\1s\x614e\x656dfs\xffe8\xffffRDPSound\0\x216b\xffe0\xffff\x6b76\4\4\x8000\3\0\4\0\1s\x7954\x6570Fi\xfff0\xffff\x6b38\6\x6b70\6\0\0\xffe8\xffff\x6b76\0\2\x8000\0\0\1\0\0\x9d5\xff90\xffff\x6b6e \x3cb0\x3c26\x538c\x1c2\0\0\x6a20\6\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x69a0\6\x1e8\0\xffff\xffff\0\0\0\0\b\0\34\0\2\0\32\0\x6554\x6d72\x6e69\x6c61\x5320\x7265\x6576\x2072\x6552\x6964\x6572\x7463\x726f Se\xffe0\xffff\x6b76\4\34\0\x6c48\6\1\0\1\\x614e\x656dnd\xffe0\xffff\Device\RdpDr\0\xffe0\xffff\x6b76\4\4\x8000\0\0\4\0\1m\x7954\x6570ur\xffd8\xffff\x686c\3\x6a78\6\x9dbb\x2f90\x6ad8\6\xc614\x998f\x6bb8\6\xb01a\x216b\x7bb8\6\xb01a\x216b\xff98\xffff\x6b6e \x2e50\x3c23\x538c\x1c2\0\0\x6518\6\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x6128\6\x1e8\0\xffff\xffff\0\0\0\0\0\0\2\0\1\0\26\0\x7541\x6874\x726f\x7a69\x6465\x7041\x6c70\x6369\x7461\x6f69\x736e\0\xffe8\xffff\x6b76\0\2\x8000\0\0\1\0\0n\xff98\xffff\x6b6e \x2e50\x3c23\x538c\x1c2\0\0\x6518\6\0\0\0\0\xffff\xffff\xffff\xffff\e\0\x7310\6\x1e8\0\xffff\xffff\0\0\0\08\0\4\0\2\0\30\0\x6544\x6166\x6c75\x5574\x6573\x4372\x6e6f\x6966\x7567\x6172\x6974\x6e6f\xffe0\xffff\x6b76\b\4\x8000\0\0\4\0\1\0\x6143\x6c6c\x6162\x6b63\xffd8\xffff\x6b76\16\2\x8000\0\0\1\0\1\0\x6143\x6c6c\x6162\x6b63\x754e\x626d\x7265\0\xffe0\xffff\x6b76\6\2\x8000\0\0\1\0\1\0\x6f44\x616d\x6e69\0\xffd8\xffff\x6b76\16\2\x8000\0\0\1\0\1\0\x6e49\x7469\x6169\x506c\x6f72\x7267\x6d61\0\xffe8\xffff\x7af0\6\x7b30\6\x7b70\6\x7bb0\6\x8750\6\xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1\0\x654b\x6279\x616f\x6472\x614c\x6f79\x7475\0\xffd0\xffff\x6b76\21\4\x8000\0\0\4\0\1\0\x614d\x4378\x6e6f\x656e\x7463\x6f69\x546e\x6d69e\0\0\0\xffe0\xffff\x6b76\b\2\x8000\0\0\1\0\1\17\x6150\x7373\x6f77\x6472\xffd0\xffff\x6b76\24\4\x8000\0\0\4\0\1\0\x614d\x4478\x7369\x6f63\x6e6e\x6365\x6974\x6e6f\x6954\x656d\0\0\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\0\x614d\x4978\x6c64\x5465\x6d69e\0\0\xffe0\xffff\x6b76\6\4\x8000\1\0\4\0\1\17\x6853\x6461\x776f\17\xfff8\xffff\x69d8\6\xffd8\xffff\x6b76\r\2\x8000\0\0\1\0\1\0\x574e\x6f4c\x6f67\x536e\x7265\x6576r\0\xffd8\xffff\x6b76\r\2\x8000\0\0\1\0\1\17\x6f57\x6b72\x6944\x6572\x7463\x726f\xeb79\17\b\0\x7f10\6\xffe0\xffff\x6b76\b\2\x8000\0\0\1\0\1\0\x7355\x7265\x614e\x656d\xffd8\xffff\x6b76\20\4\x8000\0\0\4\0\1\17\x4966\x686e\x7265\x7469\x6143\x6c6c\x6162\x6b63\xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1\17\x4966\x686e\x7265\x7469\x6853\x6461\x776f\17\x6268\x6e69\x7000\6\x1000\0\0\0\0\0\0\0\0\0\0\0\xffd0\xffff\x6b76\21\4\x8000\1\0\4\0\1\0\x4966\x686e\x7265\x7469\x7541\x6f74\x6f4c\x6f67n\0\0\0\xffd0\xffff\x6b76\26\4\x8000\1\0\4\0\1\17\x4966\x686e\x7265\x7469\x6e49\x7469\x6169\x506c\x6f72\x7267\x6d61\17\xfff0\xffff\x8678\6\x86c8\6\x9380\6\xffd0\xffff\x6b76\26\4\x8000\0\0\4\0\1\0\x4966\x686e\x7265\x7469\x6143\x6c6c\x6162\x6b63\x754e\x626d\x7265\0\xffd0\xffff\x6b76\23\4\x8000\0\0\4\0\1\17\x4966\x686e\x7265\x7469\x614d\x4978\x6c64\x5465\x6d69e\xeb20\17\xffe8\xffff\x686c\1\x9020\6\xcb5b\1\xa020\6\xcb5b\1\xffc8\xffff\x6b76\34\4\x8000\0\0\4\0\1\0\x4966\x686e\x7265\x7469\x614d\x4478\x7369\x6f63\x6e6e\x6365\x6974\x6e6f\x6954\x656d\0\0\xffd0\xffff\x6b76\25\4\x8000\0\0\4\0\1\17\x4966\x686e\x7265\x7469\x6552\x6f63\x6e6e\x6365\x5374\x6d61\xeb65\17\xffe0\xffff\x6b76\b\26\0\x72f0\6\1\0\1\17\x3030\x3030\x3030\x3030\xffd0\xffff\x6b76\26\4\x8000\0\0\4\0\1\0\x4966\x686e\x7265\x7469\x614d\x5378\x7365\x6973\x6e6f\x6954\x656d\0\xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1\17\x4c66\x676f\x6e6f\x6944\x6173\x6c62\x6465\17\xffd0\xffff\x6b76\22\4\x8000\0\0\4\0\1\17\x5066\x6f72\x706d\x4674\x726f\x6150\x7373\x6f77\x6472\17\xeb20\17\xffd0\xffff\x6b76\23\4\x8000\0\0\4\0\1\0\x4966\x686e\x7265\x7469\x6552\x6573\x4274\x6f72\x656bn\0\0\xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1\17\x5266\x6365\x6e6f\x656e\x7463\x6153\x656d\17\xffd8\xffff\x6b76\f\4\x8000\0\0\4\0\1\17\x5266\x7365\x7465\x7242\x6b6f\x6e65\xeac8\17\xffe0\xffff\x6b76\b\26\0\x76b0\6\1\0\1\0\x3030\x3030\x3030\x3130\b\0\x7762\1\xffd0\xffff\x6b76\24\4\x8000<\0\4\0\1\0\x624b\x4964\x6c64\x4265\x7375\x6d79\x4173\x6c6c\x776f\x6465\0\0\xffe0\xffffkbd101.dll\0\0\0\0\xff90\xffff\x6d98\6\x6db8\6\x6de0\6\x6e00\6\x6e40\6\x6e68\6\x6eb8\6\x6ee8\6\x6f38\6\x6e98\6\x6f10\6\x6f90\6\x6f60\6\x7020\6\x6fb0\6\x7090\6\x7050\6\x7108\6\x70c0\6\x7190\6\x7140\6\x7218\6\x6fd8\6\x71c0\6\x71e8\6\x7248\6\x7270\6\xffa8\xffff\x6b6e \xb580\x3c24\x538c\x1c2\0\0\x6518\6\0\0\0\0\xffff\xffff\xffff\xffff\b\0\x7528\6\x1e8\0\xffff\xffff\0\0\0\0006\0\4\0\0\0\3\0\x6f44s\0\0\xffd0\xffff\x6b76\25\4\x8000\1\0\4\0\1P\x624b\x4964\x6c64\x4465\x7465\x6365\x4174\x7362\x6c6f\x7475es\xffc8\xffff\x6b76\e\4\x8000P\0\4\0\1i\x624b\x4964\x6c64\x4465\x7465\x6365\x5074\x6f72\x6162\x6974\x6e6f\x6f43\x6e75tn\0\xffd0\xffff\x6b76\27\4\x8000#\0\4\0\1\0\x624b\x4964\x6c64\x4965\x506e\x6f72\x6162\x6974\x6e6f\x6f43\x6e75t\xffd8\xffff\x6b76\20\4\x8000\0\0\4\0\1\xeb24\x624b\x4964\x6c64\x6d65\x4173\x6c6c\x776f\x6465\xffc8\xffff\x6b76\31\4\x8000\x9c4\0\4\0\1\0\x624b\x4964\x6c64\x6d65\x4773\x6f6f\x5064\x6f72\x6162\x6974\x6e6f\x6e45d\0\0\0\xffd0\xffff\x6b76\27\4\x8000\x9c4\0\4\0\1\0\x624b\x4964\x6c64\x6d65\x5073\x6f72\x6162\x6974\x6e6f\x7254\x6169l\xffd8\xffff\x6b76\16\4\x8000d\0\4\0\1\0\x624b\x4964\x6c64\x6d65\x5373\x656c\x7065\0\xffd8\xffff\x72c0\6\x73d8\6\x7408\6\x7440\6\x7470\6\x7498\6\x74d0\6\x7500\6\0\0\xffa0\xffff\x6b6e \x8940\xea4\x5327\x1c2\0\0\x6518\6\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x68d8\6\x1e8\0\xffff\xffff\0\0\0\0\0\0\2\0\nH\f\0\x6e49\x7570\x4474\x7665\x6369\x7365TE\xffe0\xffff\x6b76\0050\0\x7f80\6\a\0\1\0\x6f6c\x6f67n\0\xffe0\xffff\x6b76\4,\0\x8190\6\a\0\1\0\x6f70\x7472\0\0\xff98\xffff\x6b6e \x8880\xb5b5\xeb84\x1c4\0\0\x6518\6\2\0\0\0\x4d50\6\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\b\0\0\0\0\0\0\0\0\0\24\0\x654b\x6279\x616f\x6472\x7954\x6570\x4d20\x7061\x6970\x676e\0\0\xffa8\xffff\x6b6e \x3cb0\x3c26\x538c\x1c2\0\0\x75f0\6\0\0\0\0\xffff\xffff\xffff\xffff\17\0\x7a38\6\x1e8\0\xffff\xffff\0\0\0\0\30\0\32\0\0\0\3\0\x504aN\0\0\xffe0\xffffkbdax2.dll\0\0\0\0\xffe0\xffff\x6b76\b\26\0\x76f0\6\1\0\1\0\x3030\x3030\x3030\x3230\xffe0\xffffkbd106.dll\0\0\0\0\xffe0\xffff\x6b76\b\32\0\x7730\6\1\0\1\0\x3030\x3030\x3030\x3330\xffe0\xffffkbdibm02.dll\0\0\xffe0\xffff\x6b76\b\32\0\x7770\6\1\0\1\0\x3030\x3130\x4430\x3130\xffe0\xffffkbdnec95.dll\0\0\xffd8\xffff\x6b76\f\32\0\x77b8\6\1\0\1S\x3030\x3030\x3030\x3030\x3030\x3731tr\xffe0\xffffkbdlk41a.dll\0\0\xffe0\xffff\x6b76\b\32\0\x78b0\6\1\0\1\17\x3030\x3030\x4430\x3130\xffd8\xffff\x6b76\f\32\0\x7820\6\1\0\1C\x3030\x3030\x3030\x3230\x3030\x3531\P\xffe0\xffffkbdnecAT.dll\0y\xffd8\xffff\x6b76\f\32\0\x7868\6\1\0\1t\x3030\x3030\x3030\x3230\x3030\x3731lS\xffe0\xffffkbdlk41j.dll\0t\xffe0\xffff\x6b76\b\30\0\x7940\6\1\0\1\17\x3030\x3130\x3030\x3230\b\0\x87d8\6\xffe0\xffffkbdnecNT.dll\0C\xffe0\xffff\x6b76\b\32\0\x78f0\6\1\0\1e\x3030\x3030\x4430\x3430\xffe0\xffffkbdnecNT.dll\0e\xffe0\xffff\x6b76\b\32\0\x79d8\6\1\0\1\17\x3030\x3230\x3030\x3230\xfff0\xffffrdpwd\0\xffe0\xffffkbd106n.dll\0So\xffe0\xffff\x6b76\b\32\0\x7980\6\1\0\1o\x3030\x3130\x4430\x3430\xffe0\xffffkbdnec95.dll\0f\xffe0\xffff\x6b76\b\32\0\x7a78\6\1\0\1\17\x3030\x3230\x4430\x3430\xffe8\xffff\x75b0\6\x75d0\6\x81c0\6\x8210\6\x8ce0\6\xffe0\xfffff3ahvoas.dll\0y\xffe0\xffff\x6b76\b\32\0\x7a18\6\1\0\1t\x3030\x3230\x4430\x3130\xffe0\xffffkbdnecAT.dll\0C\xffc0\xffff\x7170\6\x7298\6\x76d0\6\x7710\6\x7750\6\x7790\6\x77f8\6\x7840\6\x77d8\6\x78d0\6\x7888\6\x7960\6\x7910\6\x79f8\6\x79a0\6\xffe0\xffffkbdnecAT.dll\0r\xffa8\xffff\x6b6e \xb580\x3c24\x538c\x1c2\0\0\x75f0\6\0\0\0\0\xffff\xffff\xffff\xffff\4\0\x6e28\6\x1e8\0\xffff\xffff\0\0\0\0\20\0\30\0\0\0\3\0\x4f4bR\0\0\xffe0\xffff\x6b76\b\30\0\x7b10\6\1\0\1\0\x3030\x3030\x3030\x3330\xffe0\xffffkbd101a.dll\0\0\0\xffe0\xffff\x6b76\b\30\0\x7b50\6\1\0\1\0\x3030\x3030\x3030\x3430\xffe0\xffffkbd101b.dll\0\0\0\xffe0\xffff\x6b76\b\30\0\x7b90\6\1\0\1\0\x3030\x3030\x3030\x3530\xffe0\xffffkbd101c.dll\0\0\0\xffe0\xffff\x6b76\b\26\0\x7bd0\6\1\0\1\0\x3030\x3030\x3030\x3630\xffe0\xffffkbd103.dll\0\0\0\0\xffa8\xffff\x6b6e \x67d0\x3c2f\x538c\x1c2\0\0\x6518\6\0\0\0\0\xffff\xffff\xffff\xffff\25\0\x8020\6\x1e8\0\xffff\xffff\0\0\0\0\30\0\4\0\xffff\xffff\b\0\x7953\x5073\x6f72\x7363\xffd8\xffff\x6b76\t\4\x8000\0\0\4\0\1\xffff\x7363\x7372\x2e73\x7865\x165\0\xfc00\xffff\xffe0\xffff\x6b76\b\4\x8000\0\0\4\0\1\xffff\x6d73\x7373\x652e\x6578\xffd8\xffff\x6b76\t\4\x8000\0\0\4\0\1\xffff\x6373\x6572\x2e67\x7865\xff65\xffff\xffff\xffff\xffd8\xffff\x6b76\t\4\x8000\0\0\4\0\1\xffff\x736c\x7361\x2e73\x7865\xff65\xffff\xffff\xffff\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\xffff\x7073\x6f6f\x736c\x2e73\x7865\xff65\xffff\xffff\xffd8\xffff\x6b76\f\4\x8000\0\0\4\0\1\xffff\x7645\x6e65\x4c74\x676f\x652e\x6578\xffff\xffff\xffe0\xffff\x6b76\a\4\x8000\0\0\4\0\1\20\x6977\x2e6e\x6f63m\xffd8\xffff\x6b76\n\4\x8000\0\0\4\0\1\xffff\x656e\x6474\x6564\x652e\x6578\xffff\xffff\xffff\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\xffff\x6c63\x7069\x7273\x2e76\x7865\xff65\xffff\xffff\xffd8\xffff\x6b76\f\4\x8000\0\0\4\0\1\20\x6977\x6c6e\x676f\x6e6f\x652e\x6578\xb28\20\xffd8\xffff\x6b76\n\4\x8000\0\0\4\0\1\xffff\x6d6c\x7673\x7363\x652e\x6578\xffff\xffff\xffff\xffd8\xffff\x6b76\n\4\x8000\0\0\4\0\1\xffff\x734d\x5367\x6376\x652e\x6578\xffff\xffff\xffff\xffd8\xffff\x6b76\f\4\x8000\0\0\4\0\1\20\x646e\x6564\x6761\x746e\x652e\x6578\xb28\20\b\0\x8da0\6\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\xffff\x454e\x5354\x5254\x2e53\x5845\xff45\xffff\xffff\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\20\x6677\x6873\x6c65\x2e6c\x7865e\xb28\20\xfff0\xffff\x87d0\6\x8820\6\x8e18\6\xffd8\xffff\x6b76\n\4\x8000\0\0\4\0\1\xffff\x736f\x7332\x7672\x652e\x6578\xffff\xffff\xffff\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\20\x6472\x6370\x696c\x2e70\x7865e\xb28\20\xffd8\xffff\x6b76\f\4\x8000\0\0\4\0\1\20\x6d69\x7065\x6461\x7673\x652e\x6578\xb78\20\xffd8\xffff\x6b76\n\4\x8000\0\0\4\0\1\20\x7463\x6d66\x6e6f\x652e\x6578\20\xb28\20\xfff0\xffffRDP\0\xc30\20\xffd8\xffff\x6b76\n\4\x8000\0\0\4\0\1\xffff\x6f63\x696e\x656d\x652e\x6578\xffff\xffff\xffff\xffc8\xffff0\0001\0LOGON\0chglogon.exe\0\0\0\0\xffe8\xffff\x82c0\6\x8328\6\x8380\6\x83d8\6\x8428\6\xffd8\xffff\x6b76\f\4\x8000\0\0\4\0\1\20\x7270\x716f\x6f75\x6174\x652e\x6578\x9d8\20\b\0\0\0\x6268\x6e69\x8000\6\x1000\0\0\0\0\0\0\0\0\0\0\0\xffa8\xffff\x7c48\6\x7c70\6\x7c90\6\x7cb8\6\x7ce0\6\x7d08\6\x7d50\6\x7d78\6\x7dc8\6\x7df0\6\x7da0\6\x7e48\6\x7e18\6\x7ea8\6\x7e70\6\x7d30\6\x7ed0\6\x7f58\6\x7fd0\6\x7ef8\6\x7f20\6\xffa0\xffff\x6b6e \x8880\xb5b5\xeb84\x1c4\0\0\x6518\6\3\0\0\0\x85a0\6\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\16\0\0\0\0\0\0\0\b\0\t\0\x7455\x6c69\x7469\x6569s\0\0\0\xffd8\xffff\x6b76\v\xb8\0\x8338\36\3\0\1\x5d78\x6543\x7472\x6669\x6369\x7461e\x7762\1\xfff0\xffff\x3978\20\x80d8\6\xcda7\x7f0a\xffd8\xffff\x6b76\t\b\0\x1f78\20\3\0\1\x9d5\x6f4c\x6f67\x546e\x6d69\xa365\6\xb143\xdb60\xffa8\xffff\x6b6e \xb580\x3c24\x538c\x1c2\0\0\x8078\6\0\0\0\0\xffff\xffff\xffff\xffff\4\0\x79c0\6\x1e8\0\xffff\xffff\0\0\0\0\f\0002\0\0\0\6\0\x6863\x6e61\x6567\0\xffd0\xffff0\0001\0PORT\0chgport.exe\0\0\xffe0\xffff\x6b76\4*\0\x81e0\6\a\0\1\0\x7375\x7265\0\0\xffd0\xffff0\0001\0USER\0chgusr.exe\0\0\0\xffe0\xffff\x6b76\0062\0\x8230\6\a\0\1\0\x6977\x736e\x6174\0\xffc8\xffff1\0001\0WINSTA\0chglogon.exe\0\0\0\xffa8\xffff\x6b6e \xb580\x3c24\x538c\x1c2\0\0\x8078\6\0\0\0\0\xffff\xffff\xffff\xffff\5\0\x7fb8\6\x1e8\0\xffff\xffff\0\0\0\0\22\08\0\1\0\5\0\x7571\x7265y\0\xffd8\xffff\x6b76\t8\0\x82e8\6\a\0\1\0\x7061\x7370\x7265\x6576r\0\0\0\xffc0\xffff0\0002\0TERMSERVER\0qappsrv.exe\0\0\0\0\xffe0\xffff\x6b76\a4\0\x8348\6\a\0\1\0\x7270\x636f\x7365s\xffc8\xffff0\0001\0PROCESS\0qprocess.exe\0\0\xffe0\xffff\x6b76\a2\0\x83a0\6\a\0\1\0\x6573\x7373\x6f69n\xffc8\xffff0\0001\0SESSION\0qwinsta.exe\0\0\0\xffe0\xffff\x6b76\4(\0\x83f8\6\a\0\1\0\x7375\x7265\0\0\xffd0\xffff0\0001\0USER\0quser.exe\0\0\0\0\xffe0\xffff\x6b76\0060\0\x8448\6\a\0\1\0\x6977\x736e\x6174\0\xffc8\xffff1\0001\0WINSTA\0qwinsta.exe\0\0\0\0\xffe8\xffff\x686c\1\x9078\6\xcb33\1\xa078\6\xcb33\1\xffa8\xffff\x6b6e \xb580\x3c24\x538c\x1c2\0\0\x8078\6\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x6938\6\x1e8\0\xffff\xffff\0\0\0\0\16\0002\0\2\0\5\0\x6572\x6573t\0\xffe0\xffff\x6b76\a2\0\x8510\6\a\0\1\0\x6573\x7373\x6f69n\xffc8\xffff0\0001\0SESSION\0rwinsta.exe\0\0\0\xffe0\xffff\x6b76\0060\0\x8568\6\a\0\1\0\x6977\x736e\x6174\0\xffc8\xffff1\0001\0WINSTA\0rwinsta.exe\0\0\0\0\xffd8\xffff\x686c\3\x8138\6\xf24a\x1d2b\x8268\6\x93d2\x94f\x8498\6\x17eb\x960\x9498\6\x17eb\x960\xffa8\xffff\x6b6e \x8880\xb5b5\xeb84\x1c4\0\0\x6518\6\2\0\0\0\xf620*\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\f\0\0\0\0\0\0\0\t\0\5\0\x4956\x4544O0\xffa8\xffff\x6b6e \x8940\xea4\x5327\x1c2\0\0\x85c8\6\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x7080\6\x1e8\0\xffff\xffff\0\0\0\0\34\0\x84\0\0\0\4\0\x6964\x6373\C\xffd8\xffff\x6b76\r\36\0\x86a0\6\1\0\1 \x6756\x4361\x6d6f\x6170\x6974\x6c62e,\xffd8\xffff\Device\Video0\0,a0\xffd8\xffff\x6b76\16\x84\0\x86f0\6\1\0\1n\x445c\x7665\x6369\x5c65\x6956\x6564\x306f\x808b\xff78\xffff\REGISTRY\Machine\System\CurrentControlSet\Services\TSDDD\Device0\0\xffa8\xffff\x6b6e \xd240\x3c2a\x538c\x1c2\0\0\x85c8\6\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x7e98\6\x1e8\0\xffff\xffff\0\0\0\0\34\0\x84\0\1\0\5\0\x6472\x6470\x9164\x43e0\xffd8\xffff\x6b76\r\36\0\x87f8\6\1\0\1C\x6756\x4361\x6d6f\x6170\x6974\x6c62\xaa65\x6878\xffd8\xffff\Device\Video0\0\4\x6dde\x6bd0\xffd8\xffff\x6b76\16\x84\0\x8848\6\1\0\1\xd17b\x445c\x7665\x6369\x5c65\x6956\x6564\x306f\x5f16\xff78\xffff\REGISTRY\Machine\System\CurrentControlSet\Services\RDPDD\Device0\0\xffa8\xffff\x6b6e \x8880\xb5b5\xeb84\x1c4\0\0\x6518\6\1\0\0\0\x4f40\6\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\f\0\0\0\0\0\0\0\n\0\3\0\x6457s\0\0\xffa8\xffff\x6b6e \x8880\xb5b5\xeb84\x1c4\0\0\x88d0\6\1\0\0\0\x70f0\6\xffff\xffff&\0\x9148\6\x1e8\0\xffff\xffff\b\0\0\0,\0$\0\0\0\5\0\x6472\x7770\xff64\xffff\xffe0\xffff\x6b76\b\4\x8000\xe100\0\4\0\1\20\x6142\x6475\x6152\x6574\xffe0\xffff\x6b76\b\4\x8000\b\0\4\0\1\xffff\x7942\x6574\x6953\x657a\xffe0\xffff\x6b76\6\32\0\x89e0\6\1\0\1\xffff\x6643\x4467\x6c6c\xffff\xffe0\xffffRDPCFGEX.DLL\0\xffff\xffd8\xffff\x6b76\v\4\x8000\1\0\4\0\1\xffff\x6f43\x6e6e\x6365\x5474\x7079\xff65\xffff\xffff\xffe8\xffffrdpclip\0\xec0\20\xffd8\xffff\x6b76\n\4\x8000\1\0\4\0\1\xffff\x6f43\x6f6c\x4472\x7065\x6874\xffff\xffff\xffff\xffd8\xffff\x6b76\n\2\x8000\0\0\1\0\1\xffff\x6544\x6976\x6563\x614e\x656d\xffff\xffff\x2cff\xffe0\xffff\x6b76\b\4\x8000\1\0\4\0\1\20\x6c46\x776f\x7954\x6570\xffd8\xffff\x6b76\16\4\x8000\1\0\4\0\1\0\x6c46\x776f\x6148\x6472\x6177\x6572\x7852\xffff\xffd8\xffff\x6b76\16\4\x8000\1\0\4\0\1\xffff\x6c46\x776f\x6148\x6472\x6177\x6572\x7854\0\xffe0\xffff\x6b76\6\4\x8000\0\0\4\0\1\20\x6150\x6972\x7974\20\b\0\x9a90\6\xffd0\xffff\x6b76\21\4\x8000\x800\0\4\0\1\0\x6e49\x7570\x4274\x6675\x6566\x4c72\x6e65\x7467h\0\0\0\xffd8\xffff\x6b76\17\20\0\x8a28\6\1\0\1\0\x7453\x7261\x7574\x5070\x6f72\x7267\x6d61s\b\0\x9b88\6\xffd0\xffff\x6b76\22\4\x8000\2\0\4\0\1\0\x694d\x456e\x636e\x7972\x7470\x6f69\x4c6e\x7665\x6c65ess\xffe0\xffff\x6b76\5\f\0\x7930\6\1\0\1\20\x6457\x4c44\xf4c\20\xffe8\xffffrdpwsx\0\20\xfd8\20\xffe0\xffff\x6b76\b\4\x8000\0\0\4\0\1\20\x7453\x706f\x6942\x7374\xffe0\xffff\x6b76\6$\0\x8cb8\6\1\0\1\20\x6457\x614e\x656d\20\xffe0\xffff\x6b76\b\b\0\x7f48\6\1\0\1\0\x6457\x7250\x6665\x7869\xffe0\xffff\x6b76\6\4\x80006\0\4\0\1r\x6457\x6c46\x6761a\xffe0\xffff\x6b76\6\16\0\x8bd8\6\1\0\1\20\x7357\x4478\x4c4c\20\xffe0\xffff\x6b76\b\4\x8000\23\0\4\0\1M\x6f58\x6666\x6843\x7261\b\0\x9c10\6\xffd8\xffffMicrosoft RDP 5.1\0\xffe0\xffff\x6b76\a\4\x8000\21\0\4\0\1\20\x6f58\x436e\x6168r\xffd0\xffff\x6b76\21\4\x8000\1\0\4\0\1\20\x4166\x7475\x436f\x696c\x6e65\x4474\x6972\x6576\x1173\20\x1118\20\xffd8\xffff\x6b76\17\4\x8000\1\0\4\0\1\20\x4166\x7475\x436f\x696c\x6e65\x4c74\x7470s\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\20\x4466\x7369\x6261\x656c\x6343m\x1118\20\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\20\x4466\x7369\x6261\x656c\x6443m\xf30\20\xffd8\xffff\x6b76\f\4\x8000\0\0\4\0\1\20\x4466\x7369\x6261\x656c\x6c43\x7069\x10a0\20\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\20\x4466\x7369\x6261\x656c\x7043m\xe58\20\xffd0\xffff\x6b76\22\4\x8000\1\0\4\0\1\20\x4466\x7369\x6261\x656c\x6e45\x7263\x7079\x6974\x6e6f\20\x1080\20\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\20\x4466\x7369\x6261\x656c\x504cT\x1240\20\xffd0\xffff\x6b76\26\4\x8000\0\0\4\0\1\20\x4566\x616e\x6c62\x4265\x6572\x6b61\x6944\x6373\x6e6f\x656e\x7463\20\xffd0\xffff\x6b76\25\4\x8000\0\0\4\0\1\20\x4566\x616e\x6c62\x4465\x7273\x6553\x736e\x7469\x7669\x7469\xe79\20\xffd0\xffff\x6b76\22\4\x8000\1\0\4\0\1\20\x4666\x726f\x6563\x6c43\x6569\x746e\x704c\x4474\x6665\20\x1180\20\xffd0\xffff\x6b76\22\4\x8000\1\0\4\0\1\20\x4966\x686e\x7265\x7469\x7541\x6f74\x6c43\x6569\x746e\20\x1050\20\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\20\x4466\x7369\x6261\x656c\x6143m\x38c8\20\xffd8\xffff\x6b76\n\4\x8000\1\0\4\0\1\20\x4566\x616e\x6c62\x5265\x5354\20\x1080\20\xffd8\xffff\x6b76\17\4\x8000\1\0\4\0\1\20\x4666\x6f6c\x5377\x666f\x7774\x7261\x5265x\xffd8\xffff\x6b76\17\4\x8000\1\0\4\0\1\20\x4666\x6f6c\x5377\x666f\x7774\x7261\x5465x\b\0\x9fb8\6\xffd8\xffff\x6b76\n\4\x8000\1\0\4\0\1\20\x4566\x616e\x6c62\x4465\x5254\20\x1180\20\xffe8\xffff\x686c\1\x9e38\6\xc0a6\1\xae38\6\xc0a6\1\b\0\xcb5b\1\x6268\x6e69\x9000\6\x1000\0\0\0\0\0\0\0\0\0\0\0\xffa8\xffff\x6b6e \x8880\xb5b5\xeb84\x1c4\0\0\x8928\6\1\0\0\0\x8480\6\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\b\0\0\0\0\0\0\0\x1310\20\3\0\x6454s\x1398\20\xffa8\xffff\x6b6e \xef00\x3c30\x538c\x1c2\0\0\x9020\6\0\0\0\0\xffff\xffff\xffff\xffff\n\0\x9350\6\x1e8\0\xffff\xffff\0\0\0\0 \0\f\0on\3\0\x6374p M\xffd8\xffff\x6b76\20\4\x8000\n\0\4\0\1a\x6e49\x6574\x6172\x7463\x7669\x4465\x6c65\x7961\xffd8\xffff\x6b76\v\4\x8000\6\0\4\0\1\0\x754f\x4274\x6675\x6f43\x6e75tvr\xfff0\xfffftdtcp\0\xfff0\xfffftcp\0\x1610\20\b\0\xa238\6\xff60\xffff\x8980\6\x89a0\6\x89c0\6\x8a00\6\x8a40\6\x8a68\6\x8ab0\6\x8ad8\6\x8a90\6\x8b28\6\x8b88\6\x8b00\6\x8b58\6\x8bf0\6\x8bb8\6\x8c50\6\x8c10\6\x8c30\6\x8c70\6\x8c90\6\x8ce0\6\x8d00\6\x8d30\6\x8d58\6\x8d80\6\x8da8\6\x8dd0\6\x8df8\6\x8e28\6\x8e50\6\x8fb8\6\x8e80\6\x8f38\6\x8f60\6\x8f88\6\x8eb0\6\x8ee0\6\x8f10\6\0\0\xffd8\xffff\x6b76\v\4\x8000d\0\4\0\1S\x754f\x4274\x6675\x6544\x616cy28\xffd8\xffff\x6b76\f\4\x8000\x212\0\4\0\0011\x754f\x4274\x6675\x654c\x676e\x6874l1\xffe0\xffff\x6b76\a\4\x8000\2\0\4\0\1a\x6450\x6c43\x7361s\xffe0\xffff\x6b76\5\f\0\x9120\6\1\0\1a\x6450\x4c44Li\xfff0\xfffftcpip\0\xfff0\xffff\xfe58\36\xfe78\36\xcb33\1\xffe0\xffff\x6b76\6\4\x8000N\0\4\0\1o\x6450\x6c46\x6761n\xffe0\xffff\x6b76\6\b\0\x9130\6\1\0\1f\x6450\x614e\x656de\xffd8\xffff\x6b76\17\xc4\0\x93e0\6\3\0\1\0\x6544\x6166\x6c75\x5374\x6365\x7275\x7469\x279\xffd8\xffff\x6b76\n\4\x8000\xd3d\0\4\0\1A\x6f50\x7472\x754e\x626d\x7265id3\xffd8\xffff\x6b76\v\f\0\x9278\6\1\0\1\0\x6553\x7672\x6369\x4e65\x6d61eLs\xffd0\xffff\x90d0\6\x90f8\6\x91e8\6\x9210\6\x9238\6\x9258\6\x9298\6\x92b8\6\x9300\6\x9328\6\0\0\xffa0\xffff\x6b6e \x8880\xb5b5\xeb84\x1c4\0\0\x6518\6\2\0\0\0\x8ef0.\xffff\xffff\2\0\x9598\6\x1e8\0\xffff\xffff\20\0\0\0\36\0\xc4\0or\v\0\x6957\x536e\x6174\x6974\x6e6fstf\xff38\xffff\1\x8014\xac\0\xb8\0\0\0\24\0\2\x98\6\0\0$\x3bf\17\x501\0\0\x500\25\0\xcd49\x4a5e\x3e04\xebf5\xc7db\x3958\x3ef\0\0\30\x3bf\17\x201\0\0\x500 \0\x220\0\0\24\x3bf\17\x101\0\0\x500\22\0\0\30\x1a1\0\x201\0\0\x500 \0\x22b\0\0\24\x81\0\x101\0\0\x500\23\0\0\24\x81\0\x101\0\0\x500\24\0\x101\0\0\x500\22\0\x101\0\0\x500\22\0\xffd8\xffff\x6b76\17\xc4\0\x94d0\6\3\0\1\0\x6f43\x736e\x6c6f\x5365\x6365\x7275\x7469\x679\xff38\xffff\1\x8014\xac\0\xb8\0\0\0\24\0\2\x98\6\0\0$\x3bf\17\x501\0\0\x500\25\0\xcd49\x4a5e\x3e04\xebf5\xc7db\x3958\x3ef\0\0\30\x3bf\17\x201\0\0\x500 \0\x220\0\0\24\x3bf\17\x101\0\0\x500\22\0\0\30\x1a1\0\x201\0\0\x500 \0\x22b\0\0\24\x81\0\x101\0\0\x500\23\0\0\24\x81\0\x101\0\0\x500\24\0\x101\0\0\x500\22\0\x101\0\0\x500\22\0\xfff0\xffff\x92d8\6\x94a8\6\0\0\xffa8\xffff\x6b6e \x8880\xb5b5\xeb84\x1c4\0\0\x9380\6\1\0\0\0\x8fe0\6\xffff\xffff.\0\xa020\6\x1e8\0\xffff\xffff\b\0\0\08\0z\0MR\a\0\x6f43\x736e\x6c6fe\xffd0\xffff\x6b76\22\4\x8000\0\0\4\0\1d\x694d\x456e\x636e\x7972\x7470\x6f69\x4c6e\x7665\x6c65\0LD\xffe0\xffff\x6b76\b\4\x8000\0\0\4\0\1\20\x6143\x6c6c\x6162\x6b63\xfff0\xffffwdcon\0\xffd8\xffff\x6b76\16\2\x8000\0\0\1\0\1l\x6143\x6c6c\x6162\x6b63\x754e\x626d\x7265p\xffe0\xffff\x6b76\a\36\0\x96a8\6\1\0\1\0\x6f43\x6d6d\x6e65t\xffd8\xffffSystem Console\0\0hp\xffe8\xffffconsole\0\x17c0\20\xffe0\xffff\x6b76\6\2\x8000\0\0\1\0\1k\x6f44\x616d\x6e69p\xffd8\xffff\x6b76\16\2\x8000\0\0\1\0\1a\x6e49\x7469\x6169\x506c\x6f72\x7267\x6d61l\xffe0\xffff\x6b76\b\2\x8000\0\0\1\0\1\20\x6150\x7373\x6f77\x6472\xffd0\xffff\x6b76\21\4\x8000\0\0\4\0\1i\x6e49\x7570\x4274\x6675\x6566\x4c72\x6e65\x7467h Li\xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1 \x654b\x6279\x616f\x6472\x614c\x6f79\x7475d\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\20\x614d\x4978\x6c64\x5465\x6d69e\x1930\20\xffd8\xffff\x6b76\fz\0\x97f8\6\1\0\0010\x654b\x6279\x616f\x6472\x614e\x656d2w\xff80\xffff\REGISTRY\Machine\System\CurrentControlSet\Services\Kbdclass\0b\xffd0\xffff\x6b76\21\4\x8000\0\0\4\0\1a\x614d\x4378\x6e6f\x656e\x7463\x6f69\x546e\x6d69e550\xffd8\xffff\x6b76\tz\0\x9940\6\1\0\1\20\x6f4d\x7375\x4e65\x6d61\x1865\20\x1930\20\b\0\xa8d8\6\xffd0\xffff\x6b76\24\4\x8000\0\0\4\0\1h\x614d\x4478\x7369\x6f63\x6e6e\x6365\x6974\x6e6f\x6954\x656d\0a\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\20\x754f\x4274\x6675\x6544\x616cy\x1930\20\xfff0\xffff\xb6d0\6\xb740\6\xb768\6\xff80\xffff\REGISTRY\Machine\System\CurrentControlSet\Services\Mouclass\0\0\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1p\x754f\x4274\x6675\x6f43\x6e75tac\xffe0\xffff\x6b76\a\4\x8000\1\0\4\0\1\20\x6450\x6c43\x7361s\xffe0\xffff\x6b76\5\2\x8000\0\0\1\0\1\20\x6450\x6c44\x1a6c\20\xffd8\xffff\x6b76\f\4\x8000\0\0\4\0\1\0\x754f\x4274\x6675\x654c\x676e\x6874\0\0\xffe0\xffff\x6b76\6\4\x8000\36\0\4\0\1\20\x6450\x6c46\x6761\20\xffe0\xffff\x6b76\6\20\0\x96d0\6\1\0\1\20\x6450\x614e\x656d\20\xffe0\xffff\x6b76\b\2\x8000\0\0\1\0\1\20\x7355\x7265\x614e\x656d\xffe0\xffff\x6b76\5\f\0\x9650\6\1\0\1\20\x6457\x6c44\x1a6c\20\xffe0\xffff\x6b76\6\4\x8000$\0\4\0\1\20\x6457\x6c46\x6761\20\xffe0\xffff\x6b76\6\20\0\x9b10\6\1\0\1\20\x6457\x614e\x656d\20\xffe8\xffffConsole\0\x17c0\20\xffd8\xffff\x6b76\r\2\x8000\0\0\1\0\1\20\x6f57\x6b72\x6944\x6572\x7463\x726f\x1a79\20\xffd0\xffff\x6b76\21\4\x8000\0\0\4\0\1\20\x4966\x686e\x7265\x7469\x7541\x6f74\x6f4c\x6f67n\0\xb738\17\xffd8\xffff\x6b76\20\4\x8000\0\0\4\0\1\20\x4966\x686e\x7265\x7469\x6143\x6c6c\x6162\x6b63\xffd0\xffff\x6b76\26\4\x8000\0\0\4\0\1\20\x4966\x686e\x7265\x7469\x6143\x6c6c\x6162\x6b63\x754e\x626d\x7265\20\xffd0\xffff\x6b76\26\4\x8000\0\0\4\0\1\20\x4966\x686e\x7265\x7469\x6e49\x7469\x6169\x506c\x6f72\x7267\x6d61\20\xffc8\xffff\x6b76\34\4\x8000\0\0\4\0\1\20\x4966\x686e\x7265\x7469\x614d\x4478\x7369\x6f63\x6e6e\x6365\x6974\x6e6f\x6954\x656d\x4c68\20\xffd0\xffff\x6b76\23\4\x8000\0\0\4\0\1\17\x4966\x686e\x7265\x7469\x614d\x4978\x6c64\x5465\x6d69e\x18b0\20\xffd0\xffff\x6b76\26\4\x8000\0\0\4\0\1\0\x4966\x686e\x7265\x7469\x614d\x5378\x7365\x6973\x6e6f\x6954\x656d\0\xffd0\xffff\x6b76\25\4\x8000\0\0\4\0\1\0\x4966\x686e\x7265\x7469\x6552\x6f63\x6e6e\x6365\x5374\x6d61e\0\xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1\20\x4c66\x676f\x6e6f\x6944\x6173\x6c62\x6465\20\xffd0\xffff\x6b76\22\4\x8000\1\0\4\0\1\20\x5066\x6f72\x706d\x4674\x726f\x6150\x7373\x6f77\x6472\20\x4cb8\20\xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1\20\x5266\x6365\x6e6f\x656e\x7463\x6153\x656d\20\xfff0\xfffftdtcp\0\xffd0\xffff\x6b76\23\4\x8000\0\0\4\0\1\20\x4966\x686e\x7265\x7469\x6552\x6573\x4274\x6f72\x656bn\x4cb8\20\xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1\20\x4966\x686e\x7265\x7469\x6853\x6461\x776f\20\xffd8\xffff\x6b76\f\4\x8000\0\0\4\0\1\20\x5266\x7365\x7465\x7242\x6b6f\x6e65\x1ae8\20\xffd8\xffff\x6b76\v\4\x8000\f\0\4\0\1\20\x7254\x6361\x4565\x616e\x6c62e\x4d70\20\xffd0\xffff\x6b76\21\4\x8000\1\0\4\0\1\20\x4566\x616e\x6c62\x5765\x6e69\x7453\x7461\x6f69\x196e\20\x1a38\20\xffa8\xffff\x6b6e \xd240\x3c2a\x538c\x1c2\0\0\x95a8\6\0\0\0\0\xffff\xffff\xffff\xffff\20\0\xa2f8\6\x1e8\0\xffff\xffff\0\0\0\0 \0$\0x\0\3\0\x4452P8u\xffd8\xffff\x6b76\n\4\x8000\t\x1000\4\0\1\20\x7254\x6361\x4365\x616c\x7373\20\x1930\20\xffd8\xffff\x6b76\r\4\x8000\1\0\4\0\1\20\x7254\x6361\x4465\x6265\x6775\x6567\x1a72\20\xffe0\xffff\x6b76\5\2\x8000\0\0\1\0\18\x6443\x4c44L\0\xffe0\xffff\x6b76\6\4\x8000\0\0\4\0\1\0\x6443\x6c46\x6761\0\xffe0\xffff\x6b76\6\2\x8000\0\0\1\0\1\0\x6443\x614e\x656d\0\xfff0\xfffftcp\0\xfd58\17\b\0\xaf58\6\xffe0\xffff\x6b76\6\32\0\x9f78\6\1\0\1r\x6643\x4467\x6c6ct\xffe0\xffffRDPCFGEX.DLL\0r\xffd8\xffff\x6b76\17\4\x8000\0\0\4\0\1\20\x5566\x6573\x6544\x6166\x6c75\x4774\x6e69a\xffe0\xffff\x6b76\6\4\x8000\1\0\4\0\1\20\x6853\x6461\x776f\20\xffe0\xffff\x6b76\a\4\x8000\0\0\4\0\1a\x6443\x6c43\x7361s\x6268\x6e69\xa000\6\x1000\0\0\0\0\0\0\0\0\0\0\0\xff40\xffff\x9600\6\x9630\6\x9660\6\x9688\6\x96e8\6\x9708\6\x9750\6\x9780\6\x97d0\6\x9878\6\x98d8\6\x97a8\6\x98a8\6\x99c0\6\x9908\6\x9a28\6\x9730\6\x99e8\6\x9a08\6\x9a50\6\x9a70\6\x9a90\6\x9ab0\6\x9ad0\6\x9af0\6\x9b28\6\x9b50\6\x9b80\6\x9ba8\6\x9bd8\6\x9c08\6\x9c40\6\x9c70\6\x9ca0\6\x9d60\6\x9d90\6\x9cd0\6\x9cf8\6\x9d28\6\x9db8\6\x9f98\6\x9fc0\6\x9e90\6\x9eb8\6\x9de0\6\x9e08\6\0\0\xffd8\xffff\x6b76\20\4\x80002\0\4\0\1p\x6e49\x6574\x6172\x7463\x7669\x4465\x6c65\x7961\xffe0\xffff\x6b76\5\f\0\x9d50\6\1\0\1\20\x6450\x4c44\xba4c\17\xffd8\xffff\x6b76\v\4\x8000d\0\4\0\1\17\x754f\x4274\x6675\x6544\x616cy \20\xffe0\xffff\x6b76\a\4\x8000\2\0\4\0\1r\x6450\x6c43\x7361s\xffe0\xffff\x6b76\6\b\0\x9f40\6\1\0\1\20\x6450\x614e\x656d\17\xfff8\xffff\xb418\6\xffe0\xffff\x6b76\6\4\x8000N\0\4\0\1t\x6450\x6c46\x6761S\xffe0\xffff\x6b76\6\4\x80004\0\4\0\1\20\x6457\x6c46\x6761\17\xfff0\xffffRDP\0\xc8\20\xffe0\xffff\x6b76\5\f\0\xa208\6\1\0\1e\x6457\x4c44Lu\xfff0\xffffrdpwd\0\xffe0\xffff\x6b76\b\b\0\xa1d8\6\1\0\1\20\x6457\x7250\x6665\x7869\xffe8\xffffrdpwsx\0\20\x110\20\xffe0\xffff\x6b76\6$\0\xa270\6\1\0\1a\x6457\x614e\x656dM\xffd8\xffffMicrosoft RDP 5.1\0\xfff0\xffff\0\xa28\1\5\xc0a6\1\xffe0\xffff\x6b76\6\32\0\xa398\6\1\0\1\20\x6643\x4467\x6c6c\20\xfff0\xfffftdtcp\0\xffe0\xffff\x6b76\6\16\0\xa238\6\1\0\1o\x7357\x4478\x4c4cy\xffb8\xffff\x9fe0\6\x9ee0\6\x9f00\6\x9f20\6\x9f58\6\xa0e0\6\xa128\6\xa150\6\xa108\6\xa198\6\xa170\6\xa1e8\6\xa1b8\6\xa250\6\xa218\6\xa2d8\6\0\0\xffa8\xffff\x6b6e \x8490\x3c35\x538c\x1c2\0\0\x9380\6\0\0\0\0\xffff\xffff\xffff\xffffJ\0\xb020\6\x1e8\0\xffff\xffff\0\0\0\08\0$\0nt\a\0\x4452\x2d50\x6354p\xffe0\xffffRDPCFGEX.DLL\0u\xffd0\xffff\x6b76\21\4\x8000\1\0\4\0\1l\x4566\x616e\x6c62\x5765\x6e69\x7453\x7461\x6f69n\0mr\xffd8\xffff\x6b76\20\4\x8000\xffff\xffff\4\0\1l\x614d\x4978\x736e\x6174\x636e\x4365\x756f\x746e\xffe0\xffff\x6b76\6\b\0\xa430\6\1\0\1M\x6450\x614e\x656dD\xfff0\xfffftcp\0fd\xffe8\xffffrdpwsx\0\20\x37e8\20\xffe0\xffff\x6b76\a\4\x8000\2\0\4\0\1p\x6450\x6c43\x7361s\xffe0\xffff\x6b76\5\f\0\xa2c8\6\1\0\19\x6450\x4c44L\0\xffe0\xffff\x6b76\6$\0\xa5d0\6\1\0\1\20\x6457\x614e\x656d\20\xffe0\xffff\x6b76\6\4\x8000N\0\4\0\1y\x6450\x6c46\x6761k\xffd8\xffff\x6b76\f\4\x8000\x212\0\4\0\1a\x754f\x4274\x6675\x654c\x676e\x6874ev\xffd8\xffff\x6b76\20\4\x80002\0\4\0\1\20\x6e49\x6574\x6172\x7463\x7669\x4465\x6c65\x7961\xffd8\xffff\x6b76\v\4\x8000\6\0\4\0\1i\x754f\x4274\x6675\x6f43\x6e75tte\xffd8\xffff\x6b76\v\4\x8000d\0\4\0\1k\x754f\x4274\x6675\x6544\x616cyie\xffd8\xffff\x6b76\20\4\x8000\0\0\4\0\1\20\x654b\x7065\x6c41\x7669\x5465\x6d69\x6f65\x7475\xfff8\xffff\xb808\6\xffd8\xffff\x6b76\n\4\x8000\xd3d\0\4\0\0010\x6f50\x7472\x754e\x626d\x7265c2w\xffd8\xffffMicrosoft RDP 5.1\0\xfff0\xffffrdpwd\0\xffd8\xffff\x6b76\n\4\x8000\0\0\4\0\1d\x614c\x416e\x6164\x7470\x7265\0cd\xffe0\xffff\x6b76\6\16\0\xa440\6\1\0\1\20\x7357\x4478\x4c4c\20\xffe0\xffff\x6b76\6\4\x80006\0\4\0\1\20\x6457\x6c46\x6761\20\xffe0\xffff\x6b76\5\f\0\xa5f8\6\1\0\1c\x6457\x4c44L0\xffd0\xffff\x6b76\21\4\x8000\x800\0\4\0\1\20\x6e49\x7570\x4274\x6675\x6566\x4c72\x6e65\x7467\x3868\20\x38a0\20\xffe0\xffff\x6b76\6\2\x8000\0\0\1\0\1\20\x6443\x614e\x656d\20\xffe0\xffff\x6b76\5\2\x8000\0\0\1\0\1\20\x6443\x4c44\x384c\20\xffe0\xffff\x6b76\6\4\x8000\0\0\4\0\1\20\x6443\x6c46\x6761\20\xfff8\xffff\xbb10\6\xffe0\xffff\x6b76\a\4\x8000\0\0\4\0\1c\x6443\x6c43\x7361s\xffe0\xffff\x6b76\a\2\x8000\0\0\1\0\1\20\x6f43\x6d6d\x6e65t\xffd0\xffff\x6b76\21\4\x8000\1\0\4\0\1\20\x4966\x686e\x7265\x7469\x7541\x6f74\x6f4c\x6f67\x396e\20\x3a30\20\xffd0\xffff\x6b76\23\4\x8000\1\0\4\0\1\20\x4966\x686e\x7265\x7469\x6552\x6573\x4274\x6f72\x656bn\x38c8\20\xffd0\xffff\x6b76\25\4\x8000\1\0\4\0\1\20\x4966\x686e\x7265\x7469\x6552\x6f63\x6e6e\x6365\x5374\x6d61\x3a65\20\xffd0\xffff\x6b76\26\4\x8000\1\0\4\0\1\20\x4966\x686e\x7265\x7469\x6e49\x7469\x6169\x506c\x6f72\x7267\x6d61\20\xffd8\xffff\x6b76\20\4\x8000\0\0\4\0\1\20\x4966\x686e\x7265\x7469\x6143\x6c6c\x6162\x6b63\xffd0\xffff\x6b76\26\4\x8000\1\0\4\0\1\20\x4966\x686e\x7265\x7469\x6143\x6c6c\x6162\x6b63\x754e\x626d\x7265\20\xffd8\xffff\x6b76\16\4\x8000\1\0\4\0\1\20\x4966\x686e\x7265\x7469\x6853\x6461\x776f\20\xffd0\xffff\x6b76\26\4\x8000\1\0\4\0\1\20\x4966\x686e\x7265\x7469\x614d\x5378\x7365\x6973\x6e6f\x6954\x656d\20\xffc8\xffff\x6b76\34\4\x8000\1\0\4\0\1\20\x4966\x686e\x7265\x7469\x614d\x4478\x7369\x6f63\x6e6e\x6365\x6974\x6e6f\x6954\x656d\x3918\20\xffd0\xffff\x6b76\23\4\x8000\1\0\4\0\1\20\x4966\x686e\x7265\x7469\x614d\x4978\x6c64\x5465\x6d69e\x3b08\20\xffd0\xffff\x6b76\22\4\x8000\0\0\4\0\1\20\x4966\x686e\x7265\x7469\x6f43\x6f6c\x4472\x7065\x6874\20\x38a0\20\xffd0\xffff\x6b76\22\4\x8000\0\0\4\0\1\20\x5066\x6f72\x706d\x4674\x726f\x6150\x7373\x6f77\x6472\20\x3aa0\20\xffd8\xffff\x6b76\f\4\x8000\0\0\4\0\1\20\x5266\x7365\x7465\x7242\x6b6f\x6e65\x3c78\20\xfff8\xffff\xbd70\6\xffd0\xffff\x6b76\22\4\x8000\1\0\4\0\1\20\x4966\x686e\x7265\x7469\x7541\x6f74\x6c43\x6569\x746e\20\x38a0\20\xffd8\xffff\x6b76\20\4\x8000\0\0\4\0\1\20\x4966\x686e\x7265\x7469\x6553\x7563\x6972\x7974\xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1\20\x5266\x6365\x6e6f\x656e\x7463\x6153\x656d\20\xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1\0\x4c66\x676f\x6e6f\x6944\x6173\x6c62\x6465\0\xffd0\xffff\x6b76\21\4\x8000\1\0\4\0\1\0\x4166\x7475\x436f\x696c\x6e65\x4474\x6972\x6576s\0\0\0\xffd0\xffff\x6b76\22\4\x8000\1\0\4\0\1\20\x4466\x7369\x6261\x656c\x6e45\x7263\x7079\x6974\x6e6f\20\x38a0\20\xffd0\xffff\x6b76\25\4\x8000\0\0\4\0\1\20\x4866\x6d6f\x4465\x7269\x6365\x6f74\x7972\x614d\x5270\x6f6f\x3a74\20\xffd8\xffff\x6b76\17\4\x8000\0\0\4\0\1\20\x5566\x6573\x6544\x6166\x6c75\x4774\x6e69a\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\20\x4466\x7369\x6261\x656c\x7043m\x3ea0\20\xffd8\xffff\x6b76\17\4\x8000\1\0\4\0\1\20\x4166\x7475\x436f\x696c\x6e65\x4c74\x7470s\xffd0\xffff\x6b76\22\4\x8000\1\0\4\0\1\20\x4666\x726f\x6563\x6c43\x6569\x746e\x704c\x4474\x6665\20\x3ce0\20\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\20\x4466\x7369\x6261\x656c\x6443m\x3858\20\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\20\x4466\x7369\x6261\x656c\x6343m\x39d0\20\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\20\x4466\x7369\x6261\x656c\x7845e\x38c8\20\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\20\x4466\x7369\x6261\x656c\x6143m\x3a30\20\xffe0\xffff\x6b76\b\2\x8000\0\0\1\0\1\20\x7355\x7265\x616e\x656d\xffe0\xffff\x6b76\6\2\x8000\0\0\1\0\1\20\x6f44\x616d\x6e69\20\xffe0\xffff\x6b76\b\2\x8000\0\0\1\0\1\20\x6150\x7373\x6f77\x6472\xffe0\xffff\x6b76\b\4\x8000\0\0\4\0\1\20\x6143\x6c6c\x6162\x6b63\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\20\x4466\x7369\x6261\x656c\x504cT\x3b68\20\xffd8\xffff\x6b76\f\4\x8000\0\0\4\0\1\20\x4466\x7369\x6261\x656c\x6c43\x7069\x3ce0\20\xffd0\xffff\x6b76\24\4\x8000\0\0\4\0\1\20\x614d\x4478\x7369\x6f63\x6e6e\x6365\x6974\x6e6f\x6954\x656d\x38a0\20\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\20\x614d\x4978\x6c64\x5465\x6d69e\x5198\20\xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1\20\x654b\x6279\x616f\x6472\x614c\x6f79\x7475\20\xffd0\xffff\x6b76\22\4\x8000\2\0\4\0\1\20\x694d\x456e\x636e\x7972\x7470\x6f69\x4c6e\x7665\x6c65\20\x38a0\20\xffd8\xffff\x6b76\r\2\x8000\0\0\1\0\1\20\x574e\x6f4c\x6f67\x536e\x7265\x6576\x3a72\20\xfff0\xffffRDP\0\x3fa8\20\b\0\xbe10\6\xffd8\xffff\x6b76\16\2\x8000\0\0\1\0\1\20\x6e49\x7469\x6169\x506c\x6f72\x7267\x6d61\20\xffd8\xffff\x6b76\16\2\x8000\0\0\1\0\1\20\x6143\x6c6c\x6162\x6b63\x754e\x626d\x7265\20\xffd8\xffff\x6b76\r\2\x8000\0\0\1\0\1\20\x4657\x7250\x666f\x6c69\x5065\x7461\x3c68\20\xffe0\xffff\x6b76\b\b\0\xadf8\6\1\0\1\20\x6457\x7250\x6665\x7869\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\20\x7254\x6361\x4565\x616e\x6c62e\x3ef8\20\xffd8\xffff\x6b76\r\4\x8000\0\0\4\0\1\20\x7254\x6361\x4465\x6265\x6775\x6567\x5072\20\xffd8\xffff\x6b76\n\4\x8000\0\0\4\0\1\20\x7254\x6361\x4365\x616c\x7373\20\x3838\20\xffd8\xffff\x6b76\n\4\x8000\3\0\4\0\1\20\x6f43\x6f6c\x4472\x7065\x6874\20\x3b08\20\xfff0\xffffmnmdd\0\xffe0\xffff\x6b76\6\4\x8000\1\0\4\0\1\20\x6853\x6461\x776f\20\xffd0\xffff\x6b76\21\4\x8000\0\0\4\0\1\20\x614d\x4378\x6e6f\x656e\x7463\x6f69\x546e\x6d69\x3e65\20\x3e50\20\xffe8\xffff\x686c\1\x3748\a\x677e\xd66e\x4748\a\x677e\xd66e\xffd8\xffff\x6b76\r\2\x8000\0\0\1\0\1\20\x6f57\x6b72\x6944\x6572\x7463\x726f\x3779\20\xffe8\xffff\0\v\1\2\0\0\0\0003.\x6268\x6e69\xb000\6\x1000\0\0\0\0\0\0\0\0\0\0\0\xfed0\xffff\xa2a8\6\xa3b8\6\xa3e8\6\xa410\6\xa458\6\xa478\6\xa4b8\6\xa4d8\6\xa528\6\xa550\6\xa500\6\xa5a8\6\xa578\6\xa608\6\xa498\6\xa670\6\xa630\6\xa650\6\xa690\6\xa728\6\xa6c0\6\xa6e0\6\xa700\6\xa748\6\xa768\6\xa798\6\xa7c8\6\xa7f8\6\xa828\6\xa850\6\xa880\6\xa8a8\6\xa8d8\6\xa910\6\xa9d0\6\xaa00\6\xa940\6\xa970\6\xa9a0\6\xaa28\6\xaa50\6\xaa78\6\xab58\6\xab80\6\xaaa8\6\xaad8\6\xab08\6\xab30\6\xabb0\6\xabd8\6\xacd0\6\xacf8\6\xac00\6\xac28\6\xac50\6\xac70\6\xac90\6\xafc0\6\xae10\6\xae38\6\xacb0\6\xaf58\6\xaf78\6\xad20\6\xad50\6\xad78\6\xada0\6\xadd0\6\xae60\6\xae88\6\xaea8\6\xaed0\6\xaef8\6\xaf20\6\xb458\6\xff98\xffff\x6b6e \x1828\x583f\x1f0d\x1c8\0\0\x2e8\0\0\0\0\0\xffff\xffff\xffff\xffff\b\0\xb398\6\x1e8\0\xffff\xffff\0\0\0\0004\0.\0004\0\23\0\x6954\x656d\x6f5a\x656e\x6e49\x6f66\x6d72\x7461\x6f69nJo\xffe0\xffff\x6b76\4\4\x8000\x12c\0\4\0\1V\x6942\x7361_0\xffd8\xffff\x6b76\f,\0\xb200\6\1\0\1l\x7453\x6e61\x6164\x6472\x614e\x656d\x6946\x656c\xffc8\xffffEastern Standard Time\0\0003.t\xffd8\xffff\x6b76\f\4\x8000\0\0\4\0\1\0\x7453\x6e61\x6164\x6472\x6942\x7361\x5373\x7075\xffd8\xffff\x6b76\r\20\0\xafe8\6\3\0\1A\x7453\x6e61\x6164\x6472\x7453\x7261to\xffe8\xffff\0\3\2\2\0\0\0\0\x6b60\a\xffd8\xffff\x6b76\f,\0\xb2c8\6\1\0\1s\x6144\x6c79\x6769\x7468\x614e\x656d\0U\xffc8\xffffEastern Daylight Time\0\0trs\xffd8\xffff\x6b76\f\4\x8000\xffc4\xffff\4\0\1n\x6144\x6c79\x6769\x7468\x6942\x7361ti\xffe0\xffffUSB Device\0\0\0\0\xffd8\xffff\x6b76\r\20\0\xb288\6\3\0\1e\x6144\x6c79\x6769\x7468\x7453\x7261tP\xffd8\xffff\x6b76\16\4\x8000\x12c\0\4\0\1e\x6341\x6974\x6576\x6954\x656d\x6942\x7361o\xffd8\xffff\xb1b8\6\xb1d8\6\xb238\6\xb260\6\xb2a0\6\xb300\6\xb348\6\xb370\6\xb970\1\xffa8\xffff\x6b6e \x8940\xea4\x5327\x1c2\0\0\x2e8\0\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xa190\6\x1e8\0\xffff\xffff\0\0\0\0\24\0\4\0005\0\6\0\x7055\x6164\x6574,\xffd8\xffff\x6b76\n\4\x8000\1\0\4\0\1\xc827\x7055\x6164\x6574\x6f4d\x6564\0\x4c19\xb8fd\xffa8\xffff\x6b6e \xd2ee\x8cbd\xbbf\x1c8\0\0\x2e8\0\t\0\0\0\x2708$\xffff\xffff\4\0\xb590\6\x1e8\0\xffff\xffff\32\0\0\0>\0*\0006\0\b\0\x7355\x4662\x616c\x7367\xffd0\xffff\x6b76\26\1\x8000\1\0\3\0\1\0\x6749\x6f6e\x6572\x5748\x6553\x4e72\x6d75\x3430\x3137\x3330\x3230\0\xffd0\xffff\x6b76\26\1\x8000\1\0\3\0\1\0\x6c47\x626f\x6c61\x6944\x6173\x6c62\x5365\x7265\x754e\x476d\x6e65\0\xffd0\xffff\x6b76\26\26\0\xb328\6\1\0\1\0\x6547\x656e\x6972\x5563\x4253\x6544\x6976\x6563\x7453\x6972\x676e\0\xffc8\xffff\x6b76\37*\0\xb560\6\1\0\1\0\x6547\x656e\x6972\x4363\x6d6f\x6f70\x6973\x6574\x5355\x4442\x7665\x6369\x5365\x7274\x6e69g\xffd0\xffffComposite USB Device\0\0\xffe8\xffff\xb498\6\xb4c8\6\xb4f8\6\xb528\6\0\0\xffa8\xffff\x6b6e \xc276\x3e63\x23b6\x1c7\0\0\x2e8\0\a\0\0\0\x2f98\a\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffffN\0\0\0\0\0\0\0007\0\5\0\x6956\x6564oe\xff88\xffff\x6b6e \x8880\xb5b5\xeb84\x1c4\0\0\xb5a8\6\3\0\0\0\x6108$\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\f\0\0\0\0\0\0\0\0\0&\0\x327b\x4133\x3737\x4642\x2d37\x4445\x3639\x342d\x4530\x2d43\x4641\x3630\x392d\x3142\x3446\x3638\x3737\x3233\x7d41o\xffa8\xffff\x6b6e \xfcc0\x8c86\xbf27\x1c3\0\0\xb600\6\0\0\0\0\xffff\xffff\xffff\xffff\3\0\x9930\6\x1e8\0\xffff\xffff\0\0\0\0002\08\0\0\0\4\0\x3030\x3030lS\xffd0\xffff\x6b76\278\0\xb700\6\a\0\1t\x6e49\x7473\x6c61\x656c\x4464\x7369\x6c70\x7961\x7244\x7669\x7265s\xffc0\xffffvga\0framebuf\0vga256\0vga64k\0\0Ne\xffd8\xffff\x6b76\r\4\x8000\1\0\4\0\0015\x6756\x4361\x6d6f\x6170\x6974\x6c62e-\xffc8\xffff\x6b76\31\4\x8000\x381d\x2e43\3\0\1\0\x6148\x6472\x6177\x6572\x6e49\x6f66\x6d72\x7461\x6f69\x2e6e\x7243\x33632\0\0\0\xfff0\xffffLCD\0\0\0\xffa8\xffff\x6b6e \x1070\xea6\x5327\x1c2\0\0\xb600\6\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xa5a0\6\x1e8\0\xffff\xffff\0\0\0\0\16\0\20\0\2\0\5\0\x6956\x6564o\\xffe0\xffff\x6b76\a\20\0\xb828\6\1\0\1s\x6553\x7672\x6369e\xffe8\xffffVgaSave\0,0\xffe8\xffff\xba4\0\0\t\x117d\0\0\b\x52ff\x4718\xff88\xffff\x6b6e \x8880\xb5b5\xeb84\x1c4\0\0\xb5a8\6\3\0\0\0\xbb30\6\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\f\0\0\0\0\0\0\0\2\0&\0\x387b\x3642\x3744\x3538\x2d39\x3641\x3933\x342d\x3141\x2d35\x3738\x3039\x372d\x3631\x3931\x3637\x3044\x3735\x7d41K\xffe8\xffffnv4_disp\0\0\xffa8\xffff\x6b6e \x1070\xea6\x5327\x1c2\0\0\xb858\6\0\0\0\0\xffff\xffff\xffff\xffff\4\0\xba30\6\x1e8\0\xffff\xffff\0\0\0\0.\0$\0\0\0\4\0\x3030\x3030er\xffd0\xffff\x6b76\27\16\0\xb970\6\a\0\1"\x6e49\x7473\x6c61\x656c\x4464\x7369\x6c70\x7961\x7244\x7669\x7265s\xffe8\xffffmnmdd\0\0oot\xffd0\xffff\x6b76\22$\0\xb9b8\6\1\0\1s\x6544\x6976\x6563\x4420\x7365\x7263\x7069\x6974\x6e6f rp\xffd8\xffffNetMeeting driver\0\xffd8\xffff\x6b76\r\4\x8000\0\0\4\0\1o\x6756\x4361\x6d6f\x6170\x6974\x6c62er\xffd8\xffff\x6b76\f\4\x8000\1\0\4\0\1"\x694d\x7272\x726f\x7244\x7669\x7265ct\xffe8\xffff\xb940\6\xb988\6\xb9e0\6\xba08\6\0\0\xffa8\xffff\x6b6e \x1070\xea6\x5327\x1c2\0\0\xb858\6\0\0\0\0\xffff\xffff\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\0\0\0\0\0\0\0\0\1\0\4\0\x3030\x3130\0\0\xffe8\xffff\x686c\1\x3a30\a\xe2d0\xe465\x4a30\a\xe2d0\xe465\xffa8\xffff\x6b6e \x1070\xea6\x5327\x1c2\0\0\xb858\6\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xa720\6\x1e8\0\xffff\xffff\0\0\0\0\16\0\f\0\2\0\5\0\x6956\x6564o"\xffe0\xffff\x6b76\a\f\0\xaf48\6\1\0\1,\x6553\x7672\x6369e\xffd8\xffff\x686c\3\xb8e8\6\x2140&\xba48\6\x2141&\xbab8\6\x42e7\x9d5\xcab8\6\x42e7\x9d5\xff88\xffff\x6b6e \x8880\xb5b5\xeb84\x1c4\0\0\xb5a8\6\2\0\0\0\x9d98.\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\f\0\0\0\0\0\0\0\3\0&\0\x397b\x3945\x3844\x3132\x2d30\x4545\x3744\x342d\x3436\x2d41\x3342\x4235\x442d\x3530\x3737\x4145\x4243\x3537\x7d34\0\xffd8\xffffRDPDD Chained DD\0\0\xffa8\xffff\x6b6e \x7cf0\x4df1\x5353\x1c2\0\0\xbb58\6\0\0\0\0\xffff\xffff\xffff\xffff1\0\x42a0\21\x1e8\0\xffff\xffff \0\0\0B\0\xf3c\0\0\0\4\0\x3030\x3030\0\0\xffd0\xffff\x6b76\27\24\0\xb8d0\6\a\0\1\0\x6e49\x7473\x6c61\x656c\x4464\x7369\x6c70\x7961\x7244\x7669\x7265s\xffd8\xffff\x6b76\r\4\x8000\0\0\4\0\1\0\x6756\x4361\x6d6f\x6170\x6974\x6c62e\0\xffd0\xffff\x6b76\22\4\x8000\b\0\4\0\1\0\x6143\x6170\x6962\x696c\x7974\x764f\x7265\x6972\x6564\0\0\0\xffd8\xffff\x6b76\20\4\x8000\1\0\4\0\1\0\x7441\x6174\x6863\x542e\x446f\x7365\x746b\x706f\xffc8\xffff\x6b76\32\4\x8000\20\0\4\0\1\0\x6544\x6166\x6c75\x5374\x7465\x6974\x676e\x2e73\x6942\x7374\x6550\x5072\x6c65\0\0\0\xffc8\xffff\x6b76\e\4\x8000\x320\0\4\0\1\0\x6544\x6166\x6c75\x5374\x7465\x6974\x676e\x2e73\x5258\x7365\x6c6f\x7475\x6f69n\0\0\xffe0\xffff\x6b76\a\6\0\xbef8\6\1\0\1\t\x6553\x7672\x6369e\xffc8\xffff\x6b76\e\4\x8000\x258\0\4\0\1\0\x6544\x6166\x6c75\x5374\x7465\x6974\x676e\x2e73\x5259\x7365\x6c6f\x7475\x6f69n\0\0\xffd0\xffff\x6b76\27\4\x8000\1\0\4\0\1\0\x7355\x4365\x6d6f\x7270\x7365\x6573\x4d64\x646f\x4665\x726f\x616dt\xffd8\xffff\x6b76\20\x1ee\0\xc620\6\1\0\1\t\x564e\x4130\x4d5f\x646f\x7365\x445f\x6c65\x6174\xffd8\xffff\x6b76\17\x2b0\0\xc020\6\1\0\1\0\x564e\x5f34\x6f4d\x6564\x5f73\x6544\x746ca\xffd8\xffff\x6b76\17\x340\0\xc2d8\6\1\0\1\0\x564e\x5f35\x6f4d\x6564\x5f73\x6544\x746ca\xffd0\xffff\x6b76\22\x1e6\0\xca10\6\1\0\1\t\x564e\x4d35\x3436\x4d5f\x646f\x7365\x445f\x6c65\x6174\t\xafd8\t\xffd0\xffff\x6b76\23\x1f4\0\xc818\6\1\0\1\0\x564e\x4156\x544e\x5f41\x6f4d\x6564\x5f73\x6544\x746ca\0\0\xffd8\xffff\x6b76\20\x400\0\xd020\6\1\0\1\t\x564e\x3031\x4d5f\x646f\x7365\x445f\x6c65\x6174\xfff0\xffffnv\0\b\x698\b\xffd0\xffff\x6b76\24\x340\0\xcc00\6\1\0\1\0\x564e\x5535\x544c\x4152\x4d5f\x646f\x7365\x445f\x6c65\x6174\0\0\xffd0\xffff\x6b76\22\x400\0\xd830\6\1\0\1\t\x564e\x3031\x4c47\x4d5f\x646f\x7365\x445f\x6c65\x6174\t\xafd8\t\xfff0\xffffLCD\0\0\0\xffd0\xffff\x6b76\23\x400\0\xd428\6\1\0\1\0\x564e\x3031\x4444\x5f52\x6f4d\x6564\x5f73\x6544\x746ca\0\0\xffd0\xffff\x6b76\21\x400\0\xe830\6\1\0\1\0\x564e\x3131\x5f4d\x6f4d\x6564\x5f73\x6544\x746ca\0\0\0\xffd8\xffff\x6b76\20\x400\0\xf428\6\1\0\1\t\x564e\x3531\x4d5f\x646f\x7365\x445f\x6c65\x6174\x6268\x6e69\xc000\6\x1000\0\0\0\0\0\0\0\0\0\0\0\xfd48\xffffA 640,480,-,140-240;800,600,-,140-240;1024,768,-,140-170;1152,864,-16,140-150;1152,864,32,140;S 1280,768,-,-;1280,960,-,-;1280,1024,32,120;1600,900,-16,100-;1600,900,32,85-;1600,1024,-16,100-;1600,1024,32,85-;1600,1200,-16,100-;1600,1200,32,85-;1920,1080,-16,100-;1920,1080,32,75-;1920,1200,-16,85-;1920,1200,32,70-;1920,1440,-,-;2048,1536,-,-\0\0\0\xfcb8\xffffA 640,480,-16,140-240;640,480,32,140-170;800,600,-16,140-240;800,600,32,140-150;1024,768,-16,140-200;1152,864,-16,140-170;1280,768,-16,140-150;1280,960,-16,140-150;1280,1024,-16,140-150;S 1600,900,32,100-;1600,1024,-16,120;1600,1024,32,100-;1600,1200,-16,120;1600,1200,32,100-;1920,1080,-16,120;1920,1080,32,85-;1920,1200,-16,100-;1920,1200,32,72-;1920,1440,-16,85-;1920,1440,32,70-;2048,1536,-16,70-;2048,1536,32,-\0\0\0\xfe08\xffffS 1600,900,-16,120;1600,900,32,100-;1600,1024,-16,120;1600,1024,32,100-;1600,1200,-16,120;1600,1200,32,100-;1920,1080,-16,120;1920,1080,32,85-;1920,1200,-16,100-;1920,1200,32,72-;1920,1440,-16,85-;1920,1440,32,70-;2048,1536,-16,70-;2048,1536,32,-\0\0\0\0\xfe08\xffffS 1280,768,-,-;1280,960,-,-;1280,1024,32,120;1600,900,-16,100-;1600,900,32,85-;1600,1024,-16,100-;1600,1024,32,85-;1600,1200,-16,100-;1600,1200,32,85-;1920,1080,-16,100-;1920,1080,32,70-;1920,1200,-16,85-;1920,1200,32,70-;1920,1440,-,-;2048,1536,-,-\0\xfe10\xffffS 1600,900,-16,120;1600,900,32,100-;1600,1024,-16,120;1600,1024,32,100-;1600,1200,-16,120;1600,1200,32,100-;1920,1080,-16,120;1920,1080,32,85-;1920,1200,-16,100-;1920,1200,32,-;1920,1440,-16,85-;1920,1440,32,-;2048,1536,-16,70-;2048,1536,32,-\0\0\0\0\xfcb8\xffffA 640,480,-16,140-240;640,480,32,140-170;800,600,-16,140-240;800,600,32,140-150;1024,768,-16,140-200;1152,864,-16,140-170;1280,768,-16,140-150;1280,960,-16,140-150;1280,1024,-16,140-150;S 1600,900,32,100-;1600,1024,-16,120;1600,1024,32,100-;1600,1200,-16,120;1600,1200,32,100-;1920,1080,-16,120;1920,1080,32,85-;1920,1200,-16,100-;1920,1200,32,72-;1920,1440,-16,85-;1920,1440,32,70-;2048,1536,-16,70-;2048,1536,32,-\0\0\0\xffd8\xffff\x6b76\20\x400\0\xe020\6\1\0\1\0\x564e\x3131\x4d5f\x646f\x7365\x445f\x6c65\x6174\xffd0\xffff\x6b76\22\x400\0\xf020\6\1\0\1\t\x564e\x3131\x4c47\x4d5f\x646f\x7365\x445f\x6c65\x6174\t\xaf00\t\xffe8\xffffi81xdnt5\0\0\b\0\xdfc0\6\xffd0\xffff\x6b76\23\x400\0\xe428\6\1\0\1\t\x564e\x3131\x4444\x5f52\x6f4d\x6564\x5f73\x6544\x746ca\xafd8\t\xfff0\xffffLCD\0\x920\b\x6268\x6e69\xd000\6\x1000\0\0\0\0\0\0\0\0\0\0\0\xfbf8\xffffA 640,480,-,140-240;800,600,-,140-240;848,480,-,-240;1024,768,-16,140-240;1024,768,32,140-200;1152,864,-16,140-200;1152,864,32,140-170;1280,720,-16,-170;1280,720,32,-150;1280,768,-16,140-170;1280,768,32,140-150;1280,960,-16,140-170;1280,960,32,140-150;1280,1024,-16,140-170;1280,1024,32,140-150;1360,768,-16,-170;1360,768,32,-150;1600,900,-16,140-150;S 1600,1024,32,120;1600,1200,32,120;1920,1080,-16,120;1920,1080,32,100-;1920,1200,-16,120;1920,1200,32,100-;1920,1440,-16,100-;1920,1440,32,85-;2048,1536,-16,85\0\0\0\xfbf8\xffffA 640,480,-,140-240;800,600,-,140-240;848,480,-,-240;1024,768,-16,140-240;1024,768,32,140-200;1152,864,-16,140-200;1152,864,32,140-170;1280,720,-16,-170;1280,720,32,-150;1280,768,-16,140-170;1280,768,32,140-150;1280,960,-16,140-170;1280,960,32,140-150;1280,1024,-16,140-170;1280,1024,32,140-150;1360,768,-16,-170;1360,768,32,-150;1600,900,-16,140-150;S 1600,1024,32,120;1600,1200,32,120;1920,1080,-16,120;1920,1080,32,100-;1920,1200,-16,120;1920,1200,32,100-;1920,1440,-16,100-;1920,1440,32,85-;2048,1536,-16,85\0\0\0\xfbf8\xffffA 640,480,-,140-240;800,600,-,140-240;848,480,-,-240;1024,768,-16,140-240;1024,768,32,140-200;1152,864,-16,140-200;1152,864,32,140-170;1280,720,-16,-170;1280,720,32,-150;1280,768,-16,140-170;1280,768,32,140-150;1280,960,-16,140-170;1280,960,32,140-150;1280,1024,-16,140-170;1280,1024,32,140-150;1360,768,-16,-170;1360,768,32,-150;1600,900,-16,140-150;S 1600,1024,32,120;1600,1200,32,120;1920,1080,-16,120;1920,1080,32,100-;1920,1200,-16,120;1920,1200,32,100-;1920,1440,-16,100-;1920,1440,32,85-;2048,1536,-16,85\0\0\0\xffd0\xffff\x6b76\23\x400\0\xf830\6\1\0\1\t\x564e\x3531\x4444\x5f52\x6f4d\x6564\x5f73\x6544\x746ca\xde90\t\xffd8\xffff\x6b76\20\x400\0\x830\a\1\0\1\t\x564e\x3032\x4d5f\x646f\x7365\x445f\x6c65\x6174\xffd0\xffff\x6b76\23\x206\0\xdcc0\6\1\0\1\t\x5243\x5355\x3148\x5f31\x6f4d\x6564\x5f73\x6544\x746ca\xbfa8\t\xfdf0\xffffS 640,400,-,120;640,480,-,120;800,600,-,120;1024,768,-,120;1152,864,-,-;1280,768,-,-;1280,960,-,-;1280,1024,-,120;1600,900,-,120;1600,1024,-,-;1600,1200,-,120;1920,1080,-,-;1920,1200,-,120;1920,1440,-16,120;1920,1440,32,85-;2048,1536,-16,85-;2048,1536,32,70-\0\0\0\0\xffd0\xffff\x6b76\22\x400\0 \a\1\0\1\t\x564e\x3531\x5242\x4d5f\x646f\x7365\x445f\x6c65\x6174\t\xafd8\t\xffd0\xffff\x6b76\22\x400\0\x428\a\1\0\1\t\x564e\x3531\x4c47\x4d5f\x646f\x7365\x445f\x6c65\x6174\t\xdf28\t\xffd0\xffff\x6b76\22\x400\0\x1020\a\1\0\1\t\x564e\x3032\x315f\x4d5f\x646f\x7365\x445f\x6c65\x6174\t\xde90\t\xffd8\xffff\x6b76\20\x400\0\x2020\a\1\0\1\t\x564e\x3731\x4d5f\x646f\x7365\x445f\x6c65\x6174\xffd0\xffff\x6b76\22\x400\0\x2428\a\1\0\1\t\x564e\x3731\x4c47\x4d5f\x646f\x7365\x445f\x6c65\x6174\t\xcf80\t\xffd8\xffff\x6b76\20\x400\0\x2830\a\1\0\1\t\x564e\x3532\x4d5f\x646f\x7365\x445f\x6c65\x6174\xffe8\xffffwADV02NT\0\0\b\0\0\0\x6268\x6e69\xe000\6\x1000\0\0\0\0\0\0\0\0\0\0\0\xfbf8\xffffA 640,480,-,140-240;800,600,-,140-240;848,480,-,-240;1024,768,-16,140-240;1024,768,32,140-200;1152,864,-16,140-200;1152,864,32,140-170;1280,720,-16,-170;1280,720,32,-150;1280,768,-16,140-170;1280,768,32,140-150;1280,960,-16,140-170;1280,960,32,140-150;1280,1024,-16,140-170;1280,1024,32,140-150;1360,768,-16,-170;1360,768,32,-150;1600,900,-16,140-150;S 1600,1024,32,120;1600,1200,32,120;1920,1080,-16,120;1920,1080,32,100-;1920,1200,-16,120;1920,1200,32,100-;1920,1440,-16,100-;1920,1440,32,85-;2048,1536,-16,85\0\0\0\xfbf8\xffffA 640,480,-,140-240;800,600,-,140-240;848,480,-,-240;1024,768,-16,140-240;1024,768,32,140-200;1152,864,-16,140-200;1152,864,32,140-170;1280,720,-16,-170;1280,720,32,-150;1280,768,-16,140-170;1280,768,32,140-150;1280,960,-16,140-170;1280,960,32,140-150;1280,1024,-16,140-170;1280,1024,32,140-150;1360,768,-16,-170;1360,768,32,-150;1600,900,-16,140-150;S 1600,1024,32,120;1600,1200,32,120;1920,1080,-16,120;1920,1080,32,100-;1920,1200,-16,120;1920,1200,32,100-;1920,1440,-16,100-;1920,1440,32,85-;2048,1536,-16,85\0\0\0\xfbf8\xffffA 640,480,-,140-240;800,600,-,140-240;848,480,-,-240;1024,768,-16,140-240;1024,768,32,140-200;1152,864,-16,140-200;1152,864,32,140-170;1280,720,-16,-170;1280,720,32,-150;1280,768,-16,140-170;1280,768,32,140-150;1280,960,-16,140-170;1280,960,32,140-150;1280,1024,-16,140-170;1280,1024,32,140-150;1360,768,-16,-170;1360,768,32,-150;1600,900,-16,140-150;S 1600,1024,32,120;1600,1200,32,120;1920,1080,-16,120;1920,1080,32,100-;1920,1200,-16,120;1920,1200,32,100-;1920,1440,-16,100-;1920,1440,32,85-;2048,1536,-16,85\0\0\0\xffd0\xffff\x6b76\22\x400\0\x1428\a\1\0\1\t\x564e\x3032\x325f\x4d5f\x646f\x7365\x445f\x6c65\x6174\t\xaf70\t\xffd0\xffff\x6b76\22\x400\0\x1830\a\1\0\1\t\x564e\x3032\x335f\x4d5f\x646f\x7365\x445f\x6c65\x6174\t\xde60\t\xffd0\xffff\x6b76\22\x400\0\x3020\a\1\0\1\t\x564e\x3532\x4c47\x4d5f\x646f\x7365\x445f\x6c65\x6174\t\xaf00\t\xffd0\xffff\x6b76\22~\0\xecf8\6\1\0\1\t\x6544\x6976\x6563\x4420\x7365\x7263\x7069\x6974\x6e6f\t\xbfa8\t\xff78\xffffNVIDIA RIVA TNT2 Model 64/Model 64 Pro (Microsoft Corporation)\0\t\xef40\t\xffc8\xffff\x6b76\34&\0\xedb8\6\3\0\1\t\x6148\x6472\x6177\x6572\x6e49\x6f66\x6d72\x7461\x6f69\x2e6e\x6843\x7069\x7954\x6570\xcf80\t\xffd0\xffffRIVA TNT2 Model 64\0\t\xdf80\t\xffc0\xffff\x6b76!&\0\xef58\6\3\0\1\0\x6148\x6472\x6177\x6572\x6e49\x6f66\x6d72\x7461\x6f69\x2e6e\x6441\x7061\x6574\x5372\x7274\x6e69g\0\0\0\b\0\xfc8\a\xffd8\xffff\x6b76\17`\0\xee58\6\3\0\1\4\x6544\x6976\x6563\x614d\x6b73\x6c46\x6761s\xff98\xffff\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xffc8\xffff\x6b76\36\4\x8000\0\x100\3\0\1\t\x6148\x6472\x6177\x6572\x6e49\x6f66\x6d72\x7461\x6f69\x2e6e\x654d\x6f6d\x7972\x6953\x657a\t\xffd0\xffff\x6b76\30\4\x8000\1\0\3\0\1\0\x7953\x7473\x6d65\x6f4d\x6564\x6553\x4874\x7361\x634f\x7563\x7272\x6465\xffd0\xffff\x6b76\21\4\x8000\xffff\xffff\3\0\1\0\x764e\x7043\x536c\x7465\x7441\x7453\x7261\x7574p\0\0\0\xffd0\xffffRIVA TNT2 Model 64\0\0\0\0\xffc8\xffff\x6b76\e$\0\xefc0\6\3\0\1\t\x6148\x6472\x6177\x6572\x6e49\x6f66\x6d72\x7461\x6f69\x2e6e\x6144\x5463\x7079e\xcf80\t\xffd8\xffffIntegrated RAMDAC\0\xffe8\xffffwADV01nt\0\0\x6268\x6e69\xf000\6\x1000\0\0\0\0\0\0\0\0\0\0\0\xfbf8\xffffA 640,480,-,140-240;800,600,-,140-240;848,480,-,-240;1024,768,-16,140-240;1024,768,32,140-200;1152,864,-16,140-200;1152,864,32,140-170;1280,720,-16,-170;1280,720,32,-150;1280,768,-16,140-170;1280,768,32,140-150;1280,960,-16,140-170;1280,960,32,140-150;1280,1024,-16,140-170;1280,1024,32,140-150;1360,768,-16,-170;1360,768,32,-150;1600,900,-16,140-150;S 1600,1024,32,120;1600,1200,32,120;1920,1080,-16,120;1920,1080,32,100-;1920,1200,-16,120;1920,1200,32,100-;1920,1440,-16,100-;1920,1440,32,85-;2048,1536,-16,85\0\0\0\xfbf8\xffffA 640,480,-,140-240;800,600,-,140-240;848,480,-,-240;1024,768,-16,140-240;1024,768,32,140-200;1152,864,-16,140-200;1152,864,32,140-170;1280,720,-16,-170;1280,720,32,-150;1280,768,-16,140-170;1280,768,32,140-150;1280,960,-16,140-170;1280,960,32,140-150;1280,1024,-16,140-170;1280,1024,32,140-150;1360,768,-16,-170;1360,768,32,-150;1600,900,-16,140-150;S 1600,1024,32,120;1600,1200,32,120;1920,1080,-16,120;1920,1080,32,100-;1920,1200,-16,120;1920,1200,32,100-;1920,1440,-16,100-;1920,1440,32,85-;2048,1536,-16,85\0\0\0\xfbf8\xffffA 640,480,-,140-240;800,600,-,140-240;848,480,-,-240;1024,768,-16,140-240;1024,768,32,140-200;1152,864,-16,140-200;1152,864,32,140-170;1280,720,-16,-170;1280,720,32,-150;1280,768,-16,140-170;1280,768,32,140-150;1280,960,-16,140-170;1280,960,32,140-150;1280,1024,-16,140-170;1280,1024,32,140-150;1360,768,-16,-170;1360,768,32,-150;1600,900,-16,140-150;S 1600,1024,32,120;1600,1200,32,120;1920,1080,-16,120;1920,1080,32,100-;1920,1200,-16,120;1920,1200,32,100-;1920,1440,-16,100-;1920,1440,32,85-;2048,1536,-16,85\0\0\0\xffd8\xffff\x6b76\f\xf3c\0\x4020\a\3\0\1\t\x6153\x6576\x6553\x7474\x6e69\x7367\xae50\t\xffd8\xffff\x6b76\f\x11c\0\xfe30\6\3\0\1\t\x7754\x6e69\x6976\x7765\x6e49\x6f66\xafd8\t\xffa8\xffff\x6b6e \xc320\x3a0f\x5327\x1c2\0\0\xbb58\6\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xa9c8\6\x1e8\0\xffff\xffff\0\0\0\0\16\0\6\0\1\0\5\0\x6956\x6564\x9f6f\t\xffa8\xffff\x6b6e \x11a0\x4a8f\x5353\x1c2\0\0\xff50\6\0\0\0\0\xffff\xffff\xffff\xffff(\0\xf020\5\x1e8\0\xffff\xffff \0\0\0B\0H\0\0\0\4\0\x3030\x3030\0\0\b\0\xd40\a\xffc8\xffff\x6b76\36$\0\xfd78\6\3\0\1\t\x6148\x6472\x6177\x6572\x6e49\x6f66\x6d72\x7461\x6f69\x2e6e\x6942\x736f\x7453\x6972\x676e\t\xffd8\xffffVersion 2.05.2002\0\xffd8\xffff\x6b76\r\4\x8000\0\0\3\0\1\t\x5654\x6e45\x6f63\x6564\x5472\x7079\xbc65\t\xffd8\xffff\x6b76\v\4\x8000\0\0\3\0\1\t\x5654\x6e45\x6f63\x6564\x4972D\xde60\t\xffd8\xffff\x6b76\r\4\x8000\0\0\4\0\1\0\x6756\x4361\x6d6f\x6170\x6974\x6c62e\0\xffe8\xffffwADV05NT\0\b\xfee0\xffff\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x320\0\x258\0\0\0\0\0\0\0\1\0\x101\1\1\0\1\0\0\0\a\0\0\0\0\0\20\0F\0\x127\0\x13b\0\0\0\0\0\x320\0\x258\0\0\0\0\0\x320\0\x258\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\x246\b\x20b0\xbf9f\x850\xf94d\0\0\0\0\20\0F\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff88\xffff\x6b6e \x8880\xb5b5\xeb84\x1c4\0\0\xb5a8\6\2\0\0\0\x9dc0.\xffff\xffff\0\0\xffff\xffff\x1e8\0\xffff\xffff\f\0\0\0\0\0\0\0\3\0&\0\x427b\x4346\x4339\x4337\x2d46\x4537\x3545\x342d\x4436\x2d35\x3641\x3341\x462d\x4139\x3644\x3938\x3635\x4630\x7d33\0\xffd0\xffff\x6b76\27\24\0\xcfa0\6\a\0\1\0\x6e49\x7473\x6c61\x656c\x4464\x7369\x6c70\x7961\x7244\x7669\x7265s\b\0\0\0\x6268\x6e69\0\a\x1000\0\0\0\0\0\0\0\0\0\0\0\xfbf8\xffffA 640,480,-,140-240;800,600,-,140-240;848,480,-,-240;1024,768,-16,140-240;1024,768,32,140-200;1152,864,-16,140-200;1152,864,32,140-170;1280,720,-16,-170;1280,720,32,-150;1280,768,-16,140-170;1280,768,32,140-150;1280,960,-16,140-170;1280,960,32,140-150;1280,1024,-16,140-170;1280,1024,32,140-150;1360,768,-16,-170;1360,768,32,-150;1600,900,-16,140-150;S 1600,1024,32,120;1600,1200,32,120;1920,1080,-16,120;1920,1080,32,100-;1920,1200,-16,120;1920,1200,32,100-;1920,1440,-16,100-;1920,1440,32,85-;2048,1536,-16,85\0\0\0\xfbf8\xffffA 640,480,-,140-240;800,600,-,140-240;848,480,-,-240;1024,768,-16,140-240;1024,768,32,140-200;1152,864,-16,140-200;1152,864,32,140-170;1280,720,-16,-170;1280,720,32,-150;1280,768,-16,140-170;1280,768,32,140-150;1280,960,-16,140-170;1280,960,32,140-150;1280,1024,-16,140-170;1280,1024,32,140-150;1360,768,-16,-170;1360,768,32,-150;1600,900,-16,140-150;S 1600,1024,32,120;1600,1200,32,120;1920,1080,-16,120;1920,1080,32,100-;1920,1200,-16,120;1920,1200,32,100-;1920,1440,-16,100-;1920,1440,32,85-;2048,1536,-16,85\0\0\0\xfbf8\xffffA 640,480,-,140-240;800,600,-,140-240;848,480,-,-240;1024,768,-16,140-240;1024,768,32,140-200;1152,864,-16,140-200;1152,864,32,140-170;1280,720,-16,-170;1280,720,32,-150;1280,768,-16,140-170;1280,768,32,140-150;1280,960,-16,140-170;1280,960,32,140-150;1280,1024,-16,140-170;1280,1024,32,140-150;1360,768,-16,-170;1360,768,32,-150;1600,900,-16,140-150;S 1600,1024,32,120;1600,1200,32,120;1920,1080,-16,120;1920,1080,32,100-;1920,1200,-16,120;1920,1200,32,100-;1920,1440,-16,100-;1920,1440,32,85-;2048,1536,-16,85\0\0\0\xffa0\xffff\x6b6e \x9a0\x796d\x8887\x1c7\0\0\x9b00\b\1\0\0\0\xec58\2\xffff\xffff\1\0\xee78\2\x9ad8\32\xffff\xffff\b\0\0\0\30\0\4\0007\0\f\0\x454c\x4147\x5943\x525f\x5044\x504e\xcfd8\6\xffa8\xffff\x6b6e \x9a0\x796d\x8887\x1c7\0\0\xc38\a\0\0\0\0\xffff\xffff\xffff\xffff\6\0\x4420\21\x9ad8\32\xffff\xffff\16\0\0\0\26\0N\0\0\0\4\0\x3030\x3030\xd40\a\b\0\xdc8\a\xffd0\xffff\x6b76\22\4\x8000\0\0\4\0\1\0\x6143\x6170\x6962\x696c\x7974\x764f\x7265\x6972\x6564\0\0\0\xffd8\xffff\x6b76\f\b\0\xbf68\6\1\0\1\0\x754f\x7074\x7475\x2e30\x7954\x6570\0\0\xffd0\xffff\x6b76\22\22\0\xefe8\6\1\0\1\0\x754f\x7074\x7475\x2e30\x694d\x696e\x7264\x7669\x7265\0\0\0\xffd8\xffff\x6b76\20\4\x8000\0\0\4\0\1\0\x754f\x7074\x7475\x2e30\x3249\x5f43\x6441\x7264\xfff0\xffffLCD\0\xa18\b\xfff0\xffffLFP\0\xac0\b\xffd8\xffff\x6b76\f\b\0\xb7a0\6\1\0\1\0\x754f\x7074\x7475\x2e31\x7954\x6570\0\0\xffd0\xffff\x6b76\22\22\0\xdfe0\6\1\0\1\0\x754f\x7074\x7475\x2e31\x694d\x696e\x7264\x7669\x7265\0\0\0\xffd8\xffff\x6b76\20\4\x8000\0\0\4\0\1\0\x754f\x7074\x7475\x2e32\x3249\x5f43\x6441\x7264\xffd8\xffff\x6b76\20\4\x8000\0\0\4\0\1\0\x754f\x7074\x7475\x2e31\x3249\x5f43\x6441\x7264\xffd8\xffff\x6b76\f\b\0\xcff0\6\1\0\1\0\x754f\x7074\x7475\x2e32\x7954\x6570\0\0\xffd8\xffff\x6b76\f\b\0\xda8\a\1\0\1\b\x754f\x7074\x7475\x2e33\x7954\x6570\xac0\b\b\0\x1ec8\a\xffd0\xffff\x6b76\22\22\0\xfe18\6\1\0\1\0\x754f\x7074\x7475\x2e32\x694d\x696e\x7264\x7669\x7265\0\0\0\xffd8\xffff\x6b76\20\4\x8000\0\0\4\0\1\b\x754f\x7074\x7475\x2e33\x3249\x5f43\x6441\x7264\xfff0\xffffTVOut\0\xffd0\xffff\x6b76\22\22\0\xf60\a\1\0\1\0\x754f\x7074\x7475\x2e33\x694d\x696e\x7264\x7669\x7265\0\0\0\xffe8\xffffwSiINTxx\0\0\xffd0\xffff\x6b76\22\22\0\xfe0\a\1\0\1\b\x754f\x7074\x7475\x2e34\x694d\x696e\x7264\x7669\x7265\b\xb40\b\xfff0\xffffTVOut\0\xffd8\xffff\x6b76\f\b\0\xdb8\a\1\0\1\0\x754f\x7074\x7475\x2e34\x7954\x6570\0\0\xffe8\xffffwVchNTxx\0\0\b\0\0\0\x6268\x6e69\x1000\a\x1000\0\0\0\0\0\0\0\0\0\0\0\xfbf8\xffffA 640,480,-,140-240;800,600,-,140-240;848,480,-,-240;1024,768,-16,140-240;1024,768,32,140-200;1152,864,-16,140-200;1152,864,32,140-170;1280,720,-16,-170;1280,720,32,-150;1280,768,-16,140-170;1280,768,32,140-150;1280,960,-16,140-170;1280,960,32,140-150;1280,1024,-16,140-170;1280,1024,32,140-150;1360,768,-16,-170;1360,768,32,-150;1600,900,-16,140-150;S 1600,1024,32,120;1600,1200,32,120;1920,1080,-16,"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Session Manager]
"PendingFileRenameOperations"=str(7):"\x6264\4\xaf08 e\0`\0\x6b6e \xd6ca\x5cd8\x40f6\x1c8\0\0\xdf30M\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xb0b0\32\xffff\xffff\xffff\xffff\0\0\0\0\30\0\4\0[\0\17\0\x454c\x4147\x5943\x4d5f\x5553\x4450\x5441E\xffd8\xffff255.255.240.0\0\0$\x2140&\xfff0\xffff\x686c\1\x3948 \x2140&\xfff8\xffff\x4938 \xfff0\xffff\x686c\1\x48e0 \xe2d0\xe465\xffa8\xffff\x6b6e \xe9e4\x895c\x4091\x1c8\0\0\x4dc0 \0\0\0\0\xffff\xffff\xffff\xffff\6\0\xc2c0\37\x9ad8\32\xffff\xffff\16\0\0\0\26\0N\0\0\0\4\0\x3030\x303053\xfff0\xffff\x686c\1\x9640 \x2140&\xffa8\xffff{8ECC055D-047F-11D1-A537-0000F8753ED1}\0i j\xffe8\xffffRkPavProc\0\xffa8\xffff\x6b6e \xe9e4\x895c\x4091\x1c8\0\0\x4d60 \0\0\0\0\xffff\xffff\xffff\xffff\6\0\x97c0 \x9ad8\32\xffff\xffff\16\0\0\0\26\0N\0\0\0\4\0\x3030\x303053\xffd8\xffff\x6b76\tN\0\x8ba0 \1\0\1\16\x6c43\x7361\x4773\x4955\x3744\24\xc020o\xffd8\xffff\x6b76\n\24\0\x62d0\22\1\0\1Z\x6544\x6976\x6563\x6544\x6373[\x8020[\xffe0\xffff\xc760\37\xff38\37\x2830 \x2420 \x9770 \x9798 r\0\xfff8\xffff\x4e48 \xfff0\xffff\x686c\1\x4a60 \x2140&\xffc0\xffff\x3808\21\xa3a0\22\xb600\22\xab30\22\xc440\22\x2e98\23\x4590\23\x7e28\23\x3370\23\x9f90\23\x8608\23\xfcf0\23\xfcc0\23\x31a0\24\x4b10\27\xff88\xffff"C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe"\0p\xffe0\xffffLocalSystem\0ti\xffb0\xffffProtects your computer from spyware\0g \xfff0\xffff\x686c\1\x24d8 \x2140&\xffe0\xffffShellSvcGroup\0\xfff8\xffff\x3030 \xfff8\xffff\x34a0 \xfff0\xffff\x686c\1\x3448 \xe2d0\xe465\xff98\xffff\x6b6e \xb6ec\xf011\x4091\x1c8\0\0\x9b00\b\1\0\0\0\xa138 \xffff\xffff\1\0\x97e0 \x9ad8\32\xffff\xffff\b\0\0\0\30\0\4\0:\0\23\0\x454c\x4147\x5943\x485f\x5841\x544c\x5450\x5851\x4a4fC\x5688\r\xffa8\xffff\x6b6e \xb6ec\xf011\x4091\x1c8\0\0\x9970 \0\0\0\0\xffff\xffff\xffff\xffff\6\0\x9ba0 \x9ad8\32\xffff\xffff\16\0\0\0\26\0N\0\0\0\4\0\x3030\x3030\xaf40\22\xffe0\xffffhaxltptqxojc\0\23\xffe0\xffff\x6b76\6\4\x8000\1\0\4\0\1\23\x654c\x6167\x7963\23\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\23\x6f43\x666e\x6769\x6c46\x6761s\xc8c0\23\xffe0\xffff\x6b76\5\32\0\x9ab8 \1\0\1\23\x6c43\x7361\xe673\23\xffe0\xffffLegacyDriver\0\23\xffd8\xffff\x6b76\tN\0\x9b00 \1\0\1\23\x6c43\x7361\x4773\x4955\xd744\23\xd7e0\23\xffa8\xffff{8ECC055D-047F-11D1-A537-0000F8753ED1}\0\23\xf690\23\xffd8\xffff\x6b76\n\32\0\x9b80 \1\0\1\24\x6544\x6976\x6563\x6544\x6373\24\xf08\24\xffe0\xffffhaxltptqxojc\0\24\xffe0\xffff\x47c8 \x9a50 \x9a70 \x9a98 \x9ad8 \x9b58 \x830\24\xffa8\xffff\x6b6e \xb010\x2776\x41cd\x1c8\0\0\xc338\t\0\0\1\0\xffff\xffff\x8c00\x8000\4\0\x5838\22\x80a8\21\xffff\xffff\b\0\0\0\30\0:\0\x10d\0\a\0\x4453\x4854\x4f4fK\xffe0\xffff\x6b76\4\4\x8000\1\0\4\0\1\24\x7954\x6570\x4a10\24\xffd8\xffff\x6b76\f\4\x8000\1\0\4\0\1\24\x7245\x6f72\x4372\x6e6f\x7274\x6c6f\x5758\24\xffe0\xffff\x6b76\5\4\x8000\3\0\4\0\1\24\x7453\x7261\x5f74\24\xffd8\xffff\x6b76\t:\0\x9ca8 \2\0\1\24\x6d49\x6761\x5065\x7461\x4d68\24\x6868\24\xffc0\xffffSystem32\DRIVERS\SDTHOOK.sys\0\24\xffa0\xffff\x6b6e \x61de\x5b54\x4092\x1c8\0\0\x9b00\b\1\0\0\0\xa1c0 \xffff\xffff\1\0\xa1f8 \x9ad8\32\xffff\xffff\b\0\0\0\30\0\4\0\x8f\0\16\0\x454c\x4147\x5943\x535f\x5444\x4f48\x4b4f\24\xffd8\xffff\x6b76\f\4\x8000\1\0\4\0\1\24\x654e\x7478\x6e49\x7473\x6e61\x6563\xc2d0\24\xffa8\xffff\x6b6e \xb010\x2776\x41cd\x1c8\0\0\x9ce8 \1\0\1\0\x6360\r\x8b98\x8000\a\0\x9f18 \x9ad8\32\xffff\xffff\16\0\0\0\30\0N\0\0\0\4\0\x3030\x3030IN\xffe0\xffff\x6b76\a\20\0\xa598 \1\0\0013\x6553\x7672\x6369e\xffe0\xffff\x6b76\6\4\x8000\1\0\4\0\1\\x654c\x6167\x7963W\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1e\x6f43\x666e\x6769\x6c46\x6761swf\xffe0\xffff\x6b76\5\32\0\x9e50 \1\0\1:\x6c43\x7361sN\xffe0\xffffLegacyDriver\0o\xffd8\xffff\x6b76\tN\0\x9e98 \1\0\1\\x6c43\x7361\x4773\x4955DNDO\xffa8\xffff{8ECC055D-047F-11D1-A537-0000F8753ED1}\0\r\x8050\r\xffd8\xffff\x6b76\n\20\0\xa808 \1\0\1\27\x6544\x6976\x6563\x6544\x6373\30\x37e0\30\xffe0\xffff\x9dc8 \x9de8 \x9e08 \x9e30 \x9e70 \x9ef0 \xb020\34\xffa8\xffff\x6b6e \xd1e\x754d\xb917\x1c7\0\0\x4210\37\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xbee8\31\xd020\t\xffff\xffff\0\0\0\0\20\0\xbc\0\0\0\b\0\x6553\x7563\x6972\x7974\xffd8\xffff\x6b76\n8\0\xa4d8 \1\0\1\0\x624f\x656a\x7463\x614e\x656d\0\0\0\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1#\x6f43\x666e\x6769\x6c46\x6761s\xa40"\xffe0\xffff\x6b76\5\24\0\x7438\16\1\0\1.\x6c43\x7361st\x6268\x6e69\xa000 \x1000\0\0\0\0\0\0\0\0\0\0\0\xff68\xffff%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000\0\26\xffd8\xffff\x6b76\f\4\x8000\1\0\4\0\1\\x7245\x6f72\x4372\x6e6f\x7274\x6c6fot\xffa8\xffff\x6b769\xcc\0\xb770 \1\0\19\x3a43\x505c\x6f72\x7267\x6d61\x4620\x6c69\x7365\x545c\x7275\x6f62\x6154\x5c78\x6544\x756c\x6578\x3220\x3030\x5c36\x3233\x6962\x5c74\x7075\x6164\x6574\x676d\x2e72\x7865\x6965\x5c74\x7075\x6164\xfff0\xffff\x686c\1\x99d8 \x2140&\xffe0\xffff\x6b76\3.\0\x1678$\1\0\1.\x664dg\0y\xffa8\xffff\x6b6e \xced8\xc4ae\xbe5d\x1c7\0\0\x3988\4\0\0\0\0\xffff\xffff\xffff\xffff\0\0\xffff\xffff\x80a8\21\xffff\xffff\0\0\0\0\0\0\0\0\4\0\4\0\x494d\x4944t.\xfff0\xffff\x686c\1\x9d70 \x2140&\xffd8\xffff\x6b76\16,\0\xab18 \3\0\1\1\x6146\x6c69\x7275\x4165\x7463\x6f69\x736e\0\xfff8\xffff\x9d48 \xffe8\xffff\x686c\1\x7d08-0\0\xdd0830\0\xff18\xffffShares Windows Media Player libraries to other networked players and media devices using Universal Plug and Play\0000\xffd0\xffff\x1f20\25\x7a30\26\x3578\36\x7030\37\x7058\37\x9150\37\x91b0\37\x9f90 \xa518 \xa540 \W\xff40\xffff\1\x8014\xa4\0\xb0\0\24\0000\0\2\34\1\0\x8002\24\x1ff\17\x101\0\0\x100\0\0\2t\5\0\0\24\x1fd\2\x101\0\0\x500\22\0\0\30\x1ff\17\x201\0\0\x500 \0\x220\0\0\24\x18d\2\x101\0\0\x500\v\0\0\30\x1fd\2\x201\0\0\x500 \0\x223\0\0\24\x19d\2\x101\0\0\x500\4\0\x101\0\0\x500\22\0\x101\0\0\x500\22\0\xff50\xffff\1\x8014\x90\0\x9c\0\24\0000\0\2\34\1\0\x8002\24\x1ff\17\x101\0\0\x100\0\0\2`\4\0\0\24\x1fd\2\x101\0\0\x500\22\0\0\30\x1ff\17\x201\0\0\x500 \0\x220\0\0\24\x18d\2\x101\0\0\x500\v\0\0\30\x1fd\2\x201\0\0\x500 \0\x223\0\x101\0\0\x500\22\0\x101\0\0\x500\22\0\0\0\xffe0\xffff\x6b76\5\32\0\xcbb8 \1\0\1e\x6c43\x7361\x473\0\xffe8\xffff\x686c\1\x4208-\x86f8\x64f3\xa2083\x86f8\x64f3\xffc0\xffffNT AUTHORITY\NetworkService\0\1f\xffd8\xffff\x6b76\v\xe2\0\xa218 \1\0\1\0\x6544\x6373\x6972\x7470\x6f69\x616e\x7963\\xffd8\xffff\x6b76\16,\0\xa568 \3\0\1\1\x6146\x6c69\x7275\x4165\x7463\x6f69\x736e\0\xffd0\xffff\0\0\0\0\0\0\3\0\x101\0\1\0\x7530\0\1\0\x7530\0\0\0\0\0\xffe8\xffffSDTHOOK\0\0\0\xfff0\xffff\xa6900\xa6c80\xe528%\xff48\xffff\x4e48\r\x5718\r\x28b8\23\x2a30\23\x3230\23\x3940\23\x4e48\23\xae20\30\x3820\23\x9828\25\x8e70\23\x98e0\25\x99b8\25\x9ea0\25\x9fa0\25\xa228\25\x89b8\30\xbcd8\23\xa588\25\xa7a8\25\x8970\30\xb280\25\xb338\25\x9830\30\x9570\30\x97d0\30\x9508\30\x9800\30\x8f58\30\xb6b0\25\xa6f0\30\x8ee0\30\x8f10\30\x8f88\30\x8fc0\30\xa670\30\xa6a0\30\xfc08\e\x1360\36\xbd58\25\x1228\24\xc0b8\25\xc288\25\xc3e0\02532\xfee8\xffffEnables event log messages issued by Windows-based programs and components to be viewed in Event Viewer. This service cannot be stopped.\0e\xffb0\xffff%SystemRoot%\system32\services.exe\0tCo\xffd8\xffff\x6b76\n\30\0\xda28\24\1\0\1n\x624f\x656a\x7463\x614e\x656dSaf\xffe8\xffffSDTHOOK\0\x6d58\27\xfff0\xffff\x686c\1\xab78 \xe2d0\xe465\xffe8\xffff\x686c\1\x45d0-\x86f8\x64f3\xa5d03\x86f8\x64f3\xffa8\xffff\x6b6e \xced8\xc4ae\xbe5d\x1c7\0\0\x8dc0@\0\0\0\0\xffff\xffff\xffff\xffff\0\0\xffff\xffff\x80a8\21\xffff\xffff\0\0\0\0\0\0\0\0\4\0\4\0\x494d\x4944t.\xff58\xffffC:\Program Files\TurboTax\Deluxe 2006\32bit\ttax.exe:LocalSubNet:Enabled:TurboTax\0\xfff8\xffff\x8c88 \b\0\x90a8 \xffa0\xffffWindows Media Player Network Sharing Service\0N\xffc8\xffffupnphost\0http\0HTTPFilter\0\0\xffc0\xffffNT AUTHORITY\NetworkService\0\1f\xff18\xffffShares Windows Media Player libraries to other networked players and media devices using Universal Plug and Play\0000\xffd0\xffff\0\0\0\0\0\0\3\0\x101\0\1\0\x7530\0\1\0\x7530\0\0\0\0\0\xffd0\xffff\x3020\23\x6e50\23\xbec0\31\x3170\34\x4140\34\x89c8\35\xb440\35\xbf30\35\x3be8\37\xa1d0 \xe408\27\xffa8\xffff\x6b6e \xd1e\x754d\xb917\x1c7\0\0\xaf20 \0\0\0\0\xffff\xffff\xffff\xffff\1\0\x8598\24\xd020\t\xffff\xffff\0\0\0\0\20\0\xbc\0\0\0\b\0\x6553\x7563\x6972\x7974\xff40\xffff\1\x8014\xa4\0\xb0\0\24\0000\0\2\34\1\0\x8002\24\x1ff\17\x101\0\0\x100\0\0\2t\5\0\0\24\x1fd\2\x101\0\0\x500\22\0\0\30\x1ff\17\x201\0\0\x500 \0\x220\0\0\24\x18d\2\x101\0\0\x500\v\0\0\30\x1fd\2\x201\0\0\x500 \0\x223\0\0\24\x19d\2\x101\0\0\x500\4\0\x101\0\0\x500\22\0\x101\0\0\x500\22\0\xffa8\xffff\x6b6e \xee16\x3be4\xb917\x1c7\0\0\x99c0P\1\0\0\0\xaff0 \xffff\xffff\b\0\xe080 \x1e8\0\xffff\xffff\20\0\0\0\30\0\x8e\0\x174\0\6\0\x7557\x6664\x6650\27\xffd8\xffff\x6b76\f\4\x8000\1\0\4\0\1\24\x7245\x6f72\x4372\x6e6f\x7274\x6c6f\x230\37\xffd8\xffff\x6b76\t8\0\xad38 \2\0\1\23\x6d49\x6761\x5065\x7461\x3d68\25\x7d40\23\xffc0\xffffsystem32\DRIVERS\WudfPf.sys\0\22\0\xffe0\xffff\x6b76\5\4\x8000\2\0\4\0\1\x696c\x7453\x7261\xc274\x7e17\xffd0\xffff\x6b76\23\4\x8000\3\0\4\0\0012\x6c50\x6775\x6c50\x7961\x6553\x7672\x6369\x5465\x7079e""\xffd8\xffff\x6b76\n0\0\xc250 \1\0\1\16\x7244\x7669\x7265\x6544\x6373\30\xcf70\16\xffd8\xffff\x6b76\f\24\0\xbfa0 \1\0\1\0\x6f43\x706d\x7475\x7265\x614e\x656d\0\0\xfff0\xffff\x686c\1\x8cb0 \x2140&\xff48\xffffnetfxcustomperfcounters.1.0\0SharedPerfIPCBlock\0Cor_Private_IPCBlock\0Cor_Public_IPCBlock_\0\0\xffd8\xffff\x6b76\tF\0\xa790 \2\0\1,\x6d49\x6761\x5065\x7461h000\xffe8\xffff a\x8020]\x4020]\xc020`\x8fc0\27\xffa0\xffff\x6b6e \x9ad0\x74f9\xb917\x1c7\0\0\x99c0P\1\0\0\0\xa820 \xffff\xffff\n\0\xab48 \x1e8\0\xffff\xffff\20\0\0\0\36\0\xe2\0\x171\0\r\0\x4d57\x4e50\x7465\x6f77\x6b72\x7653c\0\xff90\xffff"C:\Program Files\Windows Media Player\WMPNetwk.exe"\0n\xfff0\xffff\x686c\1\xcbe0 \xe2d0\xe465\x6268\x6e69\xb000 \x1000\0\0\0\6\0\32\0\31\0\0\0\xff68\xffff%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000\0\26\x378\0Microsoft security update service\0\xc0\0{8ECC055D-047F-11D1-A537-0000F8753ED1}\0047\0\x7f68\e`\0{8ECC055D-047F-11D1-A537-0000F8753ED1}\0044\0MM\xa8\0\x6b6e \x4584\x499e\x40ee\x1c8\0\0\x99c0P\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xbfe0\r\xffff\xffff\xffff\xffff\0\0\0\0\22\0H\0O\0\6\0\x7244\x7669\x7265\2P\0\??\C:\WINDOWS\system32\kernelw.sys\0N\0\x1c8\0\x6b6e \x2536\xa583\x41ca\x1c8\0\0\x99c0P\0\0\0\0\xffff\xffff\xffff\xffff\a\0\x29b0\24\xffff\xffff\xffff\xffff\b\0\0\0\30\0\x82\0\xaf\0\b\0\x736d\x7075\x6164\x6574\x170\0\??\C:\WINDOWS\system32\wowfx.dll\0\??\C:\WINDOWS\system32\wowfx.dll\0\??\C:\WINDOWS\system32\wowfx.dll\0\??\C:\WINDOWS\system32\wowfx.dll\0\0\22X\0\xece0\22\xb990\22\xec40\22\x2040\23\x2668\23@\0System32\DRIVERS\serial.sys\0\0\0\xffe8\xffffUSBSTOR\0\x4020\16\xffd8\xffff\x6b76\tN\0\x9530%\1\0\1\24\x6c43\x7361\x4773\x4955\x4444\x7365\x2563\25X\0\x6b6e \xd6ca\x5cd8\x40f6\x1c8\0\0\x9590 \0\0\0\0\xffff\xffff\xffff\xffff\6\0\xc9a0\37\xffff\xffff\xffff\xffff\16\0\0\0\26\0N\0\0\0\4\0\x3030\x3030\W\xffc0\xffffUSB Flash Memory USB Device\0\0\0\20\0to\b\0\x6369\x6c65\xffa0\xffff\x6b6e \xe5f8\x1145\xf0d4\x1c7\0\0\xb440\6\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xa9e8\24\x1e8\0\xffff\xffff\0\0\0\0\b\0\2\0\b\0\f\0\x6530\x3061\x3132\x3836\x3130\x3030\x7208\23\xffd8\xffff\x6b76\f\xa0\0\xc498 \1\0\1\23\x7953\x626d\x6c6f\x6369\x694c\x6b6e\x3108\25\x90\0{8ECC055D-047F-11D1-A537-0000F8753ED1}\0\C:8\0\xdce8\21\xe5e0\21\xc5c0\21\xeca0\21\xd960\21\xf80\22\x7878\25\x8278\31\xe718\23\x8f80 if\b\0r\0\xff98\xffff\x6b6e \xe5f8\x1145\xf0d4\x1c7\0\0\xa5e0\t\1\0\0\0\xbb10 \xffff\xffff\0\0\xffff\xffff\x9ad8\32\xffff\xffff\34\0\0\0\0\0\0\0\f\0\21\0\x6956\x5f64\x6530\x3061\x5026\x6469\x325f\x36318\0\r\n\xfff0\xffff\x686c\1\xd280 \x7751\xd9f1\xfff0\xffff\x686c\1\xd3e8 #\0\xff48\xffffnetfxcustomperfcounters.1.0\0SharedPerfIPCBlock\0Cor_Private_IPCBlock\0Cor_Public_IPCBlock_\0\0\xff30\xffffC:\Program Files\TurboTax\Deluxe 2006\32bit\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager\0\xffe0\xffff7&31153f81&0\0\27\xffe0\xffffLegacyDriver\0\23\xff68\xffffWindows Driver Foundation - User-mode Driver Framework Platform Driver\0\27\xfdb0\27\xff90\xffffProvide communciation services for UMDF components.\0\x59f8\e\xffe8\xffff\x686c\1\x49b8-\x86f8\x64f3\xa9b83\x86f8\x64f3\xff50\xffff\1\x8014\x90\0\x9c\0\24\0000\0\2\34\1\0\x8002\24\x1ff\17\x101\0\0\x100\0\0\2`\4\0\0\24\x1fd\2\x101\0\0\x500\22\0\0\30\x1ff\17\x201\0\0\x500 \0\x220\0\0\24\x18d\2\x101\0\0\x500\v\0\0\30\x1fd\2\x201\0\0\x500 \0\x223\0\x101\0\0\x500\22\0\x101\0\0\x500\22\0\x8250\32\xffa8\xffff\x6b6e \x80c\x3b5d\xb917\x1c7\0\0\x99c0P\1\0\0\0\xe148 \xffff\xffff\6\0\x3bf8\35\x1e8\0\xffff\xffff\20\0\0\0\30\0\x82\0\x175\0\6\0\x7557\x6664\x6452\23\xffc0\xffffsystem32\DRIVERS\wudfrd.sys\0er\xffd8\xffff\x6b76\v\x82\0\xca98 \1\0\1 \x6944\x7073\x616c\x4e79\x6d61e\0s\xfff0\xffff\x686c\1\xdba0 \x99d0\x313f\xfff8\xffff\xb578 \xffe8\xffff\x686c\1\x4fa0-\x86f8\x64f3\xafa03\x86f8\x64f3\xffa0\xffff\x6b6e \x1f26\x3b13\xb917\x1c7\0\0\xddc8 \0\0\0\0\xffff\xffff\xffff\xffff\2\0\x2278\16\x80a8\21\xffff\xffff\0\0\0\0,\0D\0\0\0\n\0\x6150\x6172\x656d\x6574\x7372\0\x5653\x5243\xffb8\xffff%SystemRoot%\System32\WUDFSvc.dll\0\xffa8\xffff\x6b6e \x264c\x3a78\xb917\x1c7\0\0\xddc8 \0\0\0\0\xffff\xffff\xffff\xffff\1\0\xb170\35\xd020\t\xffff\xffff\0\0\0\0\20\0\xa8\0\1\0\b\0\x6553\x7563\x6972\x7974\xff50\xffff\1\x8014\x90\0\x9c\0\24\0000\0\2\34\1\0\x8002\24\x1ff\17\x101\0\0\x100\0\0\2`\4\0\0\24\x1fd\2\x101\0\0\x500\22\0\0\30\x1ff\17\x201\0\0\x500 \0\x220\0\0\24\x18d\2\x101\0\0\x500\v\0\0\30\x1fd\2\x201\0\0\x500 \0\x223\0\x101\0\0\x500\22\0\x101\0\0\x500\22\0\1\0\xffa8\xffff\x6b6e \x4852\x1148\xf0d4\x1c7\0\0\xdba0 \0\0\0\0\xffff\xffff\xffff\xffff\0\0\xffff\xffff\x9ad8\32\xffff\xffff\0\0\0\0\0\0\0\0\1\0\a\0\x6f4c\x4367\x6e6ff\xff98\xffff\x6b6e \xfef4\x1428\xf0d4\x1c7\0\0\xdba0 \0\0\0\0\xffff\xffff\xffff\xffff\2\0\x77c8\r\xc078 \xffff\xffff\0\0\0\0(\0\x9e\0\0\0\21\0\x6544\x6976\x6563\x5020\x7261\x6d61\x7465\x7265\x8173\23\xdf40\23\xff90\xffffUSB\Vid_0ea0&Pid_2168&Rev_0100\0USB\Vid_0ea0&Pid_2168\0\0\xff68\xffffUSB\Class_08&SubClass_06&Prot_50\0USB\Class_08&SubClass_06\0USB\Class_08\0\0\x75c8\23\xffc0\xffffCompatible USB storage device\0\xfff0\xffff\x686c\1\xc3f0 #\0\xff68\xffff%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000\0\26\xffd8\xffffseabreeze\00069F52\0\0\0\xffd0\xffff\x7160\25\x4250\31\xa0b8 \xcb80\23\xaee0 \xa7e0 \xad98 \x4f80\25\xdc68\24\xadf0 \x5ef0\27\xfff8\xffff\xd4d0 \x6268\x6e69\xc000 \x1000\0\0\0\0\0\0\0\0\0\0\0\xffa8\xffff{36FC9E60-C465-11CF-8056-444553540000}\0\r\x8fb0\r\xff58\xffff\x6b73\r\x5a68\34\x2e58$\4\0\x90\0\1\x8004t\0\x84\0\0\0\24\0\2`\3\0\x1300\24\31\2\x101\0\0\x100\0\0\x1300\24?\17\x101\0\0\x500\22\0\x200\30?\17\x201\0\0\x500 \0\x220\0\0Root\LEGACY\x201\0\0\x500 \0\x220\0\x101\0\0\x500\22\0\xffa8\xffff\x6b6e \xed92\x13f6\xf0d4\x1c7\0\0\x2f50\0\0\0\0\0\xffff\xffff\xffff\xffff\n\0\xc288 \x1e8\0\xffff\xffff\0\0\0\0 \0B\0\20\0\4\0\x3030\x3631\x4b80\27\xffa0\xffff{36FC9E60-C465-11CF-8056-444553540000}\0016\0\x4088\27\xffd8\xffff\x6b76\n\26\0\x1b48'\1\0\1\x7ed2\x6544\x6976\x6563\x6544\x6373&\xc24\x7cb1\xfff8\xffff\xd8e0 \xffb8\xffffusb\class_08&subclass_06&prot_50\0\27\xffc8\xffffUSB Mass Storage Device\0\x6ae8\27\xffd0\xffff\x9830\35\x95f0\30\x30f8\36\x36d8\36\x3b08\36\x41e8\37\x90c8\37\x9f50\37\xca40\34\xadc8 \xc2d0\27\xffc8\xffff\x5a58\27\x20a8\34\x6b70\27\x1b50\26\xb1a0\31\xbe50\31\xb3c0\32\x54e0\26\x5260\26\xa6d0\30\xd570\30\x9fb8 \xd7f8\27\xff60\xffff\x6b6e \x14a0\x13fe\xf0d4\x1c7\0\0\x1230\1\1\0\0\0\xbef8 \xffff\xffff\1\0\xdbd0\27\x1e8\0\xffff\xffff\16\0\0\0\34\0J\0\b\0O\0\x2323\x233f\x5355\x2342\x6956\x5f64\x6530\x3061\x5026\x6469\x325f\x3631\x2338\x3030\x3030\x3030\x3030\x3030\x3030\x4236\x7b23\x3561\x6364\x6662\x3031\x362d\x3335\x2d30\x3131\x3264\x392d\x3130\x2d66\x3030\x3063\x6634\x3962\x3135\x6465}\xffa0\xffff\x686c\v\x938\e\x6b41\xb660\x7788\e\x562d\xde44\x12a8\1\xeb2f\x72b2\x52b8'\xf746\xd112\x2700\27\xd334\xdb6a\x4ac0\30\xaadb\x85c8\xeee8\27\x9cec\x7e85\x300'\x3341\x7733\x37f0\26\x1645\xe217\x47c8$\xbceb\x676b\xc2f0 \x5491\x8ce8\xffa8\xffff\x6b6e \x14a0\x13fe\xf0d4\x1c7\0\0\xc2f0 \0\0\0\0\xffff\xffff\xffff\xffff\1\0\xbb20 \x1e8\0\xffff\xffff\16\0\0\0\30\0\xa0\0\0\0\1\0\x3923\31\xbeb0\31\xffb0\xffffUSB\Vid_0ea0&Pid_2168\0000000000006B\0\31\xff58\xffff\\?\USB#Vid_0ea0&Pid_2168#0000000000006B#{a5dcbf10-6530-11d2-901f-00c04fb951ed}\0\x5e88\e\xff58\xffff\??\USB#Vid_0ea0&Pid_2168#0000000000006B#{a5dcbf10-6530-11d2-901f-00c04fb951ed}\35\xca18\35\xff80\xffff\x6b6e \xc516\x140e\xf0d4\x1c7\0\0\x3a40\26\1\0\0\0\xdc70 \xffff\xffff\0\0\xffff\xffff\x9ad8\32\xffff\xffff \0\0\0\0\0\0\0\3\0+\0\x6944\x6b73\x5626\x6e65\x535f\x6d69\x6c70\x2665\x7250\x646f\x425f\x6e6f\x617a\x5f69\x7058\x6572\x7373\x5226\x7665\x305f\x302e0\xfd00\35\xffa0\xffff\x6b6e \x7600\x176b\xf0d4\x1c7\0\0\xc5e8 \2\0\0\0\xf848\2\xffff\xffff\r\0\xeb40#\x9ad8\32\xffff\xffff"\0\0\0\34\0\x170\0\0\0\20\0\x3030\x3030\x3030\x3030\x3030\x3030\x4236\x3026\xffd8\xffff\x6b76\n\26\0\xc6f0 \1\0\1\36\x6544\x6976\x6563\x6544\x6373\36\x28e0\34\xffb8\xffffDisk drive\0ai Xpress USB Device\0\xa5a8\36\xffd8\xffff\x6b76\f\4\x8000\20\0\4\0\1\36\x6143\x6170\x6962\x696c\x6974\x7365\x9ad8\34\xffa8\xffff\x6b6e \xc516\x140e\xf0d4\x1c7\0\0\xc668 \0\0\0\0\xffff\xffff\xffff\xffff\0\0\xffff\xffff\x9ad8\32\xffff\xffff\0\0\0\0\0\0\0\0\1\0\a\0\x6f4c\x4367\x6e6ff\xffd8\xffff\x6b76\n\x170\0\xd020 \a\0\1\36\x6148\x6472\x6177\x6572\x4449\36\xbee8\35\xffd8\xffff\x6b76\r4\0\xc808 \a\0\1\37\x6f43\x706d\x7461\x6269\x656c\x4449\x1d73\37\xffc8\xffffUSBSTOR\Disk\0USBSTOR\RAW\0\0\xffd8\xffff\x6b76\tN\0\xd198 \1\0\1\37\x6c43\x7361\x4773\x4955\x2e44\37\xdf78\35\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\37\x6f43\x666e\x6769\x6c46\x6761s\x2820\37\xfff0\xffff\x686c\1\xd6e8 \xe918\xb548\xfff0\xffff\x686c\1\xd888 #\0\xfeb0\xffff\xf6d8\1\x4108\t\x4168\r\x42a8\r\x3bd0\r\x34b8\22\xe18\16\xc218\22\xc1f8\22\x19e8\23\x2020\23\x2240\23\x2310\23\x2598\23\x29c0\23\x2c38\23\x1830\23\x2f90\23\x2a00\23\x1d30\23\x1d50\23\x34e0\23\x4368\23\x4d38\23\x5d10\23\x4f70\23\x5fb0\23\x6388\23\x6888\23\x6978\23\x6e30\23\x6310\23\x74b8\23\x7778\23\x7bb0\23\x7958\23\x99a0\23\xa040\23\x7980\23\x8408\23\x7cf8\23\x8588\23\x8658\23\x94f0\23\x9a78\23\x9be8\23\x9d60\23\x9e88\23\xa300\23\xa320\23\xa380\23\xbb50\23\xc608\23\xca70\23\xcc40\23\xc4e8\23\xda40\23\xe108\23\xeef0\23\xe6a0\23\xfd48\23\xec50\23\xf408\23\xf528\23\xf550\23\xede0\23\xf670\23\x148\24\xa30\24\x1bf0\24\x1da0\24\x1de8\24\x22d0\24\x26f8\24\x2d48\24\xd10\24\x1fb8\24\x1fd8\24\x2750\24\x2770\24\x3020\24\x3180\24\x53b8\27\xff98\xffff\x6b6e \xcd80\xcaeb\xeb0a\x1c7\0\0\xf778Q\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xb4f8\23\x80a8\21\xffff\xffff\0\0\0\0\16\0&\0\1\0\21\0\x6e49\x6574\x6e72\x7465\x4520\x7078\x6f6c\x6572rWS\\xffd0\xffffInternet Explorer\0\0\0\xecb8\23\xff78\xffffWindows Driver Foundation - User-mode Driver Framework Reflector\0\37\xffd8\xffff\x6b76\vh\0\xcb48 \1\0\1\23\x6544\x6373\x6972\x7470\x6f69n\0000\xff90\xffffReflect device requests to user-mode driver drivers\0\xbe90\27\xffe0\xffffLegacyDriver\0\x7265\xfff8\xffff\xeb68 \xffa8\xffff\x6b6e \x678a\x3b9d\xb917\x1c7\0\0\xac90 \0\0\0\0\xffff\xffff\xffff\xffff\1\0\x87b8\30\xd020\t\xffff\xffff\0\0\0\0\20\0\xa8\0\0\0\b\0\x6553\x7563\x6972\x7974\xffd8\xffff\x6b76\f\4\x8000\1\0\4\0\1\17\x7245\x6f72\x4372\x6e6f\x7274\x6c6f\x2238\17\xfff8\xffff\xd960 \xffe8\xffff\xe2b2\x1c06\xb27b\xa9e7\xf04b\x5c71\x9a98\x4f6d\xc80&\xffd8\xffff\x6b76\f\4\x8000\1\0\4\0\1c\x7245\x6f72\x4372\x6e6f\x7274\x6c6f\x6369e\xffd8\xffff\x6b76\tl\0\xccd0 \2\0\1\0\x6d49\x6761\x5065\x7461\x8068\21\x2140&\xff90\xffff%SystemRoot%\system32\svchost.exe -k WudfServiceGroup\0\xffd8\xffff\x6b76\vn\0\xcd68 \1\0\1d\x6944\x7073\x616c\x4e79\x6d61exe\xff88\xffffWindows Driver Foundation - User-mode Driver Framework\0\0\x6b6e \xffd8\xffff\x6b76\17\24\0\x23a8\22\a\0\1\0\x6544\x6570\x646e\x6e4f\x6553\x7672\x6369e\xffd8\xffff\x6b76\r\2\x8000\0\0\a\0\1\0\x6544\x6570\x646e\x6e4f\x7247\x756f\x6970\x7974\xffd8\xffff\x6b76\16,\0\xcf30 \3\0\0014\x6146\x6c69\x7275\x4165\x7463\x6f69\x736e\0\xffd8\xffff\x6b76\n\30\0\x89f0\35\1\0\1\0\x624f\x656a\x7463\x614e\x656d\0\0\x500\xffd8\xffff\x6b76\vP\0\xcea8 \1\0\1\21\x6544\x6373\x6972\x7470\x6f69n\0\0\xffa8\xffffManages user-mode driver host processes\0\x6b73 \xffd8\xffff\x6b76\nD\0\xbba0 \2\0\1\21\x6553\x7672\x6369\x4465\x6c6c\21\x7ef8\21\b\0\x1d8&\xffd0\xffff\x384\0\0\0\0\0\3\0Se\1\0\xd4c0\1\1\0\x93e0\4\0\0\0\0\xffd8\xffff\x6b76\16\4\x8000\1\0\4\0\0014\x6553\x7672\x6369\x5365\x6469\x7954\x6570\0\xffc8\xffff\x4760\35\x48c8\35\xcc80 \xcca8 \xcd40 \x6800\35\xcde0 \xce08 \xce58 \xce80 \xce30 \xcf60 \1\0\xffd0\xffff\x6b76\26\4\x8000\1\0\4\0\1\21\x6553\x7672\x6369\x4465\x6c6c\x6e55\x6f6c\x6461\x6e4f\x7453\x706fv\b\0\xf650%\xfff8\xffff\xefb0 \x6268\x6e69\xd000 \x1000\0\0\0\0\0\0\0\0\0\0\0\xfe88\xffffUSBSTOR\DiskSimple__Bonzai_Xpress___0.00\0USBSTOR\DiskSimple__Bonzai_Xpress___\0USBSTOR\DiskSimple__\0USBSTOR\Simple__Bonzai_Xpress___0\0Simple__Bonzai_Xpress___0\0USBSTOR\GenDisk\0GenDisk\0\0\x47a8\27\xffa8\xffff{4D36E967-E325-11CE-BFC1-08002BE10318}\0\27\x4d48\27\xffd8\xffff\x6b76\r\b\0\xda88 \1\0\1&\x6e49\x5366\x6365\x6974\x6e6f\x7845\x1674&\xff98\xffff\x6b6e \x3ab4\x1770\xf0d4\x1c7\0\0\xc668 \1\0\0\0\xb698 \xffff\xffff\0\0\xffff\xffff\xc078 \xffff\xffff.\0\0\0\0\0\0\0\0\0\21\0\x6544\x6976\x6563\x5020\x7261\x6d61\x7465\x7265\x8b73\27\xb7e0\27\xff98\xffff\x6b6e \xc516\x140e\xf0d4\x1c7\0\0\xd218 \0\0\0\0\xffff\xffff\xffff\xffff\0\0\xffff\xffff\x5a68\34\xffff\xffff\0\0\0\0\0\0\0\0\0\0\27\0\x654d\x6964\x4361\x6168\x676e\x4e65\x746f\x6669\x6369\x7461\x6f69n\xff40\xffff\x6b6e \x758c\x141f\xf0d4\x1c7\0\0\xc5e8\2\1\0\0\0\xb6a8 \xffff\xffff\1\0\xdc80\27\x1e8\0\xffff\xffff\16\0\0\0\34\0\x8a\0\4\0o\0\x2323\x233f\x5355\x5342\x4f54\x2352\x6944\x6b73\x5626\x6e65\x535f\x6d69\x6c70\x2665\x7250\x646f\x425f\x6e6f\x617a\x5f69\x7058\x6572\x7373\x5226\x7665\x305f\x302e\x2330\x3030\x3030\x3030\x3030\x3030\x3030\x4236\x3026\x7b23\x3335\x3566\x3336\x3730\x622d\x6236\x2d66\x3131\x3064\x392d\x6634\x2d32\x3030\x3061\x3963\x6531\x6266\x6238}\xffc0\xffff\x686c\a\x3230$\xfa9b\x6a14\x43e8$\x3188\xdb26\x25f8'\x458e\xcc6\x6430\26\xecfa\x6bc0\x6580\30\x5a35\xf3de\xf930\27\xd71e\x1e48\xd2e8 \x34dc\xfb5\xffa8\xffff\x6b6e \x758c\x141f\xf0d4\x1c7\0\0\xd2e8 \0\0\0\0\xffff\xffff\xffff\xffff\1\0\xbff8 \x1e8\0\xffff\xffff\16\0\0\0\30\0\xe0\0\0\0\1\0\x8523\31\x8c48\31\xff70\xffffUSBSTOR\Disk&Ven_Simple&Prod_Bonzai_Xpress&Rev_0.00\0000000000006B&0\0\32\xffd8\xffff\x6b76\f\xe0\0\xd4f8 \1\0\1\32\x7953\x626d\x6c6f\x6369\x694c\x6b6e\xc328\32\xff18\xffff\\?\USBSTOR#Disk&Ven_Simple&Prod_Bonzai_Xpress&Rev_0.00#0000000000006B&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\0\xb408\35\xffd0\xffff\x6b76\27\4\x8000\1\0\4\0\1\35\x654e\x7478\x6150\x6572\x746e\x4449\x332e\x3131\x3335\x3866\x2e317\xffd8\xffff\x6b76\16\32\0\xb840 \1\0\1\35\x6150\x6572\x746e\x6449\x7250\x6665\x7869\e\xffa0\xffff\x6b6e \xf566\x184d\xf0d4\x1c7\0\0\x8160\26\1\0\0\0\xc890 \xffff\xffff\t\0\xc6d8#\x9ad8\32\xffff\xffff\16\0\0\0\32\0X\0\1\0\17\0\x2637\x3133\x3531\x6633\x3138\x3026\x5226M\xffd8\xffff\x6b76\f\4\x8000`\0\4\0\1\35\x6143\x6170\x6962\x696c\x6974\x7365\x29b8\36\xffd8\xffff\x6b76\v\4\x8000\0\0\4\0\1\35\x6f43\x666e\x6769\x6c46\x6761s\x2360\34\xffa8\xffff\x6b6e \x758c\x141f\xf0d4\x1c7\0\0\xd638 \0\0\0\0\xffff\xffff\xffff\xffff\0\0\xffff\xffff\x9ad8\32\xffff\xffff\0\0\0\0\0\0\0\0\0\0\a\0\x6f4c\x4367\x6e6ff\xffd8\xffff\x6b76\n \0\xd768 \a\0\1\36\x6148\x6472\x6177\x6572\x4449\36\xaf80\36\xffd8\xffffSTORAGE\Volume\0\0\xbdb8\36\xffd8\xffff\x6b76\r \0\xd7b8 \a\0\1\36\x6f43\x706d\x7461\x6269\x656c\x4449\xd773\36\xffd8\xffffSTORAGE\Volume\0\0\xbee8\35\xff58\xffff\x6b6e \x758c\x141f\xf0d4\x1c7\0\0\x85e0\26\1\0\0\0\xc8a0 \xffff\xffff\1\0\xc200 \x1e8\0\xffff\xffff\16\0\0\0\34\0N\0\1\0Q\0\x2323\x233f\x5453\x524f\x4741\x2345\x6552\x6f6d\x6176\x6c62\x4d65\x6465\x6169\x3723\x3326\x3131\x3335\x3866\x2631\x2630\x4d52\x7b23\x3335\x3566\x3336\x6130\x622d\x6236\x2d66\x3131\x3064\x392d\x6634\x2d32\x3030\x3061\x3963\x6531\x6266\x6238\xc7d\37\xca8\37\xffa8\xffff\x6b6e \x758c\x141f\xf0d4\x1c7\0\0\xd7e0 \0\0\0\0\xffff\xffff\xffff\xffff\1\0\xcc60 \x1e8\0\xffff\xffff\16\0\0\0\30\0\xa4\0\0\0\1\0\x5b23\37\x5480\37\xffd8\xffff\x6b76\16N\0\xd908 \1\0\1\37\x6544\x6976\x6563\x6e49\x7473\x6e61\x6563\37\xffa8\xffffSTORAGE\RemovableMedia\7&31153f81&0&RM\0\37\x4ab8\37\xffd8\xffff\x6b76\f\xa4\0\xd988 \1\0\1\37\x7953\x626d\x6c6f\x6369\x694c\x6b6e\x5ab8\37\xff58\xffff\\?\STORAGE#RemovableMedia#7&31153f81&0&RM#{53f5630a-b6bf-11d0-94f2-00a0c91efb8b}\0\xffa8\xffff\x6b6e \x57c0\x1850\xf0d4\x1c7\0\0\xcc38#\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x5ff8#\x1e8\0\xffff\xffff\16\0\0\0\30\0\xa4\0\0\0\1\0#\C:\xfff0\xffff.NT\0\xd368\31\xffd0\xffff\xb28\23\x2e10\23\x1b90\22\x86f8\22\x3c58\23\x3e90\23\x3990\23\x3fd0\23\x3320\23\xf020\23m3\xff98\xffff\x6b6e \x67e8\xbdd8\xeb0a\x1c7\0\0\x82d0R\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xf548\r\x80a8\21\xffff\xffff\0\0\0\0 \0@\0O\0\30\0\x6e49\x6574\x6e72\x7465\x4520\x7078\x6f6c\x6572\x2072\x2037\x6944\x6b73\xffb8\xffff%SystemRoot%\System32\spmsg.dll\0r\0\xffd8\xffff\x6b76\16\4\x8000\a\0\4\0\1 \x7954\x6570\x5373\x7075\x6f70\x7472\x6465\x6465\xffa0\xffff\x6b6e \xed92\x13f6\xf0d4\x1c7\0\0\xb630 \2\0\0\0\x1958\22\xffff\xffff\f\0\xc2b8 \x9ad8\32\xffff\xffff"\0\0\0&\0\x90\0\0\0\16\0\x3030\x3030\x3030\x3030\x3030\x3030\x4236\23\xffd8\xffff\x6b76\f\x9e\0\xc540 \1\0\1\23\x7953\x626d\x6c6f\x6369\x614e\x656d??\xffb8\xffff\x6b76)\x92\0\xb020 \1\0\1t\x7725\x6e69\x6964\x2572\x4e5c\x7465\x6f77\x6b72\x4420\x6169\x6e67\x736f\x6974\x5c63\x7078\x656e\x6474\x6169\x2e67\x7865eer\0\xfff0\xffff\x686c\1\xc668 \x8efe\x5d1d\b\0\xf8e0%\xffd0\xffff\x6b76\25\20\0\xcc68 \3\0\1&\x6257\x6d65\x6441\x7061\x6946\x656c\x6953\x6e67\x7461\x7275\x1b65&\xfff8\xffff\xefd8 \xffa8\xffff\x6b6e \xe3da\x3b17\xb917\x1c7\0\0\xba50 \0\0\0\0\xffff\xffff\xffff\xffff\1\0\x35b0\35\xd020\t\xffff\xffff\0\0\0\0\20\0\xa8\0\0\0\b\0\x6553\x7563\x6972\x7974\xff50\xffff\1\x8014\x90\0\x9c\0\24\0000\0\2\34\1\0\x8002\24\x1ff\17\x101\0\0\x100\0\0\2`\4\0\0\24\x1fd\2\x101\0\0\x500\22\0\0\30\x1ff\17\x201\0\0\x500 \0\x220\0\0\24\x18d\2\x101\0\0\x500\v\0\0\30\x1fd\2\x201\0\0\x500 \0\x223\0\x101\0\0\x500\22\0\x101\0\0\x500\22\0\x8198\27\xffa8\xffff\x6b6e \x1f26\x3b13\xb917\x1c7\0\0\x99c0P\2\0\0\0\x50d0\23\xffff\xffff\f\0\xcf88 \x1e8\0\xffff\xffff\24\0\0\0\36\0n\0\x16c\0\a\0\x7557\x6664\x7653c\xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1\n\x6257\x6d65\x6441\x7061\x7453\x7461\x7375\n\xfff8\xffff\xec18 \xffd8\xffff\x6b76\20\4\x8000\xe800\25\4\0\1\0\x6257\x6d65\x6441\x7061\x6946\x656c\x6953\x657a\xffc8\xffff\x4b48\n\x4ba0\n\x4c10\n\x4c78\n\xdc88 \x4db8\n\xde50 \xde20 \xf988\1\xf4b0\1\xf4d8\1\xf500\1\xf528\1\xffd0\xffff\x6b76\25\20\0\xdee0 \3\0\1\0\x6257\x6d65\x6441\x7061\x6946\x656c\x6953\x6e67\x7461\x7275e\0\xffe8\xffff\xe2b2\x1c06\xb27b\xa9e7\xf04b\x5c71\x9a98\x4f6d\0\0\xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1\n\x6257\x6d65\x6441\x7061\x7453\x7461\x7375\n\xfff8\xffff\xed00 \xffd8\xffff\x6b76\20\4\x8000\xe800\25\4\0\1\0\x6257\x6d65\x6441\x7061\x6946\x656c\x6953\x657a\xffc8\xffff\x4fb8\n\x4fd8\n\x5098\n\x50f8\n\xdeb0 \x5238\n\xdf28 \xdef8 \x66a8\0\x66d0\0\x6eb0\0\x6ed8\0\xf960\1\xffd0\xffff\x6b76\25\20\0\xdfb8 \3\0\1\0\x6257\x6d65\x6441\x7061\x6946\x656c\x6953\x6e67\x7461\x7275e\0\xffe8\xffff\xe2b2\x1c06\xb27b\xa9e7\xf04b\x5c71\x9a98\x4f6d\0\0\xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1\f\x6257\x6d65\x6441\x7061\x7453\x7461\x7375\f\xfff8\xffff\xede8 \x6268\x6e69\xe000 \x1000\0ble\0\xdfd1\x5dcf\xdfd1\x5dcf\0\0\xffd8\xffff\x6b76\20\4\x8000\xe800\25\4\0\1\x5dc9\x6257\x6d65\x6441\x7061\x6946\x656c\x6953\x657a\xffc8\xffff\x190\f\x1f0\f\x260\f\x2c8\f\xdf88 \x6610\f\xe020 \xdfd0 \xf550\1\xf578\1\xf638\1\xf660\1\xf688\1\xffd8\xffff\x7248\23\xbd70\24\xace8 \xacd8\27\xad10 \xe0f8 \xfc68\e\xe120 st\xffd8\xffff\x6b76\t8\0\xbaa8 \2\0\1 \x6d49\x6761\x5065\x7461hr\0\0\xffe0\xffff\x6b76\a\20\0\xb430 \1\0\1*\x6553\x7672\x6369e\xfff8\xffff\xeed0 \xffd8\xffff\x6b76\v\x8e\0\xb880 \1\0\1 \x6944\x7073\x616c\x4e79\x6d61\x4e65F"\xffd8\xffff\x6b76\vh\0\xb918 \1\0\1\b\x6544\x6373\x6972\x7470\x6f69n\xe3f0\35\xfff0\xffff\x686c\1\xdcc0 \xe2d0\xe465\xffd0\xffff\x6b76\25\20\0\xe188 \3\0\1 \x6257\x6d65\x6441\x7061\x6946\x656c\x6953\x6e67\x7461\x7275eA\xffe8\xffff\x86ba\x328a\x6eeb\xebb8\xffd2\x860d\x8079\xef1dME\xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1\17\x6257\x6d65\x6441\x7061\x7453\x7461\x7375&\xffd8\xffff\x6b76\20\b\0\xe1f0 \3\0\1R\x6257\x6d65\x6441\x7061\x6946\x656c\x6954\x656d\xfff0\xffff\xf800\x37f8\x4f4b\x01c2CO\xffd8\xffff\x6b76\20\4\x8000\x6800\0\4\0\1E\x6257\x6d65\x6441\x7061\x6946\x656c\x6953\x657a\xffd0\xffff\xb990\16\xb9d8\16\xba28\16\xba50\16\xbaa8\16\xbae8\16\xbb50\16\xe158 \xe1c8 \xe200 \xe1a0 \xffd0\xffff\x6b76\25\20\0\xe288 \3\0\1T\x6257\x6d65\x6441\x7061\x6946\x656c\x6953\x6e67\x7461\x7275eN\xffe8\xffff\x6a63\xaa03\x952\x2efc\x1684\x46a7\x98b1\x5561 W\xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1\17\x6257\x6d65\x6441\x7061\x7453\x7461\x7375&\xffd8\xffff\x6b76\20\b\0\xe2f0 \3\0\1O\x6257\x6d65\x6441\x7061\x6946\x656c\x6954\x656d\xfff0\xffff\xf800\x37f8\x4f4b\x1c2 D\xffd8\xffff\x6b76\20\4\x8000\x4200\0\4\0\1 \x6257\x6d65\x6441\x7061\x6946\x656c\x6953\x657a\xffd0\xffff\xbc30\16\xbc80\16\xbcd8\16\xbd00\16\xbd58\16\xbda8\16\xbe10\16\xe258 \xe2c8 \xe300 \xe2a0 \xffd0\xffff\x6b76\25\20\0\xe388 \3\0\1W\x6257\x6d65\x6441\x7061\x6946\x656c\x6953\x6e67\x7461\x7275e \xffe8\xffff\x77fc\x3cc6\xae47\xd2d\x58b\x6eda\x78c1\xf5cT \xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1\17\x6257\x6d65\x6441\x7061\x7453\x7461\x7375&\xffd8\xffff\x6b76\20\b\0\xe3f0 \3\0\1I\x6257\x6d65\x6441\x7061\x6946\x656c\x6954\x656d\xfff0\xffff\xf800\x37f8\x4f4b\x01c2AR\xffd8\xffff\x6b76\20\4\x8000\x6200\0\4\0\1N\x6257\x6d65\x6441\x7061\x6946\x656c\x6953\x657a\xffd0\xffff\xbef0\16\xbf30\16\xbf80\16\xbfa8\16\xc020\16\xc078\16\xc0d8\16\xe358 \xe3c8 \xe400 \xe3a0 \xffd0\xffff\x6b76\25\20\0\xe488 \3\0\1E\x6257\x6d65\x6441\x7061\x6946\x656c\x6953\x6e67\x7461\x7275e \xffe8\xffff\x426\x1d41\x62b3\xc7f3\x6bd4\x31ab\x2f36\x550bLE\xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1\17\x6257\x6d65\x6441\x7061\x7453\x7461\x7375&\xffd8\xffff\x6b76\20\b\0\xe4f0 \3\0\1 \x6257\x6d65\x6441\x7061\x6946\x656c\x6954\x656d\xfff0\xffff\xf800\x37f8\x4f4b\x1c2ON\xffd8\xffff\x6b76\20\4\x8000\x8800\0\4\0\1C\x6257\x6d65\x6441\x7061\x6946\x656c\x6953\x657a\xffd0\xffff\xc1b8\16\xc208\16\xc268\16\xc290\16\xc2e8\16\xc368\16\xc3d8\16\xe458 \xe4c8 \xe500 \xe4a0 \xffd0\xffff\x6b76\25\20\0\xe588 \3\0\1R\x6257\x6d65\x6441\x7061\x6946\x656c\x6953\x6e67\x7461\x7275e \xffe8\xffff\x45b4\x139d\x3d47\xfc07\x33b4\xc065\x3227\x16deW \xffd8\xffff\x6b76\20\b\0\xe5c8 \3\0\1 \x6257\x6d65\x6441\x7061\x6946\x656c\x6954\x656d\xfff0\xffff\xf800\x37f8\x4f4b\x1c2 U\xffd0\xffff\x6b76\25\20\0\xe668 \3\0\1\17\x6257\x6d65\x6441\x7061\x6946\x656c\x6953\x6e67\x7461\x7275\x6e65\17\xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1M\x6257\x6d65\x6441\x7061\x7453\x7461\x7375)\xffc8\xffff\xdcb8\16\xdcf8\16\xdd50\16\xddb0\16\xde10\16\xde38\16\xde80\16\xdea8\16\xe558 \xe5a0 \xded0\16\xe608 eb\xffe8\xffff\xb0b0\x90d7\xc75a\xc21b\xf178\x457f\x185e\x1126 \xffd8\xffff\x6b76\20\b\0\xe6a8 \3\0\1R\x6257\x6d65\x6441\x7061\x6946\x656c\x6954\x656d\xfff0\xffff\xf800\x37f8\x4f4b\x01c2AN\xffd0\xffff\x6b76\25\20\0\xe748 \3\0\1\17\x6257\x6d65\x6441\x7061\x6946\x656c\x6953\x6e67\x7461\x7275\xea65\17\xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1A\x6257\x6d65\x6441\x7061\x7453\x7461\x7375I\xffc8\xffff\x57f0\17\x5848\17\x58a0\17\x58f8\17\x5960\17\x5988\17\x59d0\17\x59f8\17\xe5d8 \xe680 \x5a20\17\xe6e8 \x8118\32\xffe8\xffff\xddf9\x9e79\xed07\x2850\x2fdb\xfe1f\x2ca7\x5793\x8f4c\x5dc9\xffd8\xffff\x6b76\20\b\0\xe788 \3\0\1\x5dca\x6257\x6d65\x6441\x7061\x6946\x656c\x6954\x656d\xfff0\xffff\xf800\x37f8\x4f4b\x1c2\xdfd1\x5dcf\xffd0\xffff\x6b76\25\20\0\xe828 \3\0\1\20\x6257\x6d65\x6441\x7061\x6946\x656c\x6953\x6e67\x7461\x7275\x1265\20\xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1\x5dc9\x6257\x6d65\x6441\x7061\x7453\x7461\x7375\x5dc9\xffc8\xffff\x7fb0\17\x7fd0\17\x8090\17\x80f0\17\x8178\17\x81a0\17\x81e8\17\x8210\17\xe6b8 \xe760 \x8238\17\xe7c8 Co\xffe8\xffff\x7e77\x9db2\x3501\x1ad8\x82d9\x2b8a\x4405\x9634on\xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1\20\x6257\x6d65\x6441\x7061\x7453\x7461\x7375&\xffd8\xffff\x6b76\20\b\0\xe890 \3\0\1\x5dcf\x6257\x6d65\x6441\x7061\x6946\x656c\x6954\x656d\xfff0\xffff\xf800\x37f8\x4f4b\x1c2\x1999\x5dd0\xffd8\xffff\x6b76\20\4\x8000\x3c00\2\4\0\1\x5dd0\x6257\x6d65\x6441\x7061\x6946\x656c\x6953\x657a\xffd0\xffff\xc3c0\17\xc4f8\17\xc548\17\xc570\17\xc5c8\17\xc5f0\17\xc648\17\xe798 \xe868 \xe8a0 \xe840 \xffd0\xffff\x6b76\25\20\0\xe928 \3\0\1\x5dcf\x6257\x6d65\x6441\x7061\x6946\x656c\x6953\x6e67\x7461\x7275\xdf65\x5dcf\xffe8\xffff\x5169\x9bb8\x594f\xa61a\x494\x6c8a\xe5d0\x4a22\xdfd1\x5dcf\xffd8\xffff\x6b76\20\b\0\xe968 \3\0\1\x5dcf\x6257\x6d65\x6441\x7061\x6946\x656c\x6954\x656d\xfff0\xffff\xf800\x37f8\x4f4b\x01c2Ci\xffd8\xffff\x6b76\20\4\x8000\x1600\0\4\0\1\0\x6257\x6d65\x6441\x7061\x6946\x656c\x6953\x657a\xffd8\xffff\xfd50\17\xff40\17\xffa0\17 \20`\20\xe8f8 \xe940 \xe978 \xe9c8 \xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1c\x6257\x6d65\x6441\x7061\x7453\x7461\x7375m\xffd0\xffff\x6b76\25\20\0\xea20 \3\0\1.\x6257\x6d65\x6441\x7061\x6946\x656c\x6953\x6e67\x7461\x7275\xd065\x5dd4\xffe8\xffff\x4996\x722c\x6e1c\x17a5\xbfe2\x38d5\xef1f\xe355\x198f\x5dd0\xffd8\xffff\x6b76\20\b\0\xea60 \3\0\1\x5dd4\x6257\x6d65\x6441\x7061\x6946\x656c\x6954\x656d\xfff0\xffff\xf800\x37f8\x4f4b\x1c2\xc400\x5dc9\xffd8\xffff\x6b76\20\4\x8000\x9c00\0\4\0\1\x5dc9\x6257\x6d65\x6441\x7061\x6946\x656c\x6953\x657a\xffd8\xffff\x1738\20\x2ae0\20\x2b40\20\x2b80\20\x2bf0\20\xe9f0 \xea38 \xea70 \xeac0 \xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1\x5dd0\x6257\x6d65\x6441\x7061\x7453\x7461\x7375\x5dc9\xffd0\xffff\x6b76\25\20\0\xeb18 \3\0\1n\x6257\x6d65\x6441\x7061\x6946\x656c\x6953\x6e67\x7461\x7275e:\xffe8\xffff\xfd7e\x1421\xd1ea\x72ac\x2634\xd710\x2b19\x32fbtr\xffd8\xffff\x6b76\20\b\0\xeb58 \3\0\1y\x6257\x6d65\x6441\x7061\x6946\x656c\x6954\x656d\xfff0\xffff\xf800\x37f8\x4f4b\x1c2nt\xffd8\xffff\x6b76\tN\0\xf288 \1\0\1\20\x6c43\x7361\x4773\x4955\xcc44\20\xcc50\20\xfff0\xffff\x268!\x418!\x2ae8&\b\0\xff68%\xffd8\xffff\x6b76\16\4\x8000\0\0\4\0\1a\x6257\x6d65\x6441\x7061\x7453\x7461\x7375c\xffb8\xffff\x3828\20\x3a70\20\x3aa8\20\x3af8\20\x3b38\20\x3b78\20\x3bd8\20\x3c00\20\x3c50\20\x3c78\20\x3c28\20\x3cd0\20\xeae8 \xeb30 \x3d00\20\xeba8 em\xffd8\xffff\x6b76\tN\0\xec40 \1\0\1\x69ce\x6c43\x7361\x4773\x4955\xa344\21\xdc6b\x69ce\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\2\xec78\x69ce\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xdf20 \x6410$\xffff\xffff\0\0\0\0\22\0N\0\x13a\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3962\x6426\x7665\x315f\x3236\x3731\x69cf\xffd8\xffff\x6b76\tN\0\xed28 \1\0\1\x69cf\x6c43\x7361\x4773\x4955\x9544\2\x4204\x69cf\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\2\x5223\x69cf\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xdff8 \x6410$\xffff\xffff\0\0\0\0\22\0N\0\x13b\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3962\x6426\x7665\x315f\x3436\xdc37\xf904\xffd8\xffff\x6b76\tN\0\xee10 \1\0\1\x8aeb\x6c43\x7361\x4773\x4955\xab44\2\xc9af\xd33d\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0&\xe015\xad3f\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xe0f0 \x6410$\xffff\xffff\0\0\0\0\22\0N\0\x13c\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3962\x6426\x7665\x315f\x3536\x5931\x1006\xffd8\xffff\x6b76\tN\0\xa10!\1\0\1\x3b57\x6c43\x7361\x4773\x4955\xbf44\2\x5d3a\x4d93\b\0\xf208%\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x8f00\a\x6410$\xffff\xffff\0\0\0\0\22\0N\0,\0\b\0\x702a\x706e\x3030\x3430\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\x5348\x5dc6\xffd8\xffff\x6b76\tN\0\xf338 \1\0\1\x8000\x6c43\x7361\x4773\x4955D\0\x240\x8000\xffd8\xffff\x6b76\tN\0\xf3e8 \1\0\1\x5dc6\x6c43\x7361\x4773\x4955D\0\x5290\x5dc6\x6268\x6e69\xf000 \x1000\0\0\0\0\0\0\0\0\0\0\0\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x49a0\17\x6410$\xffff\xffff\0\0\0\0\22\0N\0.\0\b\0\x702a\x706e\x3130\x3130\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x16b8\21\x6410$\xffff\xffff\0\0\0\0\22\0N\0000\0\b\0\x702a\x706e\x3230\x3130\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x17d0\21\x6410$\xffff\xffff\0\0\0\0\22\0N\0E\0\b\0\x702a\x706e\x6130\x3530\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xcbd8 \x6410$\xffff\xffff\0\0\0\0\22\0N\0F\0\b\0\x702a\x706e\x6130\x3630\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xcff8 \x6410$\xffff\xffff\0\0\0\0\22\0N\0H\0\b\0\x702a\x706e\x6330\x3030\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xdcb8 \x6410$\xffff\xffff\0\0\0\0\22\0N\0J\0\b\0\x702a\x706e\x6330\x3230\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xf518 \x6410$\xffff\xffff\0\0\0\0\22\0N\0M\0\b\0\x702a\x706e\x6330\x6230\xffd8\xffff\x6b76\tN\0\xf4c0 \1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\xf498 \xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xf5f8 \x6410$\xffff\xffff\0\0\0\0\22\0N\0N\0\b\0\x702a\x706e\x6330\x6330\xffd8\xffff\x6b76\tN\0\xf5a0 \1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\xf578 \xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xf6d8 \x6410$\xffff\xffff\0\0\0\0\22\0N\0O\0\b\0\x702a\x706e\x6330\x6430\xffd8\xffff\x6b76\tN\0\xf680 \1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\xf658 \xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xf7b8 \x6410$\xffff\xffff\0\0\0\0\22\0N\0P\0\b\0\x702a\x706e\x6330\x6530\xffd8\xffff\x6b76\tN\0\xf760 \1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\xf738 \xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xf898 \x6410$\xffff\xffff\0\0\0\0\22\0N\0Q\0\b\0\x702a\x706e\x6330\x3531\xffd8\xffff\x6b76\tN\0\xf840 \1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\xf818 \xffa0\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xf980 \x6410$\xffff\xffff\0\0\0\0\22\0N\0W\0\17\0\x6361\x6970\x6423\x636f\x646b\x7665\x6369e\xffd8\xffff\x6b76\tN\0\xf928 \1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\xf900 \xffd8\xffff\x6b76\nT\0\xb0d0"\b\0\1\0\x6f42\x746f\x6f43\x666e\x6769\x7469y\0\xfff8\xffff\xffb0 \xffd8\xffff\x6b76\tN\0\xfb90 \1\0\1d\x6c43\x7361\x4773\x4955D&_s\xfff8\xffff\xf9b8 \xfff8\xffff\xfc48 \xfff8\xffff\xff88 \xfff8\xffff\xa68!\xff90\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x9148\a\x6410$\xffff\xffff\0\0\0\0\22\0N\0Y\0\36\0\x6361\x6970\x6423\x636f\x646b\x7665\x6369\x2665\x735f\x5f62\x702e\x6963\x2e5f\x616f\x5f6b\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffd8\xffff\x6b76\v\20\0\xfaf0 \1\0\1D\x6944\x7073\x616c\x4e79\x6d61e\a\xffe8\xffffSparrow\0\0\0\xfff0\xffff\x4d98"\x5150"3\0\xff88\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xf9e0 \x6410$\xffff\xffff\0\0\0\0\22\0N\0X\0#\0\x6361\x6970\x6423\x636f\x646b\x7665\x6369\x2665\x735f\x5f62\x702e\x6963\x2e5f\x7369\x5f61\x732e\x636ce\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffa0\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xf9e8 \x6410$\xffff\xffff\0\0\0\0\22\0N\0[\0\20\0\x6361\x6970\x7423\x6568\x6d72\x6c61\x6f7a\x656e\xffd8\xffff\x6b76\tN\0\xfc70 \1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xfd90 \x6410$\xffff\xffff\0\0\0\0\22\0N\0\xfb\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3534\x6426\x7665\x635f\x32382 \xffd8\xffff\x6b76\tN\0\xd088!\1\0\1l\x6c43\x7361\x4773\x4955D\0is\xfff0\xffff\xd1b8!\xd180!rp\xffd8\xffff\x6b76\tN\0\xcea8!\1\0\1 \x6c43\x7361\x4773\x4955Det \xfff0\xffff\xfd68 \xcfc0!\0C\xffd8\xffff\x6b76\tN\0\xcf68!\1\0\1 \x6c43\x7361\x4773\x4955De\0t\xfff0\xffff\xfda0 \xcd50!\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x2da8\17\x6410$\xffff\xffff\0\0\0\0\22\0N\0\xcb\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3532\x6426\x7665\x315f\x33345\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffe0\xffff\x6b76\a\16\0\xff10 \1\0\1\0\x6553\x7672\x6369e\xffe8\xffffisapnp\0\0\0\0\xffa0\xffff\x6b6e \x1190\x8b60\xbf27\x1c3\0\0\x2e8\0\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xf9f0 \x6410$\xffff\xffff\0\0\0\0\26\0\4\0\37\0\t\0\x7250\x636f\x7365\x6f73r\0\0\0\xffd8\xffff\x6b76\v\4\x8000\b\0\4\0\1\0\x5343\x6174\x6574\x6c46\x6761s\0\0\xffd8\xffff\x6b76\tN\0\x330"\1\0\1N\x6c43\x7361\x4773\x4955D\0\0\0\xffd8\xffff\x6b76\tN\0\x88!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\x6268\x6e69\0!\x1000\0\0\0\0\0\0\0\0\0\0\0\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x3d28\20\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x130\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3962\x6426\x7665\x315f\x34345\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x2bd8\20\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x133\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3962\x6426\x7665\x315f\x38349\0\xffd8\xffff\x6b76\tN\0\x170!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffe0\xffff\x6b76\a\16\0\x1e8!\1\0\1\0\x6553\x7672\x6369e\xffe8\xffffisapnp\0\0\0\0\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xeb90 \x6410$\xffff\xffff\0\0\0\0\22\0N\0\x131\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3962\x6426\x7665\x315f\x34349\0\xffd8\xffff\x6b76\tN\0\x290!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffe0\xffff\x6b76\a\16\0\x308!\1\0\1\0\x6553\x7672\x6369e\xffe8\xffffisapnp\0\0\0\0\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x408!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x137\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3962\x6426\x7665\x315f\x33353\0\xffd8\xffff\x6b76\tN\0\x3b0!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff0\xffff\x388!\x510!\0\0\xffe0\xffff\x6b76\a\16\0\x438!\1\0\1\0\x6553\x7672\x6369e\xffe8\xffffisapnp\0\0\0\0\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x9ff8\a\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x132\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3962\x6426\x7665\x315f\x35341\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffe0\xffff\x6b76\a\16\0\x530!\1\0\1\0\x6553\x7672\x6369e\xffe8\xffffisapnp\0\0\0\0\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xde48 \x6410$\xffff\xffff\0\0\0\0\22\0N\0\x134\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3962\x6426\x7665\x315f\x32351\0\xffd8\xffff\x6b76\tN\0\x5d8!\1\0\1\xae28\x6c43\x7361\x4773\x4955\x7244&\xd537\xae28\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0&\x2fde\xae29\xffd8\xffff\x6b76\tN\0\x4ca8!\1\0\1\x69ce\x6c43\x7361\x4773\x4955D\0pc\xfff0\xffffpci\0\xe1c1\x69ce\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x788!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x125\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3038\x6426\x7665\x305f\x3036\xec30\x69ce\xffe0\xffff\x6b76\a\b\0\x658!\1\0\1\x69ce\x6553\x7672\x6369\x6965\xfff0\xffff\x5388!\x5348!np\xfff8\xffff\xfd30 \xffd8\xffff\x6b76\tN\0\x730!\1\0\1\x69cf\x6c43\x7361\x4773\x4955\x9544\2\x3caa\x69cf\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\2\x5211\x69cf\xfff0\xffff\x708!\x890!\x5223\x69cf\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x880!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x123\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3837\x6426\x7665\x305f\x3030\xdc30\xf904\xffd8\xffff\x6b76\tN\0\x828!\1\0\1\x8aeb\x6c43\x7361\x4773\x4955\xab44\2\xc9af\xd33d\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0&\x9957\x39c7\xfff0\xffff\x800!\x9c0!\xfa55\x39d3\xffe0\xffff\x6b76\a\16\0\x8b0!\1\0\1\x39d4\x6553\x7672\x6369\x3965\xffe8\xffffisapnp\0&\x685b\x39d4\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x9b0!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x124\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3837\x6426\x7665\x305f\x3030\xe032\xad3f\xffd8\xffff\x6b76\tN\0\x958!\1\0\1\xad3f\x6c43\x7361\x4773\x4955\x4b44&\xe545\xad3f\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\2\x726f\x2420\xfff0\xffff\x930!\x3f88!\x3fdb\x2424\xffe0\xffff\x6b76\a\16\0\x9e0!\1\0\1\x4c8\x6553\x7672\x6369\x1065\xffe8\xffffisapnp\0\2\xcc95\x3b57\xfff0\xffff\x3f08!\x4770!\x5d3a\x4d93\xfff8\xffff\x630!\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffd8\xffff\x6b76\tN\0\xc28!\1\0\1\0\x6c43\x7361\x4773\x4955D\0is\xfff8\xffff\xce8!\xfff8\xffff\x1020!\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x8c50\a\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x135\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3962\x6426\x7665\x315f\x32353\0\xffe0\xffff\x6b76\a\16\0\xb28!\1\0\1\0\x6553\x7672\x6369e\xffe8\xffffisapnp\0\0\0\0\xffd8\xffff\x6b76\tN\0\xb68!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xf9f8 \x6410$\xffff\xffff\0\0\0\0\22\0N\0\x136\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3962\x6426\x7665\x315f\x33351\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xa90!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x138\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3962\x6426\x7665\x315f\x34351\0\xffd8\xffff\x6b76\tN\0\xd10!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffd8\xffff\x6b76\tN\0\x1e98!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\x5650&\xfff8\xffff\x1f58!\xfff0\xffff\x20d8!\x2250!\x4d80&\xffa8\xffff\x6b6e \xdc8e\xb6ed\xeb84\x1c4\0\0\xc338\t\1\0\0\0\x81e8/\xffff\xffff\a\0\xf48!\x1e8\0\xffff\xffff\22\0\0\0\30\0T\0\20\0\b\0\x6c61\x6d69\x3531\x3134\xffe0\xffff\x6b76\4\4\x8000\1\0\4\0\1\0\x7954\x6570\0\0\xffe0\xffff\x6b76\5\4\x8000\4\0\4\0\1\0\x7453\x7261t\0\xffd8\xffff\x6b76\f\4\x8000\1\0\4\0\1\0\x7245\x6f72\x4372\x6e6f\x7274\x6c6f\0\0\xffe0\xffff\x6b76\3\4\x8000\4\0\4\0\1\0\x6154g\0\0\xffd8\xffff\x6b76\tT\0\x3b98$\2\0\1\0\x6d49\x6761\x5065\x7461h\0\0\0\xffd8\xffff\x6b76\v\20\0\xed8!\1\0\1D\x6944\x7073\x616c\x4e79\x6d61e\a\xffe8\xffffAha154x\0s\0\xffd8\xffff\x6b76\v&\0\xf18!\1\0\1\0\x6944\x7073\x616c\x4e79\x6d61e\0\0\xffd0\xffffALI AGP Bus Filter\0\0\0\0\xffe0\xffff\xe00!\xe20!\xe40!\xe68!\xe88!\xef0!\xf68!\xffe0\xffff\x6b76\5\26\0\xf88!\1\0\1\0\x7247\x756fp\0\xffe0\xffffPnP Filter\0\0\0\0\xffa8\xffff\x6b6e \x8cd0\xd090\x5354\x1c2\0\0\xda8!\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xa98!\xd020\t\xffff\xffff\0\0\0\0\20\0\xa8\0\0\0\b\0\x6553\x7563\x6972\x7974\x6268\x6e69\x1000!\x1000\0\x778\0\xd0b6\x26c\0\0\xd217\x26c\0\0\xffe0\xffff\x6b76\b\xa8\0\x1040!\3\0\1\0\x6553\x7563\x6972\x7974\xff50\xffff\1\x8014\x90\0\x9c\0\24\0000\0\2\34\1\0\x8002\24\x1ff\17\x101\0\0\x100\0\0\2`\4\0\0\24\x1fd\2\x101\0\0\x500\22\0\0\30\x1ff\17\x201\0\0\x500 \0\x220\0\0\24\x18d\2\x101\0\0\x500\v\0\0\30\x1fd\2\x201\0\0\x500 \0\x223\0\x101\0\0\x500\22\0\x101\0\0\x500\22\0\0\0\xffd8\xffff\x6b76\tN\0\x1450!\1\0\1\0\x6c43\x7361\x4773\x4955D\0pc\xfff8\xffff\x10f0!\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\3\0H\20\x6410$\xffff\xffff\0\0\0\0\30\0N\0\x13f\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3962\x6426\x7665\x355f\x34323\0\xffe0\xffff\x6b76\a\b\0\x11a8!\1\0\1\0\x6553\x7672\x6369\x6c65\xfff0\xffffpci\0pc\xfff8\xffff\x1840!\xffd8\xffff\x6b76\tN\0\x11e8!\1\0\1\0\x6c43\x7361\x4773\x4955\x1344\x26d\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\x26d\0\0\xffd8\xffff\x6b76\f\24\0\x1268!\a\0\1\0\x7055\x6570\x4672\x6c69\x6574\x7372\0\0\xffe8\xffffALIM1541\0\0\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\3\0\x1368!\x6410$\xffff\xffff\0\0\0\0\30\0N\0\x140\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3962\x6426\x7665\x355f\x34327\0\xffd8\xffff\x6b76\tN\0\x1310!\1\0\1\0\x6c43\x7361\x4773\x4955\x3d44\x26d\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\x26d\0\0\xfff0\xffff\x12e8!\x1378!\x1188!\xffd8\xffff\x6b76\f\24\0\x13a0!\a\0\1\0\x7055\x6570\x4672\x6c69\x6574\x7372\0\0\xffe8\xffffALIM1541\0\0\xffe0\xffff\x6b76\a\b\0\x13d8!\1\0\1\0\x6553\x7672\x6369e\xfff0\xffffpci\0\0\0\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x1118!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x141\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3962\x6426\x7665\x375f\x3031\x231\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\x26d\xbf2\0\xffa8\xffff\x6b6e \xdc8e\xb6ed\xeb84\x1c4\0\0\xc338\t\2\0\0\0\x8200/\xffff\xffff\a\0\x1788!\x6410$\xffff\xffff\26\0\0\0\30\0P\0\21\0\6\0\x6d61\x6164\x7067\0\xffa0\xffff\x6b6e \x1ff0\x8b63\xbf27\x1c3\0\0\x14a8!\0\0\0\0\xffff\xffff\xffff\xffff\3\0\x15d0!\x6410$\xffff\xffff\0\0\0\0\20\0\b\0\0\0\n\0\x6150\x6172\x656d\x6574\x7372\x26d\0\0\xfff8\xffff\x19b8!\xfff8\xffff\xd68!\xffe0\xffff\x6b76\b\b\0\x1590!\3\0\1\0\x3031\x4544\x3030\x4432\xfff0\xffff\0\20\xfa8f\xd584\0\0\xffe0\xffff\x6b76\b\b\0\x15c0!\3\0\1\0\x3031\x4232\x3530\x3532\xfff0\xffff\0\20\xf88e\xa583\0\0\xfff0\xffff\x1570!\x15a0!\x15e0!\xffe0\xffff\x6b76\b\b\0\x1600!\3\0\1\0\x3335\x3333\x4138\x3232\xfff0\xffff\0\20\xf88e\xa583\0\0\xffe0\xffff\x6b76\4\4\x8000\1\0\4\0\1\0\x7954\x6570\0\0\xffe0\xffff\x6b76\5\4\x8000\4\0\4\0\1\0\x7453\x7261t\0\xfff0\xffffpci\0\x5660&\xffd8\xffff\x6b76\f\4\x8000\1\0\4\0\1\0\x7245\x6f72\x4372\x6e6f\x7274\x6c6f\x7a7\0\xffe0\xffff\x6b76\3\4\x8000\5\0\4\0\1\0\x6154\x267\xfa\0\xffe8\xffff\x686c\1\xe710\t\x5aa7\x6bea\x1710\n\x5aa7\x6bea\xffd8\xffff\x6b76\tP\0\x3f90$\2\0\1\0\x6d49\x6761\x5065\x7461\xcb68\x26d\0\0\xffd8\xffff\x6b76\v\22\0\x1710!\1\0\1)\x6944\x7073\x616c\x4e79\x6d61e\a\xffe8\xffffadpu160m\0\0\xffd8\xffff\x6b76\v4\0\x1750!\1\0\1\0\x6944\x7073\x616c\x4e79\x6d61\x265\0\0\xffc8\xffffAMD AGP Bus Filter Driver\0\xffe0\xffff\x1610!\x1630!\x1660!\x1688!\x16c0!\x1728!\x17a8!\xffe0\xffff\x6b76\5\26\0\x17c8!\1\0\1\0\x7247\x756fp\0\xffe0\xffffPnP Filter\0\x26d\0\0\xffa8\xffff\x6b6e \x15b0\xd267\x5354\x1c2\0\0\x14a8!\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x11b8!\xd020\t\xffff\xffff\0\0\0\0\20\0\xa8\0\1\0\b\0\x6553\x7563\x6972\x7974\xffe0\xffff\x6b76\b\xa8\0\x1860!\3\0\1\0\x6553\x7563\x6972\x7974\xff50\xffff\1\x8014\x90\0\x9c\0\24\0000\0\2\34\1\0\x8002\24\x1ff\17\x101\0\0\x100\0\0\2`\4\0\0\24\x1fd\2\x101\0\0\x500\22\0\0\30\x1ff\17\x201\0\0\x500 \0\x220\0\0\24\x18d\2\x101\0\0\x500\v\0\0\30\x1fd\2\x201\0\0\x500 \0\x223\0\x101\0\0\x500\22\0\x101\0\0\x500\22\0\0\0\xffe0\xffff\x6b76\a\b\0\xd770!\1\0\1\0\x6553\x7672\x6369e\xffe0\xffff\x6b76\a\b\0\x1650!\1\0\1\0\x6553\x7672\x6369e\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\3\0\x2cf0\3\x6410$\xffff\xffff\0\0\0\0\30\0N\0\xc5\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3232\x6426\x7665\x375f\x30307\0\xffd8\xffff\x6b76\tN\0\x1dd8!\1\0\1\0\x6c43\x7361\x4773\x4955\x6544\x7372\x59b8&\xffd8\xffff\x6b76\tN\0\x1a08!\1\0\1\0\x6c43\x7361\x4773\x4955\x3e44\x26e\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\x26e\0\0\xffd8\xffff\x6b76\f\20\0\x1a88!\a\0\1\0\x7055\x6570\x4672\x6c69\x6574\x7372\0\0\xffe8\xffffAMDAGP\0\0\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\3\0\x1b88!\x6410$\xffff\xffff\0\0\0\0\30\0N\0\xc6\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3232\x6426\x7665\x375f\x3030d\0\xffd8\xffff\x6b76\tN\0\x1b30!\1\0\1\0\x6c43\x7361\x4773\x4955\x6944\x26e\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\x26e\0\0\xfff0\xffff\x1b08!\x1b98!\x1d40!\xffd8\xffff\x6b76\f\20\0\x1bc0!\a\0\1\0\x7055\x6570\x4672\x6c69\x6574\x7372\0\0\xffe8\xffffAMDAGP\0\0\0\0\xffe0\xffff\x6b76\a\b\0\x1bf8!\1\0\1\0\x6553\x7672\x6369e\xfff0\xffffpci\0\x80b\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\3\0\x1cf0!\x6410$\xffff\xffff\0\0\0\0\30\0N\0\xc7\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3232\x6426\x7665\x375f\x3030f\0\xffd8\xffff\x6b76\tN\0\x1c98!\1\0\1\0\x6c43\x7361\x4773\x4955\x9c44\x26e\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\x26e\0\0\xfff0\xffff\x1c70!\x1d00!\x1930!\xffd8\xffff\x6b76\f\20\0\x1d28!\a\0\1\0\x7055\x6570\x4672\x6c69\x6574\x7372\xda2\0\xffe8\xffffAMDAGP\0\0\0\0\xffe0\xffff\x6b76\a\b\0\x1d60!\1\0\1\0\x6553\x7672\x6369e\xfff0\xffffpci\0\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x1560!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\xc8\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3232\x6426\x7665\x375f\x3034b\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\x26e\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x1568!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\xc9\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3232\x6426\x7665\x375f\x3134\xb33\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\x26e\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xd90!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\xca\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3232\x6426\x7665\x375f\x34343\0\xffd8\xffff\x6b76\tN\0\x1f80!\1\0\1\0\x6c43\x7361\x4773\x4955\x744\x26f\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\x26f\0\0\xffd8\xffff\x6b76\tN\0\x22f0!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\x60a0&\x6268\x6e69\x2000!\x1000\0\0\0\0\0\0\0\0\0\0\0\xfff8\xffff\x1fd8!\xfff8\xffff\x23b0!\xfff8\xffff\x2430!\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xd98!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x80\0\25\0\x6370\x2369\x6576\x5f6e\x6530\x3131\x6426\x7665\x305f\x30301\0\xffe0\xffff\x6b76\a\16\0\x20c0!\1\0\1\0\x6553\x7672\x6369e\xffe8\xffffisapnp\0\0\0\0\xffd8\xffff\x6b76\tN\0\x2100!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x2240!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x81\0\25\0\x6370\x2369\x6576\x5f6e\x6530\x3131\x6426\x7665\x305f\x30302\0\xffd8\xffff\x6b76\tN\0\x21e8!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff0\xffff\x21c0!\x20a0!\0\0\xffe0\xffff\x6b76\a\16\0\x2270!\1\0\1\0\x6553\x7672\x6369e\xffe8\xffffisapnp\0\0\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x2020!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x82\0\25\0\x6370\x2369\x6576\x5f6e\x6530\x3131\x6426\x7665\x315f\x30300\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x2028!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x83\0\25\0\x6370\x2369\x6576\x5f6e\x6530\x3131\x6426\x7665\x325f\x30300\0\xffd8\xffff\x6b76\tN\0\x23d8!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffd8\xffff\x6b76\tN\0\x2730!\1\0\1\0\x6c43\x7361\x4773\x4955D\0is\xfff8\xffff\x2788!\xfff8\xffff\x2a18!\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x2588!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x88\0\25\0\x6370\x2369\x6576\x5f6e\x6530\x3131\x6426\x7665\x615f\x32659\0\xffe0\xffff\x6b76\a\16\0\x24f0!\1\0\1\0\x6553\x7672\x6369e\xffe8\xffffisapnp\0\0\0\0\xffd8\xffff\x6b76\tN\0\x2530!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff0\xffff\x2508!\x2690!\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x2680!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x8a\0\25\0\x6370\x2369\x6576\x5f6e\x6530\x3131\x6426\x7665\x615f\x3265b\0\xffd8\xffff\x6b76\tN\0\x2628!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff0\xffff\x2600!\x24d0!\0\0\xffe0\xffff\x6b76\a\16\0\x26b0!\1\0\1\0\x6553\x7672\x6369e\xffe8\xffffisapnp\0\0\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x2030!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x84\0\25\0\x6370\x2369\x6576\x5f6e\x6530\x3131\x6426\x7665\x615f\x66300\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffd8\xffff\x6b76\tN\0\x2958!\1\0\1\0\x6c43\x7361\x4773\x4955D\0is\xfff8\xffff\x2b00!\xfff8\xffff\x2b80!\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x28e0!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x85\0\25\0\x6370\x2369\x6576\x5f6e\x6530\x3131\x6426\x7665\x615f\x66303\0\xffe0\xffff\x6b76\a\16\0\x2848!\1\0\1\0\x6553\x7672\x6369e\xffe8\xffffisapnp\0\0\0\0\xffd8\xffff\x6b76\tN\0\x2888!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff0\xffff\x2860!\x2828!\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x2458!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x86\0\25\0\x6370\x2369\x6576\x5f6e\x6530\x3131\x6426\x7665\x615f\x66307\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x2460!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x89\0\25\0\x6370\x2369\x6576\x5f6e\x6530\x3131\x6426\x7665\x615f\x3265a\0\xffd8\xffff\x6b76\tN\0\x2a40!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x27b0!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x8b\0\25\0\x6370\x2369\x6576\x5f6e\x6530\x3131\x6426\x7665\x615f\x33651\0\xffd8\xffff\x6b76\tN\0\x2b28!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffd8\xffff\x6b76\tN\0\x2d58!\1\0\1\0\x6c43\x7361\x4773\x4955D\0is\xfff8\xffff\x2e98!\xfff8\xffff\x2fc8!\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x2cd8!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x8d\0\25\0\x6370\x2369\x6576\x5f6e\x6530\x3131\x6426\x7665\x615f\x36659\0\xffe0\xffff\x6b76\a\16\0\x2c40!\1\0\1\0\x6553\x7672\x6369e\xffe8\xffffisapnp\0\0\0\0\xffd8\xffff\x6b76\tN\0\x2c80!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff0\xffff\x2c58!\x2c20!\0\0\xff90\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x27b8!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x8e\0\35\0\x6370\x2369\x6576\x5f6e\x6530\x3131\x6426\x7665\x615f\x3665\x2663\x6363\x305f\x30360\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffa8\xffff\x6b6e \x7f8\x77e6\x8887\x1c7\0\0\x2188\21\0\0\0\0\xffff\xffff\xffff\xffff\2\0\xe350\20\x9ad8\32\xffff\xffff\0\0\0\0"\0\xa8\0001!\a\0\x6f4c\x4367\x6e6ff\xffe0\xffff\x6b76\a\b\0\x2ec0!\1\0\1\0\x6553\x7672\x6369e\xff90\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x2f50!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x8f\0\35\0\x6370\x2369\x6576\x5f6e\x6530\x3131\x6426\x7665\x615f\x3665\x2663\x6363\x305f\x30364\0\xffd8\xffff\x6b76\tN\0\x3020!\1\0\1\0\x6c43\x7361\x4773\x4955D\0pc\xfff0\xffffpci\0\x6e98&\xffd8\xffff\x6b76\tN\0\x2ef8!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff0\xffff\x2ed0!\x2e08!\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x2ba8!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x90\0\25\0\x6370\x2369\x6576\x5f6e\x6530\x3131\x6426\x7665\x615f\x3665d\0\xffd8\xffff\x6b76\tN\0\x30d0!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xfff8\xffff\x5b0!\b\0\x46d0&\x6268\x6e69\x3000!\x1000\0\0\0\0\0\0\0\0\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x2bb0!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\b\0\x632a\x7170\x3061\x6665\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x3200!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\b\0\x632a\x7170\x6561\x3830\xffd8\xffff\x6b76\tN\0\x31a8!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\x3180!\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x32e0!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\b\0\x632a\x7170\x6561\x3033\xffd8\xffff\x6b76\tN\0\x3288!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\x3260!\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x33c0!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\b\0\x632a\x7170\x6561\x6233\xffd8\xffff\x6b76\tN\0\x3368!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\x3340!\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x34a0!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\b\0\x632a\x7170\x6561\x6333\xffd8\xffff\x6b76\tN\0\x3448!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\x3420!\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x3580!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\b\0\x632a\x7170\x6561\x6134\xffd8\xffff\x6b76\tN\0\x3528!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\x3500!\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x3660!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\b\0\x632a\x7170\x6561\x6234\xffd8\xffff\x6b76\tN\0\x3608!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\x35e0!\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x3740!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\b\0\x632a\x7170\x6561\x6334\xffd8\xffff\x6b76\tN\0\x36e8!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\x36c0!\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x3820!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\b\0\x632a\x7170\x6561\x6434\xffd8\xffff\x6b76\tN\0\x37c8!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\x37a0!\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x3900!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\b\0\x632a\x7170\x6561\x3335\xffd8\xffff\x6b76\tN\0\x38a8!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\x3880!\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x39e0!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\b\0\x632a\x7170\x6561\x3435\xffd8\xffff\x6b76\tN\0\x3988!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\x3960!\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x3ac0!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\b\0\x632a\x7170\x6561\x3535\xffd8\xffff\x6b76\tN\0\x3a68!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\x3a40!\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x3ba0!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\b\0\x632a\x7170\x3062\x6635\xffd8\xffff\x6b76\tN\0\x3b48!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\x3b20!\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x3c80!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\b\0\x632a\x7170\x3162\x3831\xffd8\xffff\x6b76\tN\0\x3c28!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\x3c00!\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x3d60!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\b\0\x632a\x7170\x3162\x3931\xffd8\xffff\x6b76\tN\0\x3d08!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\x3ce0!\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x3e40!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\b\0\x632a\x7170\x3162\x6131\xffd8\xffff\x6b76\tN\0\x3de8!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\x3dc0!\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x2ff0!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\b\0\x632a\x7170\x6166\x6231\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x9f8!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3131\x6426\x7665\x305f\x30301\0\xffd8\xffff\x6b76\tN\0\x3f30!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffe0\xffff\x6b76\a\16\0\x3fa8!\1\0\1\0\x6553\x7672\x6369e\xffe8\xffffisapnp\0\0\0\0\xffd8\xffff\x6b76\tN\0\x4718!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xfff0\xffff\x3fc0!\x4898!\0\0\xfff8\xffff\x4d68!\x6268\x6e69\x4000!\x1000\0\0\0\0\0\0\0\0\0\0\0\xffd8\xffff\x6b76\tN\0\x4048!\1\0\1\xae28\x6c43\x7361\x4773\x4955\x7244&\xd537\xae28\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0&\x2fde\xae29\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x4108!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x1e1\0\25\0\x6370\x2369\x6576\x5f6e\x3038\x3638\x6426\x7665\x325f\x33350c\xfff8\xffff\x4178!\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\3\0\x4230!\x6410$\xffff\xffff\0\0\0\0\30\0N\0\x1e0\0\25\0\x6370\x2369\x6576\x5f6e\x3038\x3638\x6426\x7665\x325f\x3035\xed66\x69ce\xffd8\xffff\x6b76\tN\0\x4280!\1\0\1\x69cf\x6c43\x7361\x4773\x4955D\0pc\xfff0\xffffpci\0\x8178&\xffd8\xffff\x6b76\tN\0\x41d8!\1\0\1\x69cf\x6c43\x7361\x4773\x4955\x3344&\x4205\x69cf\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\2\x5235\x69cf\xfff0\xffff\x41b0!\x4240!\x42d8!\xffd8\xffff\x6b76\f\20\0\x4268!\a\0\1\xb044\x7055\x6570\x4672\x6c69\x6574\x7372\x244a\xb6e3\xffe8\xffffAGP440\0\0\xd19a\xf904\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\21\xc555\xb686\xffe0\xffff\x6b76\a\b\0\x41a0!\1\0\1\xb686\x6553\x7672\x6369\xb665\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x43e0!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x1e2\0\25\0\x6370\x2369\x6576\x5f6e\x3038\x3638\x6426\x7665\x325f\x3335\x4731\x4484\xffd8\xffff\x6b76\tN\0\x4388!\1\0\1\x90ed\x6c43\x7361\x4773\x4955\x8744&\xe796\x90ed\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0&)\x6fad\xfff8\xffff\x4360!\xffd8\xffff\x6b76\tN\0\x4630!\1\0\1\xa9a9\x6c43\x7361\x4773\x4955\x6544\x7372\xb810\x83bd\xfff0\xffff\x43e8!\x9ab8!40\xffd8\xffff\x6b76\tN\0\x9b40!\1\0\1&\x6c43\x7361\x4773\x4955\x6544\x7672\x6369\xd65\xfff0\xffffpci\0\xe015\xad3f\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\3\0\x4578!\x6410$\xffff\xffff\0\0\0\0\30\0N\0\x1e3\0\25\0\x6370\x2369\x6576\x5f6e\x3038\x3638\x6426\x7665\x325f\x3335\xec32\xad42\xffe0\xffff\x6b76\a\b\0\x4448!\1\0\1\x241e\x6553\x7672\x6369\x2465\xfff0\xffff\x9ca0!\x9d20!\x9db8!\b\0\xa900&\xffd8\xffff\x6b76\tN\0\x4520!\1\0\1\xc873\x6c43\x7361\x4773\x4955\xa444&\x9cce\x241f\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0&\xa23b\x241f\xfff0\xffff\x44f8!\x4588!\x4688!\xffd8\xffff\x6b76\f\20\0\x45b0!\a\0\1\x241f\x7055\x6570\x4672\x6c69\x6574\x7372\xad49\x241f\xffe8\xffffAGP440\0\0\xf23c\x241f\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x4410!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x1e4\0\25\0\x6370\x2369\x6576\x5f6e\x3038\x3638\x6426\x7665\x325f\x3335\x7233\x2420\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\21\xd7fb\x54c0\xffe0\xffff\x6b76\a\b\0\x8fa8!\1\0\1\x4618\x6553\x7672\x6369\x4d65\xfff8\xffff\x4420!\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x3fe8!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\xae\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3131\x6426\x7665\x305f\x32301\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffe0\xffff\x6b76\a\b\0\x4790!\1\0\1\0\x6553\x7672\x6369e\xfff0\xffffpci\0\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x4888!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\xaf\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3131\x6426\x7665\x305f\x32302\0\xffd8\xffff\x6b76\tN\0\x4830!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff0\xffff\x4808!\x49c0!\0\0\xffe0\xffff\x6b76\a\b\0\x48b8!\1\0\1\0\x6553\x7672\x6369e\xfff0\xffffpci\0\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x49b0!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\xb0\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3131\x6426\x7665\x305f\x32304\0\xffd8\xffff\x6b76\tN\0\x4958!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff0\xffff\x4930!\x4ae8!\0\0\xffe0\xffff\x6b76\a\b\0\x49e0!\1\0\1\0\x6553\x7672\x6369e\xfff0\xffffpci\0\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x4ad8!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\xb1\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3131\x6426\x7665\x305f\x32305\0\xffd8\xffff\x6b76\tN\0\x4a80!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff0\xffff\x4a58!\x4c10!\0\0\xffe0\xffff\x6b76\a\b\0\x4b08!\1\0\1\0\x6553\x7672\x6369e\xfff0\xffffpci\0\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x4c00!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\xb2\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3131\x6426\x7665\x305f\x32306\0\xffd8\xffff\x6b76\tN\0\x4ba8!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff0\xffff\x4b80!\x6d0!\0\0\xffe0\xffff\x6b76\a\b\0\x4c30!\1\0\1\0\x6553\x7672\x6369e\xfff0\xffffpci\0\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xa08!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\xe9\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x6333\x6426\x7665\x315f\x63301\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x3ff8!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\xea\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x6333\x6426\x7665\x315f\x6530d\0\xffd8\xffff\x6b76\tN\0\x4d90!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x4ed0!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\xeb\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x6333\x6426\x7665\x315f\x31329\0\xffd8\xffff\x6b76\tN\0\x4e78!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\x4e50!\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x4fc0!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\xec\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x6333\x6426\x7665\x315f\x3132a\0\xffd8\xffff\x6b76\tN\0\x4f68!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\x4f40!\xffd8\xffff\x6b76\tN\0\x5088!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xfff8\xffff\x4fc8!\xfff8\xffff\x5148!\x6268\x6e69\x5000!\x1000\0\0\0\0\0\0\0\0\0\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x4ff0!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x6333\x6426\x7665\x315f\x3132b\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x4ff8!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x6333\x6426\x7665\x315f\x3132c\0\xffd8\xffff\x6b76\tN\0\x5170!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x52a0!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\b\0\x682a\x7077\x3263\x3930\xffd8\xffff\x6b76\tN\0\x5248!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\x5220!\xffd8\xffff\x6b76\tN\0\x5470!\1\0\1\0\x6c43\x7361\x4773\x4955D\0is\xfff8\xffff\x52a8!\xfff8\xffff\x54c8!\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x6f0!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3431\x6426\x7665\x305f\x3030a\0\xffe0\xffff\x6b76\a\16\0\x5368!\1\0\1\0\x6553\x7672\x6369e\xffe8\xffffisapnp\0\0\0\0\xfff8\xffff\x5980!\xffd8\xffff\x6b76\tN\0\x53b0!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x52d0!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3431\x6426\x7665\x305f\x31307\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffd8\xffff\x6b76\tN\0\x58d0!\1\0\1\0\x6c43\x7361\x4773\x4955D\0pc\xfff8\xffff\x5a68!\xff90\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x5618!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\34\0\x6370\x2369\x6576\x5f6e\x3031\x3431\x6426\x7665\x305f\x3230\x2632\x6572\x5f76\x3030\0\0\xffe0\xffff\x6b76\a\b\0\x5588!\1\0\1\0\x6553\x7672\x6369e\xfff0\xffffpci\0\0\0\xffd8\xffff\x6b76\tN\0\x55c0!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff0\xffff\x5598!\x5720!\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x5710!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3431\x6426\x7665\x305f\x32302\0\xffd8\xffff\x6b76\tN\0\x56b8!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff0\xffff\x5690!\x5848!\0\0\xffe0\xffff\x6b76\a\b\0\x5740!\1\0\1\0\x6553\x7672\x6369e\xfff0\xffffpci\0\0\0\xff98\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x5838!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\25\0\x6370\x2369\x6576\x5f6e\x3031\x3431\x6426\x7665\x305f\x39305\0\xffd8\xffff\x6b76\tN\0\x57e0!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff0\xffff\x57b8!\x5568!\0\0\xffe0\xffff\x6b76\a\b\0\x5868!\1\0\1\0\x6553\x7672\x6369e\xfff0\xffffpci\0\0\0\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x52d8!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\b\0\x692a\x6d62\x3030\x6136\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffa8\xffff\x6b6e \x7c00\x8b5b\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x5380!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\b\0\x692a\x746e\x3830\x3030\xffd8\xffff\x6b76\tN\0\x59a8!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x54f0!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\25\0\x6370\x2369\x6576\x5f6e\x3038\x3638\x6426\x7665\x305f\x30308\0\xffd8\xffff\x6b76\tN\0\x5a90!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffd8\xffff\x6b76\tN\0\x5cc0!\1\0\1\0\x6c43\x7361\x4773\x4955D\0is\xfff8\xffff\x5ae8!\xfff8\xffff\x5d18!\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x5c48!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\25\0\x6370\x2369\x6576\x5f6e\x3038\x3638\x6426\x7665\x305f\x38342\0\xffe0\xffff\x6b76\a\16\0\x5ba8!\1\0\1\0\x6553\x7672\x6369e\xffe8\xffffisapnp\0\0\0\0\xfff8\xffff\x5fb0!\xffd8\xffff\x6b76\tN\0\x5bf0!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff0\xffff\x5bc8!\x5b88!\0\0\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x5b10!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\25\0\x6370\x2369\x6576\x5f6e\x3038\x3638\x6426\x7665\x305f\x38343\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffd8\xffff\x6b76\tN\0\x6090!\1\0\1\0\x6c43\x7361\x4773\x4955D\0is\xfff8\xffff\x5fd8!\xfff8\xffff\x62e8!\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x5e70!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\25\0\x6370\x2369\x6576\x5f6e\x3038\x3638\x6426\x7665\x305f\x38344\0\xffe0\xffff\x6b76\a\16\0\x5dd8!\1\0\1\0\x6553\x7672\x6369e\xffe8\xffffisapnp\0\0\0\0\xffd8\xffff\x6b76\tN\0\x5e18!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff0\xffff\x5df0!\x5f78!\0\0\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x5f68!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\0\0\25\0\x6370\x2369\x6576\x5f6e\x3038\x3638\x6426\x7665\x305f\x38346\0\xffd8\xffff\x6b76\tN\0\x5f10!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff0\xffff\x5ee8!\x5db8!\0\0\xffe0\xffff\x6b76\a\16\0\x5f98!\1\0\1\0\x6553\x7672\x6369e\xffe8\xffffisapnp\0\0\0\0\xffd8\xffff\x6b76\tN\0\x6158!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffd8\xffff\x6b76\tN\0\x6220!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\x6268\x6e69\x6000!\x1000\0\0\0\0\0\0\0\0\0\0\0\xff90\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x5b18!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x198\0\34\0\x6370\x2369\x6576\x5f6e\x3038\x3638\x6426\x7665\x305f\x6134\x2633\x6572\x5f76\x3030\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xff90\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x5bc0!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x199\0\34\0\x6370\x2369\x6576\x5f6e\x3038\x3638\x6426\x7665\x305f\x6134\x2633\x6572\x5f76\x3130\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xff90\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x5d40!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x19a\0\34\0\x6370\x2369\x6576\x5f6e\x3038\x3638\x6426\x7665\x305f\x6134\x2633\x6572\x5f76\x3230\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xff90\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x5d48!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x19b\0\34\0\x6370\x2369\x6576\x5f6e\x3038\x3638\x6426\x7665\x305f\x6134\x2633\x6572\x5f76\x3330\0\0\xffd8\xffff\x6b76\tN\0\x6310!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x6450!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x197\0\25\0\x6370\x2369\x6576\x5f6e\x3038\x3638\x6426\x7665\x305f\x61343\0\xffd8\xffff\x6b76\tN\0\x63f8!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\x63d0!\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x6540!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x19c\0\25\0\x6370\x2369\x6576\x5f6e\x3038\x3638\x6426\x7665\x315f\x33310\0\xffd8\xffff\x6b76\tN\0\x64e8!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff8\xffff\x64c0!\xffd8\xffff\x6b76\tN\0\x6ba0!\1\0\1\0\x6c43\x7361\x4773\x4955\x6544\x7372\0\0\xfff8\xffff\x6548!\xfff8\xffff\x6c60!\xfff8\xffff\x6d68!\xffa8\xffff\x6b6e \x10fc\x2798\x41cd\x1c8\0\0\xc338\t\2\0\1\0\x2f90/\xf240\x8000\a\0\x6758!\x1e8\0\xffff\xffff\26\0\0\0\30\0P\0\r\0\6\0\x6761\x3470\x3034\0\xffe0\xffff\x6b76\4\4\x8000\1\0\4\0\1\0\x7954\x6570\0\0\xfff8\xffff\x6810!\xffe0\xffff\x6b76\5\4\x8000\0\0\4\0\1\0\x7453\x7261t\0\xfff0\xffff\x7f48!\x7fc8!\x80f8!\xffd8\xffff\x6b76\f\4\x8000\1\0\4\0\1\0\x7245\x6f72\x4372\x6e6f\x7274\x6c6f\0\0\xffe0\xffff\x6b76\3\4\x8000\6\0\4\0\1\0\x6154g\0\0\xffe8\xffffisapnp\0\0\xa698&\xffd8\xffff\x6b76\t8\0\x3c40$\2\0\1\0\x6d49\x6761\x5065\x7461h\0\0\0\xffd8\xffff\x6b76\v\20\0\x66e8!\1\0\1)\x6944\x7073\x616c\x4e79\x6d61e\a\xffe8\xffffaic78xx\0\0\0\xffd8\xffff\x6b76\v*\0\x6728!\1\0\1\0\x6944\x7073\x616c\x4e79\x6d61e\0\0\xffd0\xffffIntel AGP Bus Filter\0\0\xffe0\xffff\x65e0!\x6608!\x6638!\x6660!\x6698!\x6700!\x6778!\xffe0\xffff\x6b76\5\26\0\x6798!\1\0\1\0\x7247\x756fp\0\xffe0\xffffPnP Filter\0\0\0\0\xffa8\xffff\x6b6e \xa850\xf7ff\x5354\x1c2\0\0\x6588!\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x6600!\xd020\t\xffff\xffff\0\0\0\0\20\0\xa8\0\1\0\b\0\x6553\x7563\x6972\x7974\xffe0\xffff\x6b76\b\xa8\0\x6830!\3\0\1\0\x6553\x7563\x6972\x7974\xff50\xffff\1\x8014\x90\0\x9c\0\24\0000\0\2\34\1\0\x8002\24\x1ff\17\x101\0\0\x100\0\0\2`\4\0\0\24\x1fd\2\x101\0\0\x500\22\0\0\30\x1ff\17\x201\0\0\x500 \0\x220\0\0\24\x18d\2\x101\0\0\x500\v\0\0\30\x1fd\2\x201\0\0\x500 \0\x223\0\x101\0\0\x500\22\0\x101\0\0\x500\22\0\0\0\xffe0\xffff\x6b76\a\b\0\x6998!\1\0\1\0\x6553\x7672\x6369e\xffd0\xffff\x6b76\21\xa8\0\xb020"\n\0\1\a\x6142\x6973\x4363\x6e6f\x6966\x5667\x6365\x6f74\x3572\3\0\0\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\3\0\x6a28!\x6410$\xffff\xffff\0\0\0\0\30\0N\0\x19d\0\25\0\x6370\x2369\x6576\x5f6e\x3038\x3638\x6426\x7665\x315f\x33311\0\xfff0\xffffpci\0\0\0\xffd8\xffff\x6b76\tN\0\x69d0!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff0\xffff\x69a8!\x6a38!\x68e0!\xffd8\xffff\x6b76\f\20\0\x6a60!\a\0\1\0\x7055\x6570\x4672\x6c69\x6574\x7372\0\0\xffe8\xffffAGP440\0\0\0\0\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x4cb0\0\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x19e\0\25\0\x6370\x2369\x6576\x5f6e\x3038\x3638\x6426\x7665\x315f\x36311\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x6570!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x1a0\0\25\0\x6370\x2369\x6576\x5f6e\x3038\x3638\x6426\x7665\x315f\x32325\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x6578!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x1a1\0\25\0\x6370\x2369\x6576\x5f6e\x3038\x3638\x6426\x7665\x315f\x3232d\0\xffd8\xffff\x6b76\tN\0\x6c88!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xffe0\xffff\x6b76\a\16\0\x6680!\1\0\1\0\x6553\x7672\x6369e\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98\2\0\0\0\0\xffff\xffff\xffff\xffff\2\0\x6e20!\x6410$\xffff\xffff\0\0\0\0\22\0N\0\x1a2\0\25\0\x6370\x2369\x6576\x5f6e\x3038\x3638\x6426\x7665\x315f\x3232e\0\xffd8\xffff\x6b76\tN\0\x7020!\1\0\1\0\x6c43\x7361\x4773\x4955D\0is\xfff8\xffff\x6fc8!\xfff8\xffff\x4020!\xffd8\xffff\x6b76\tN\0\x6dc8!\1\0\1\0\x6c43\x7361\x4773\x4955D\0\0\0\xffa8\xffff{4D36E97D-E325-11CE-BFC1-08002BE10318}\0\0\0\0\xfff0\xffff\x6da0!\x6f28!\0\0\xff98\xffff\x6b6e \x330\x8b5d\xbf27\x1c3\0\0\x6e98"

scanning hidden registry entries ...

scanning hidden files ...

C:\Program Files\Common Files\Symantec Shared\VirusDefs\lulock.dat
C:\Program Files\Common Files\Symantec Shared\VirusDefs\tmp1851.tmp

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 2


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\ttax.exe"="C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\ttax.exe:LocalSubNet:Enabled:TurboTax"
"C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\updatemgr.exe"="C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"%windir%\\system32\\winav.exe"="%windir%\\system32\\winav.exe:*:Enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\winav.exe"="%windir%\\system32\\winav.exe:*:Enabled:@xpsp2res.dll,-22019"

Remaining Files:
---------------

File Backups: - C:\DOCUME~1\GLADYS~1\Desktop\SDFix\backups\backups.zip

Files with Hidden Attributes:

Wed 10 Oct 2007 625,152 A.SH. --- "C:\Program Files\Internet Explorer\iexplore.exe"
Wed 4 Aug 2004 60,416 A.SH. --- "C:\Program Files\Outlook Express\msimn.exe"
Tue 22 May 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 28 May 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\drmbackup\DRMv1.bak"
Sat 29 Jul 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\drmbackup1\DRMv1.bak"
Wed 27 Jun 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Wed 9 May 2007 0 A.SH. --- "C:\Documents and Settings\All Users\drmbackup1\Cache\Indiv01.tmp"
Wed 9 May 2007 0 A.SH. --- "C:\Documents and Settings\All Users\drmbackup1\Cache\Indiv02.tmp"
Wed 9 May 2007 0 A.SH. --- "C:\Documents and Settings\All Users\drmbackup1\Cache\Indiv03.tmp"
Thu 20 Sep 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\cf7ced0e70c80a1e476f1abf49afecb1\BIT7.tmp"

Finished!
----------------------------------------------------------------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:42:34 PM, on 12/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\MEDIC\bin\sprtcmd.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\winter.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Road Runner High Speed Online
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\proper.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O2 - BHO: (no name) - {D27987B8-7244-4DE0-AE10-39B826B492F1} - C:\WINDOWS\system32\bronto.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MEDIC] "C:\Program Files\MEDIC\bin\sprtcmd.exe" /P MEDIC
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Undefined] C:\WINDOWS\system32\winter.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Undefined] C:\WINDOWS\system32\winter.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [Windows installer] C:\winstall.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Windows installer] C:\winstall.exe (User 'Default user')
O4 - Startup: infos.exe
O4 - Global Startup: autos.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} - http://supportsoft.adelphia.net/sdccommon/...ad/tgctlins.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/downloads/tgctlcm.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/as...rl/LSSupCtl.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/as...rl/SymAData.cab
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1136510436515
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - https://www.peryourhealth.com/viewer/active...tivexviewer.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/as...rl/SymAData.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup...er/imloader.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\wowfx.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - IntelŪ Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 13460 bytes

Edited by mike_77, 18 December 2007 - 07:04 PM.


#6 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:03:57 PM

Posted 18 December 2007 - 07:33 PM

Let's run ComboFix.


I see you are running Teatimer.
Please disable it because it can interfere with the changes you'll make on your system.
If teatimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.

How to disable TeaTimer during HijackThis Cleanup
When everything is done and your log is clean again, you can enable it again.

Then, Download ResetTeaTimer.bat.
Double click ResetTeaTimer.bat to remove all entries set by TeaTimer.

Disable Norton Antivirus while you run ComboFix.


You should NOT use Combofix unless you have been instructed to do so by a Malware Removal Expert. It is intended by its creator to be used under the guidance and supervision of an expert, not for private use. Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.


If you have used Combofix before, please delete the version you have and redownload it again, because Combofix is being updated everyday.

Disconnect from the Internet while running ComboFix.

Temporarily disable any anti-virus and anti-malware real-time protection before performing a scan.
They can interfere with ComboFix or remove some of its embedded files which may cause unpredictable results.
Some scanners may see some combofix related components as suspicious and block or delete them while there's nothing wrong with them.



1. Download this file - combofix.exe to your Desktop.
Note:
It is important that it is saved directly to your desktop

2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you, C:\ComboFix.txt. Post the ComboFix log and a fresh Hijackthis log in your next reply.
Do NOT post the ComboFix-quarantined-files.txt - unless I ask you to.
Do NOT run ComboFix more than once.
Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall
Do not run Combofix more than once.
In case you see a sed.cfexe error with the option to send a report or not, choose "don't send".
The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

If you have Norton Antivirus installed then disable script blocking so it will not interfere with the fix. Note that some versions of Norton Antivirus do not have script blocking.

To disable Norton Script blocking Service:

* Disable the Script Blocking Service:
To open Services, click Start, point to Settings, and then click Control Panel.
Double-click Administrative Tools, and then double-click Services.
Find ScriptBlocking services, Right-click the service, and then click and then click Properties.
On the General tab, under Startup, click Disabled.
Under Service Status, click Stop button. Click Apply button.

* Disable the Script Blocking In Norton Settings:
Start Norton Antivirus.
Click Options. If a menu appears when you click Options, then click Norton Antivirus. The Norton Antivirus Options dialog box appears.
Click Script Blocking.
Uncheck Enable Script Blocking (recommended).
Click OK
You can reenable it afterwards when everything is clean again.

Edited by SifuMike, 18 December 2007 - 07:34 PM.

If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#7 mike_77

mike_77
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:57 PM

Posted 18 December 2007 - 08:15 PM

SifuMike,
Ok, I'm an idiot.

I ran ComboFix as you instructed and I was pretty sure that I had turned off my modem before I ran ComboFix. However, when ComboFix finished running, rebooting and creating the log, I noticed that the modem was on. Will this corrupt the ComboFix Report? I have posted it and the new HijackThis logs below.

Sorry for any aggravation I have caused.

Mike

ComboFix 07-12-19.2 - Gladys Morgan 2007-12-18 19:56:41.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1071 [GMT -5:00]
Running from: C:\Documents and Settings\Gladys Morgan\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\infos.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\autos.exe
C:\Documents and Settings\Gladys Morgan\Application Data\antivirus.exe
C:\Documents and Settings\Gladys Morgan\Start Menu\Programs\Startup\infos.exe
C:\WINDOWS\system32\proper.exe
C:\WINDOWS\system32\winter.exe
C:\WINDOWS\system32\wowfx.dll

.
((((((((((((((((((((((((( Files Created from 2007-11-19 to 2007-12-19 )))))))))))))))))))))))))))))))
.

2007-12-18 18:39 . 2007-12-18 18:39 <DIR> d-------- C:\Program Files\EliteProtector
2007-12-18 18:15 . 2007-12-18 18:16 <DIR> d-------- C:\WINDOWS\ERUNT
2007-12-18 18:10 . 2003-12-10 03:39 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Symantec
2007-12-18 18:10 . 2003-12-10 03:41 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Sonic
2007-12-18 18:10 . 2003-12-10 03:44 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Jasc Software Inc
2007-12-17 18:06 . 2007-12-17 18:06 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-17 15:50 . 2007-12-17 15:50 11,776 --a------ C:\WINDOWS\wsystmp_aeo.exe
2007-12-17 15:49 . 2007-12-17 15:49 29,184 --a------ C:\WINDOWS\wsystmp_bcu.exe
2007-12-17 11:25 . 2007-12-17 13:07 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2007-12-17 04:51 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\SDTHOOK.SYS
2007-12-17 04:32 . 2007-12-17 04:32 2,550 --a------ C:\WINDOWS\SYSTEM32\Uninstall.ico
2007-12-17 04:32 . 2007-12-17 04:32 1,406 --a------ C:\WINDOWS\SYSTEM32\Help.ico
2007-12-17 04:27 . 2007-12-17 06:07 <DIR> d-------- C:\WINDOWS\SYSTEM32\ActiveScan
2007-12-17 04:27 . 2007-12-17 04:32 30,590 --a------ C:\WINDOWS\SYSTEM32\pavas.ico
2007-12-17 01:32 . 2007-08-01 22:47 102,664 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\tmcomm.sys
2007-12-17 01:08 . 2007-12-17 01:40 <DIR> d-------- C:\Documents and Settings\Gladys Morgan\.housecall6.6
2007-12-16 22:11 . 2007-12-16 22:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-16 16:22 . 2007-12-16 16:22 <DIR> d-------- C:\Program Files\Lavasoft
2007-12-16 16:22 . 2007-12-16 16:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-16 16:20 . 2007-12-16 16:20 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-12-16 14:52 . 2007-12-16 17:22 <DIR> d-------- C:\Program Files\Spyware Doctor
2007-12-16 14:52 . 2007-12-16 14:52 <DIR> d-------- C:\Documents and Settings\Gladys Morgan\Application Data\PC Tools
2007-12-16 14:52 . 2007-12-16 14:53 74,240 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\iksyssec.sys
2007-12-16 14:52 . 2007-12-16 14:53 56,832 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\iksysflt.sys
2007-12-16 14:52 . 2007-10-18 00:14 41,288 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\ikfilesec.sys
2007-12-16 14:52 . 2007-10-18 00:16 29,000 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\kcom.sys
2007-12-16 14:51 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\SYSTEM32\msvcr80.dll
2007-12-16 03:39 . 2007-12-16 03:39 15,872 --a------ C:\WINDOWS\windisk.dll
2007-12-16 03:21 . 2007-12-16 03:21 28,929 --a------ C:\WINDOWS\trayicons.exe
2007-12-16 03:21 . 2007-12-16 03:21 28,929 --a------ C:\Documents and Settings\Gladys Morgan\wn852.exe
2007-12-14 19:28 . 2004-05-14 16:53 462,848 --a------ C:\WINDOWS\SYSTEM32\ltkrn13n.dll
2007-12-14 19:28 . 2004-05-14 16:53 450,560 --a------ C:\WINDOWS\SYSTEM32\ltimg13n.dll
2007-12-14 19:28 . 2004-05-14 16:53 401,408 --a------ C:\WINDOWS\SYSTEM32\lfcmp13n.dll
2007-12-14 19:28 . 2004-05-14 16:53 299,008 --a------ C:\WINDOWS\SYSTEM32\ltdis13n.dll
2007-12-14 19:28 . 2004-01-12 02:09 206,336 --a------ C:\WINDOWS\SYSTEM32\ltefx13n.dll
2007-12-14 19:28 . 2004-05-14 16:53 163,840 --a------ C:\WINDOWS\SYSTEM32\ltfil13n.dll
2007-12-14 19:28 . 2003-11-04 15:10 69,632 --a------ C:\WINDOWS\SYSTEM32\lfgif13n.dll
2007-12-14 19:28 . 2004-05-14 16:53 57,344 --a------ C:\WINDOWS\SYSTEM32\lfbmp13n.dll
2007-12-06 01:33 . 2007-12-06 01:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PopCap
2007-12-01 04:15 . 2007-12-01 04:15 <DIR> d-------- C:\Program Files\Microsoft Silverlight

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-18 23:40 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-12-17 10:39 --------- d-----w C:\Program Files\Norton Personal Firewall
2007-12-17 10:36 --------- d-----w C:\Program Files\iTunes
2007-12-17 10:34 --------- d-----w C:\Program Files\Google
2007-12-06 08:47 --------- d-----w C:\Program Files\eMusic Remote
2007-12-01 22:36 --------- d-----w C:\Program Files\Norton SystemWorks
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-10 02:55 --------- d-----w C:\Documents and Settings\Gladys Morgan\Application Data\Image Zone Express
2007-11-06 03:27 --------- d-----w C:\Program Files\iPod
2007-11-06 03:26 --------- d-----w C:\Program Files\QuickTime
2007-10-25 22:40 --------- d-----w C:\Documents and Settings\Gladys Morgan\Application Data\eMusic
2007-10-25 15:26 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
2007-02-24 04:53 87,608 ----a-w C:\Documents and Settings\Gladys Morgan\Application Data\ezpinst.exe
2007-02-24 04:53 47,360 ----a-w C:\Documents and Settings\Gladys Morgan\Application Data\pcouffin.sys
2003-12-24 03:50 164 ---ha-w C:\Documents and Settings\All Users\hpothb07.dat
2003-12-24 03:50 0 ---ha-w C:\Documents and Settings\Gladys Morgan\hpothb07.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sonic RecordNow!"="" []
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-01-27 18:26]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 04:59 C:\WINDOWS\BCMSMMSG.exe]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2003-08-06 02:04]
"DwlClient"="C:\Program Files\Common Files\Dell\EUSW\Support.exe" [2004-05-27 20:05]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-03-09 10:47]
"AcctMgr"="C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe" [2003-12-10 15:56]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 02:56 C:\WINDOWS\SYSTEM32\rundll32.exe]
"nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\SYSTEM32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-04 02:56 C:\WINDOWS\SYSTEM32\rundll32.exe]
"MEDIC"="C:\Program Files\MEDIC\bin\sprtcmd.exe" [2006-12-27 19:04]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 01:41]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-07-29 16:45]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-10-19 20:16]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-02 18:36]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows installer"="C:\winstall.exe" []

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-10-10 19:51 39792 --a------ C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mswspl]
2006-10-18 20:46 64000 --a------ C:\Program Files\Windows Media Player\wmplayer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StorageGuard]
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe /r

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9 -reboot 1

R3 NPDriver;Norton Unerase Protection Driver;C:\WINDOWS\System32\Drivers\NPDRIVER.SYS [2003-09-10 05:12]
S3 SDdriver;SDdriver;C:\WINDOWS\System32\Drivers\sddriver.sys [2003-09-10 04:58]
S3 SDTHOOK;SDTHOOK;C:\WINDOWS\system32\DRIVERS\SDTHOOK.sys [2007-06-05 10:56]

.
Contents of the 'Scheduled Tasks' folder
"2007-12-18 03:18:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-05-26 00:01:40 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - Gladys Morgan.job"
- C:\PROGRA~1\NORTON~2\NORTON~1\NAVW32.EXEh/task:
"2007-12-15 02:18:13 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer.job"
- C:\PROGRA~1\NORTON~2\NORTON~1\Navw32.exeh/task:
"2007-12-01 22:36:35 C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job"
- C:\Program Files\Norton SystemWorks\OBC.exe
"2007-12-18 05:00:00 C:\WINDOWS\Tasks\Symantec Drmc.job"
- C:\Program Files\Common Files\Symantec Shared\SymDrmc.exe
"2007-12-19 00:57:00 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDetect.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-18 20:03:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-18 20:05:09 - machine was rebooted
.
2007-12-18 06:05:38 --- E O F ---

--------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:08:16 PM, on 12/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MEDIC\bin\sprtcmd.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MEDIC] "C:\Program Files\MEDIC\bin\sprtcmd.exe" /P MEDIC
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [Windows installer] C:\winstall.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Windows installer] C:\winstall.exe (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} - http://supportsoft.adelphia.net/sdccommon/...ad/tgctlins.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/downloads/tgctlcm.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/as...rl/LSSupCtl.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/as...rl/SymAData.cab
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1136510436515
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - https://www.peryourhealth.com/viewer/active...tivexviewer.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/as...rl/SymAData.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup...er/imloader.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 11916 bytes

#8 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:03:57 PM

Posted 18 December 2007 - 08:53 PM

Hi mike_77,

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:
  • Download the latest version of  Java Runtime Environment (JRE) 6 Update 3.
  • Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 3".
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement".
  • The page will refresh.
  • Click on the link to download Windows Offline Installation, Multi-language  jre-6-windows-i586.exe and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
    Examples of older versions in Add or Remove Programs:
    Java 2 Runtime Environment, SE v1.4.2
    J2SE Runtime Environment 5.0
    J2SE Runtime Environment 5.0 Update 6
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u3-windows-i586-p.exe to install the newest version.
Download CCleaner and install it. (default location is best). Do not run it yet!

CCleaner Tutorial



*******************************************

Make sure you have Teatimer disabled, as it will prevent our fixes.


Select the following with HijackThis.
With all windows (including this one!) closed (close browser/explorer windows), please select "fix checked"

O4 - HKUS\S-1-5-18\..\Run: [Windows installer] C:\winstall.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Windows installer] C:\winstall.exe (User 'Default user')



*******************************************

*NOTE* CCleaner deletes EVERYTHING out of temp/temporary folders and does not make backups.

Let's empty the temp files:

Run CCleaner.

CAUTION: Please do NOT use the Issues or Registry button. This is a built-in registry cleaner. If you don't know how to use it, you may cause irreparable damage to your system.

1. Starting with v1.27.260, CCleaner installs the Yahoo Toolbar as an option which IS checkmarked by default during the installation.
IF you do NOT want it, REMOVE the checkmark when provided with the option OR download the toolbarfree Basic version instead of the Standard Build.


2. Before first use, select Options > Advanced and UNCHECK "Only delete files in Windows Temp folder older than 48 hours"

3. Then select the items you wish to clean up.

In the Windows Tab:
? Clean all entries in the "Internet Explorer" section except Autocomplete Forum History.
? Clean all the entries in the "Windows Explorer" section.
? Clean all entries in the "System" section except for Start Menu Shortcuts and Desktop Shortcuts.
? Clean any others that you choose.

In the Applications Tab:
? Clean all including cookies in the Firefox/Mozilla section if you use it.
? Clean all in the Opera section if you use it.
? Clean Sun Java in the Internet Section.
? Clean any others that you choose.

4. Click the "Run Cleaner" button.
5. A pop up box will appear advising this process will permanently delete files from your system.
6. Click "OK" and it will scan and clean your system.
7. Click "exit" when done.

If it asks you to reboot at the end, click NO.

CCleaner should be run with the above settings for each User Account!

*******************************************

Click Start, then Run and type Notepad and click OK.
Open notepad - don't use any other text editor than notepad or the script will fail.
Copy/paste the text in the code box below into notepad:

File:: 
C:\winstall.exe

Registry:: 
[-HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows installer"=-


Name the Notepad file CFScript.txt and Save it to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.


Posted Image

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Edited by SifuMike, 18 December 2007 - 08:56 PM.

If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#9 mike_77

mike_77
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:57 PM

Posted 18 December 2007 - 09:36 PM

SifuMike,
Here are the logs.
Mike

ComboFix 07-12-19.2 - Gladys Morgan 2007-12-18 21:23:34.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1077 [GMT -5:00]
Running from: C:\Documents and Settings\Gladys Morgan\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Gladys Morgan\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\winstall.exe
.

((((((((((((((((((((((((( Files Created from 2007-11-19 to 2007-12-19 )))))))))))))))))))))))))))))))
.

2007-12-18 21:19 . 2007-12-18 21:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2007-12-18 21:08 . 2007-12-18 21:08 <DIR> d-------- C:\Program Files\Yahoo!
2007-12-18 21:08 . 2007-12-18 21:08 <DIR> d-------- C:\Program Files\CCleaner
2007-12-18 21:05 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\SYSTEM32\javacpl.cpl
2007-12-18 21:04 . 2007-12-18 21:04 <DIR> d-------- C:\Program Files\Common Files\Java
2007-12-18 18:39 . 2007-12-18 18:39 <DIR> d-------- C:\Program Files\EliteProtector
2007-12-18 18:15 . 2007-12-18 18:16 <DIR> d-------- C:\WINDOWS\ERUNT
2007-12-18 18:10 . 2003-12-10 03:39 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Symantec
2007-12-18 18:10 . 2003-12-10 03:41 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Sonic
2007-12-18 18:10 . 2003-12-10 03:44 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Jasc Software Inc
2007-12-17 18:06 . 2007-12-17 18:06 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-17 15:50 . 2007-12-17 15:50 11,776 --a------ C:\WINDOWS\wsystmp_aeo.exe
2007-12-17 15:49 . 2007-12-17 15:49 29,184 --a------ C:\WINDOWS\wsystmp_bcu.exe
2007-12-17 11:25 . 2007-12-17 13:07 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2007-12-17 04:51 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\SDTHOOK.SYS
2007-12-17 04:32 . 2007-12-17 04:32 2,550 --a------ C:\WINDOWS\SYSTEM32\Uninstall.ico
2007-12-17 04:32 . 2007-12-17 04:32 1,406 --a------ C:\WINDOWS\SYSTEM32\Help.ico
2007-12-17 04:27 . 2007-12-17 06:07 <DIR> d-------- C:\WINDOWS\SYSTEM32\ActiveScan
2007-12-17 04:27 . 2007-12-17 04:32 30,590 --a------ C:\WINDOWS\SYSTEM32\pavas.ico
2007-12-17 01:32 . 2007-08-01 22:47 102,664 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\tmcomm.sys
2007-12-17 01:08 . 2007-12-17 01:40 <DIR> d-------- C:\Documents and Settings\Gladys Morgan\.housecall6.6
2007-12-16 22:11 . 2007-12-16 22:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-16 16:22 . 2007-12-16 16:22 <DIR> d-------- C:\Program Files\Lavasoft
2007-12-16 16:22 . 2007-12-16 16:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-16 16:20 . 2007-12-16 16:20 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-12-16 14:52 . 2007-12-16 17:22 <DIR> d-------- C:\Program Files\Spyware Doctor
2007-12-16 14:52 . 2007-12-16 14:52 <DIR> d-------- C:\Documents and Settings\Gladys Morgan\Application Data\PC Tools
2007-12-16 14:52 . 2007-12-16 14:53 74,240 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\iksyssec.sys
2007-12-16 14:52 . 2007-12-16 14:53 56,832 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\iksysflt.sys
2007-12-16 14:52 . 2007-10-18 00:14 41,288 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\ikfilesec.sys
2007-12-16 14:52 . 2007-10-18 00:16 29,000 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\kcom.sys
2007-12-16 14:51 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\SYSTEM32\msvcr80.dll
2007-12-16 03:39 . 2007-12-16 03:39 15,872 --a------ C:\WINDOWS\windisk.dll
2007-12-16 03:21 . 2007-12-16 03:21 28,929 --a------ C:\WINDOWS\trayicons.exe
2007-12-16 03:21 . 2007-12-16 03:21 28,929 --a------ C:\Documents and Settings\Gladys Morgan\wn852.exe
2007-12-14 19:28 . 2004-05-14 16:53 462,848 --a------ C:\WINDOWS\SYSTEM32\ltkrn13n.dll
2007-12-14 19:28 . 2004-05-14 16:53 450,560 --a------ C:\WINDOWS\SYSTEM32\ltimg13n.dll
2007-12-14 19:28 . 2004-05-14 16:53 401,408 --a------ C:\WINDOWS\SYSTEM32\lfcmp13n.dll
2007-12-14 19:28 . 2004-05-14 16:53 299,008 --a------ C:\WINDOWS\SYSTEM32\ltdis13n.dll
2007-12-14 19:28 . 2004-01-12 02:09 206,336 --a------ C:\WINDOWS\SYSTEM32\ltefx13n.dll
2007-12-14 19:28 . 2004-05-14 16:53 163,840 --a------ C:\WINDOWS\SYSTEM32\ltfil13n.dll
2007-12-14 19:28 . 2003-11-04 15:10 69,632 --a------ C:\WINDOWS\SYSTEM32\lfgif13n.dll
2007-12-14 19:28 . 2004-05-14 16:53 57,344 --a------ C:\WINDOWS\SYSTEM32\lfbmp13n.dll
2007-12-06 01:33 . 2007-12-06 01:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PopCap
2007-12-01 04:15 . 2007-12-01 04:15 <DIR> d-------- C:\Program Files\Microsoft Silverlight

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-19 02:08 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-12-19 02:05 --------- d-----w C:\Program Files\Java
2007-12-17 10:39 --------- d-----w C:\Program Files\Norton Personal Firewall
2007-12-17 10:36 --------- d-----w C:\Program Files\iTunes
2007-12-17 10:34 --------- d-----w C:\Program Files\Google
2007-12-06 08:47 --------- d-----w C:\Program Files\eMusic Remote
2007-12-01 22:36 --------- d-----w C:\Program Files\Norton SystemWorks
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-10 02:55 --------- d-----w C:\Documents and Settings\Gladys Morgan\Application Data\Image Zone Express
2007-11-06 03:27 --------- d-----w C:\Program Files\iPod
2007-11-06 03:26 --------- d-----w C:\Program Files\QuickTime
2007-10-30 23:42 3,590,656 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\SYSTEM32\quartz.dll
2007-10-29 22:43 1,287,680 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\quartz.dll
2007-10-27 22:40 222,720 ----a-w C:\WINDOWS\SYSTEM32\wmasf.dll
2007-10-27 22:40 222,720 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wmasf.dll
2007-10-26 03:34 8,460,288 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\shell32.dll
2007-10-25 22:40 --------- d-----w C:\Documents and Settings\Gladys Morgan\Application Data\eMusic
2007-10-25 15:26 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
2007-10-10 23:56 824,832 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wininet.dll
2007-10-10 23:56 232,960 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\webcheck.dll
2007-10-10 23:56 1,159,680 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\urlmon.dll
2007-10-10 23:55 671,232 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mstime.dll
2007-10-10 23:55 63,488 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\icardie.dll
2007-10-10 23:55 6,065,664 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll
2007-10-10 23:55 52,224 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\msfeedsbs.dll
2007-10-10 23:55 478,208 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtmled.dll
2007-10-10 23:55 459,264 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\msfeeds.dll
2007-10-10 23:55 44,544 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iernonce.dll
2007-10-10 23:55 384,512 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iedkcs32.dll
2007-10-10 23:55 383,488 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dll
2007-10-10 23:55 27,648 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\jsproxy.dll
2007-10-10 23:55 267,776 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iertutil.dll
2007-10-10 23:55 230,400 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieaksie.dll
2007-10-10 23:55 214,528 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtrans.dll
2007-10-10 23:55 193,024 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\msrating.dll
2007-10-10 23:55 153,088 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakeng.dll
2007-10-10 23:55 132,608 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\extmgr.dll
2007-10-10 23:55 124,928 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\advpack.dll
2007-10-10 23:55 105,984 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\url.dll
2007-10-10 23:55 102,400 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\occache.dll
2007-10-10 10:59 70,656 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ie4uinit.exe
2007-10-10 10:59 625,152 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iexplore.exe
2007-10-10 10:59 13,824 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe
2007-10-10 05:46 161,792 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakui.dll
2007-02-24 04:53 87,608 ----a-w C:\Documents and Settings\Gladys Morgan\Application Data\ezpinst.exe
2007-02-24 04:53 47,360 ----a-w C:\Documents and Settings\Gladys Morgan\Application Data\pcouffin.sys
2003-12-24 03:50 164 ---ha-w C:\Documents and Settings\All Users\hpothb07.dat
2003-12-24 03:50 0 ---ha-w C:\Documents and Settings\Gladys Morgan\hpothb07.dat
.

((((((((((((((((((((((((((((( snapshot@2007-12-18_20.04.29.68 )))))))))))))))))))))))))))))))))))))))))
.
- 2003-12-10 08:24:35 24,670 ----a-w C:\WINDOWS\SYSTEM32\java.exe
+ 2007-09-25 03:30:28 135,168 ----a-w C:\WINDOWS\SYSTEM32\java.exe
- 2003-12-10 08:24:35 28,768 ----a-w C:\WINDOWS\SYSTEM32\javaw.exe
+ 2007-09-25 03:30:30 135,168 ----a-w C:\WINDOWS\SYSTEM32\javaw.exe
+ 2007-09-25 04:31:42 139,264 ----a-w C:\WINDOWS\SYSTEM32\javaws.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sonic RecordNow!"="" []
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-01-27 18:26]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 04:59 C:\WINDOWS\BCMSMMSG.exe]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2003-08-06 02:04]
"DwlClient"="C:\Program Files\Common Files\Dell\EUSW\Support.exe" [2004-05-27 20:05]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-03-09 10:47]
"AcctMgr"="C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe" [2003-12-10 15:56]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 02:56 C:\WINDOWS\SYSTEM32\rundll32.exe]
"nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\SYSTEM32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-04 02:56 C:\WINDOWS\SYSTEM32\rundll32.exe]
"MEDIC"="C:\Program Files\MEDIC\bin\sprtcmd.exe" [2006-12-27 19:04]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 01:41]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-07-29 16:45]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-10-19 20:16]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-02 18:36]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-10-10 19:51 39792 --a------ C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mswspl]
2006-10-18 20:46 64000 --a------ C:\Program Files\Windows Media Player\wmplayer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StorageGuard]
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe /r

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9 -reboot 1

R3 NPDriver;Norton Unerase Protection Driver;C:\WINDOWS\System32\Drivers\NPDRIVER.SYS [2003-09-10 05:12]
S3 SDdriver;SDdriver;C:\WINDOWS\System32\Drivers\sddriver.sys [2003-09-10 04:58]
S3 SDTHOOK;SDTHOOK;C:\WINDOWS\system32\DRIVERS\SDTHOOK.sys [2007-06-05 10:56]

.
Contents of the 'Scheduled Tasks' folder
"2007-12-18 03:18:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-05-26 00:01:40 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - Gladys Morgan.job"
- C:\PROGRA~1\NORTON~2\NORTON~1\NAVW32.EXEh/task:
"2007-12-15 02:18:13 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer.job"
- C:\PROGRA~1\NORTON~2\NORTON~1\Navw32.exeh/task:
"2007-12-01 22:36:35 C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job"
- C:\Program Files\Norton SystemWorks\OBC.exe
"2007-12-18 05:00:00 C:\WINDOWS\Tasks\Symantec Drmc.job"
- C:\Program Files\Common Files\Symantec Shared\SymDrmc.exe
"2007-12-19 02:27:00 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDetect.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-18 21:27:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
Completion time: 2007-12-18 21:28:53
C:\ComboFix2.txt ... 2007-12-18 20:05
.
2007-12-18 06:05:38 --- E O F ---

-----------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:31:23 PM, on 12/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe
C:\Program Files\MEDIC\bin\sprtcmd.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MEDIC] "C:\Program Files\MEDIC\bin\sprtcmd.exe" /P MEDIC
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} - http://supportsoft.adelphia.net/sdccommon/...ad/tgctlins.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/downloads/tgctlcm.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/as...rl/LSSupCtl.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/as...rl/SymAData.cab
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1136510436515
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - https://www.peryourhealth.com/viewer/active...tivexviewer.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/as...rl/SymAData.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup...er/imloader.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 12556 bytes

#10 mike_77

mike_77
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:57 PM

Posted 18 December 2007 - 09:52 PM

Hmmm... For some reason I could not see my post of Today 09:36PM.

#11 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:03:57 PM

Posted 18 December 2007 - 10:11 PM

Hi mike_77,

Hmmm... For some reason I could not see my post of Today 09:36PM.

I am not sure what you mean. I see a total of 11 logs posted, 9 posted today.


You have some suspicious files we need to check.

Go to My Computer and double-click C.
Go to the Tools menu and select 'Folder Options'.
On the 'View' tab select 'show hidden files and folders',
deselect (uncheck) 'hide protected operating system files (recommended)', and
deselect (uncheck) "Hide extensions for known file types.'


Go to next site: http://www.virustotal.com/en/indexf.html
On top you'll find 'Browse'
Click the browse button and browse to next file:

C:\WINDOWS\wsystmp_bcu.exe


Click open.
Then click the 'Send' button next to it.
This will scan the file. Please be patient.
Save the results in notepad.

Perform the same for next files:
C:\WINDOWS\wsystmp_aeo.exe
C:\WINDOWS\trayicons.exe
C:\WINDOWS\windisk.dll
C:\Documents and Settings\Gladys Morgan\wn852.exe



Once scanned, copy and paste the results also in your next reply.

NOTE: I usually enter my email address at virus total so they can send me the scan results. They usually only take a couple minutes to reply.
You can copy/paste the results of scan results here.

How is the computer running? :thumbsup:

Edited by SifuMike, 18 December 2007 - 10:24 PM.

If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#12 mike_77

mike_77
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:57 PM

Posted 18 December 2007 - 10:36 PM

SifuMike,
I have posted the Virus Total scans of the files you designated below.

As to not being able to see certain posts.... When I click on the link to the topic and scroll down, the last post I can see is your post of today at 08:53PM (first couple lines quoted below). Under your post of 08:53PM I can see my name, but I simply cannot scroll down any farther; the vertical slider is all the way at the bottom of the field.

"Hi mike_77,

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. "

In fact, to see your most recent post I had to view your profile and look at your recent posts (I had to do the same thing to see my own posts since you 8:53 post). Am I doing something incredibly stupid, like not clicking "Next Page?"

Hey! I am not getting that obnoxious pop-up anymore, and, unless I am becoming irrationally exuberant, I think the machine is running faster than when this whole debacle started!!!


File wsystmp_bcu.exe received on 12.19.2007 04:20:30 (CET)Antivirus Version Last Update Result
AhnLab-V3 - - -
AntiVir - - -
Authentium - - -
Avast - - -
AVG - - I-Worm/Nuwar.C
BitDefender - - Trojan.Peed.Gen
CAT-QuickHeal - - -
ClamAV - - -
DrWeb - - Trojan.Packed.255
eSafe - - Suspicious File
eTrust-Vet - - -
Ewido - - -
FileAdvisor - - -
Fortinet - - -
F-Prot - - -
F-Secure - - Trojan-Downloader.Win32.Tibs.ry
Ikarus - - Trojan-Downloader.Win32.Tibs.ry
Kaspersky - - Trojan-Downloader.Win32.Tibs.ry
McAfee - - -
Microsoft - - Trojan:Win32/Tibs.gen!ldr
NOD32v2 - - -
Norman - - -
Panda - - -
Prevx1 - - TROJAN.PEED.AK
Rising - - -
Sophos - - -
Sunbelt - - -
Symantec - - -
TheHacker - - -
VBA32 - - -
VirusBuster - - -
Webwasher-Gateway - - -

Additional information
MD5: 012d668a99d6d97685fbc710cea3d3a9
--------

File wsystmp_aeo.exe received on 12.08.2007 01:02:17 (CET)Antivirus Version Last Update Result
AhnLab-V3 - - -
AntiVir - - TR/Crypt.XPACK.Gen
Authentium - - -
Avast - - -
AVG - - Downloader.Agent.14.N
BitDefender - - BehavesLike:Win32.Malware
CAT-QuickHeal - - (Suspicious) - DNAScan
ClamAV - - -
DrWeb - - Trojan.DownLoader.37508
eSafe - - Suspicious File
eTrust-Vet - - -
Ewido - - -
FileAdvisor - - -
Fortinet - - -
F-Prot - - W32/Threat-HLLSI-based!Maximus
F-Secure - - -
Ikarus - - -
Kaspersky - - -
McAfee - - -
Microsoft - - -
NOD32v2 - - probably unknown NewHeur_PE virus
Norman - - -
Panda - - Suspicious file
Prevx1 - - Agent.I
Rising - - -
Sophos - - -
Sunbelt - - -
Symantec - - -
TheHacker - - -
VBA32 - - suspected of Downloader.Small.159
VirusBuster - - -
Webwasher-Gateway - - Trojan.Crypt.XPACK.Gen

Additional information
MD5: e2af133b38139dcb10f744b5b46b871f

#13 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:03:57 PM

Posted 18 December 2007 - 10:48 PM

I added several more files to check. Go back to my previous post and run Virus Total on those files and post the results, then we will kill them all at once. :thumbsup:
If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#14 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:03:57 PM

Posted 18 December 2007 - 11:00 PM

I can see my name, but I simply cannot scroll down any farther; the vertical slider is all the way at the bottom of the field.


You are doing something wrong, as I can see everything you type.
Press the "restore down" button (upper rt hand corner) , so the Window is smaller. Then use the bottom slider and slide it to the right so you can use the vertical slider bar.

Edited by SifuMike, 18 December 2007 - 11:03 PM.

If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#15 mike_77

mike_77
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:57 PM

Posted 18 December 2007 - 11:38 PM

I ran the additional files you suggested and posted the results below, including the two that you initially requested (I had Virus Total Reanalyze them).

I restored down as you suggested, but I still cannot scroll to the bottom of the topic. I tried a couple of the other topics and I am be able to scroll all the way to the bottom. I have attached a screenshot of the bottom of this topic as it appears on my screen. I am sure I doing something dumb, I just don't know what.

File wsystmp_aeo.exe received on 12.19.2007 05:09:51 (CET)Antivirus Version Last Update Result
AhnLab-V3 2007.12.19.10 2007.12.18 -
AntiVir 7.6.0.45 2007.12.18 TR/Crypt.XPACK.Gen
Authentium 4.93.8 2007.12.19 -
Avast 4.7.1098.0 2007.12.18 -
AVG 7.5.0.503 2007.12.19 Downloader.Agent.14.N
BitDefender 7.2 2007.12.19 BehavesLike:Win32.Malware
CAT-QuickHeal 9.00 2007.12.18 Trojan.Agent.dki
ClamAV 0.91.2 2007.12.19 -
DrWeb 4.44.0.09170 2007.12.18 Trojan.DownLoader.37508
eSafe 7.0.15.0 2007.12.18 Suspicious File
eTrust-Vet 31.3.5386 2007.12.18 -
Ewido 4.0 2007.12.18 -
FileAdvisor 1 2007.12.19 -
Fortinet 3.14.0.0 2007.12.19 -
F-Prot 4.4.2.54 2007.12.18 W32/Threat-HLLSI-based!Maximus
F-Secure 6.70.13030.0 2007.12.19 Trojan.Win32.Agent.dki
Ikarus T3.1.1.15 2007.12.19 BehavesLikeWin32.Malware
Kaspersky 7.0.0.125 2007.12.19 Trojan.Win32.Agent.dki
McAfee 5188 2007.12.18 -
Microsoft 1.3109 2007.12.18 TrojanDownloader:Win32/Agent.BDA
NOD32v2 2732 2007.12.19 probably unknown NewHeur_PE virus
Norman 5.80.02 2007.12.18 -
Panda 9.0.0.4 2007.12.18 W32/Booto.B.worm
Prevx1 V2 2007.12.19 Agent.I
Rising 20.23.20.00 2007.12.19 -
Sophos 4.24.0 2007.12.18 Mal/Generic-A
Sunbelt 2.2.907.0 2007.12.19 -
Symantec 10 2007.12.19 -
TheHacker 6.2.9.164 2007.12.18 -
VBA32 3.12.2.5 2007.12.18 suspected of Downloader.Small.159
VirusBuster 4.3.26:9 2007.12.18 -
Webwasher-Gateway 6.6.2 2007.12.19 Trojan.Crypt.XPACK.Gen

Additional information
File size: 11776 bytes
MD5: e2af133b38139dcb10f744b5b46b871f
SHA1: ed22e10d0f273da3e17229e1bd6b125c42f94b7c
PEiD: -
Prevx info: http://info.prevx.com/aboutprogramtext.asp...1B42100CBCAAA41
----------------------


File wsystmp_bcu.exe received on 12.19.2007 05:20:12 (CET)Antivirus Version Last Update Result
AhnLab-V3 2007.12.19.10 2007.12.18 -
AntiVir 7.6.0.45 2007.12.18 -
Authentium 4.93.8 2007.12.19 -
Avast 4.7.1098.0 2007.12.18 -
AVG 7.5.0.503 2007.12.19 I-Worm/Nuwar.C
BitDefender 7.2 2007.12.19 Trojan.Peed.Gen
CAT-QuickHeal 9.00 2007.12.18 -
ClamAV 0.91.2 2007.12.19 -
DrWeb 4.44.0.09170 2007.12.18 Trojan.Packed.255
eSafe 7.0.15.0 2007.12.18 Suspicious File
eTrust-Vet 31.3.5386 2007.12.18 -
Ewido 4.0 2007.12.18 -
FileAdvisor 1 2007.12.19 -
Fortinet 3.14.0.0 2007.12.19 -
F-Prot 4.4.2.54 2007.12.18 -
F-Secure 6.70.13030.0 2007.12.19 Trojan-Downloader.Win32.Tibs.ry
Ikarus T3.1.1.15 2007.12.19 Trojan-Downloader.Win32.Tibs.ry
Kaspersky 7.0.0.125 2007.12.19 Trojan-Downloader.Win32.Tibs.ry
McAfee 5188 2007.12.18 -
Microsoft 1.3109 2007.12.18 Trojan:Win32/Tibs.gen!ldr
NOD32v2 2732 2007.12.19 -
Norman 5.80.02 2007.12.18 -
Panda 9.0.0.4 2007.12.18 -
Prevx1 V2 2007.12.19 TROJAN.PEED.AK
Rising 20.23.20.00 2007.12.19 -
Sophos 4.24.0 2007.12.18 -
Sunbelt 2.2.907.0 2007.12.19 -
Symantec 10 2007.12.19 -
TheHacker 6.2.9.164 2007.12.18 -
VBA32 3.12.2.5 2007.12.18 -
VirusBuster 4.3.26:9 2007.12.18 -
Webwasher-Gateway 6.6.2 2007.12.19 -

Additional information
File size: 29184 bytes
MD5: 012d668a99d6d97685fbc710cea3d3a9
SHA1: 08634630dd8f623bf6f18704ab0dd3b99f16aa8a
PEiD: -
Prevx info: http://info.prevx.com/aboutprogramtext.asp...4D6A80021822C09
-------------------------------


File trayicons.exe received on 12.19.2007 05:25:43 (CET)Antivirus Version Last Update Result
AhnLab-V3 2007.12.19.10 2007.12.18 -
AntiVir 7.6.0.45 2007.12.18 TR/Crypt.ULPM.Gen
Authentium 4.93.8 2007.12.19 -
Avast 4.7.1098.0 2007.12.18 -
AVG 7.5.0.503 2007.12.19 Downloader.Small.60.W
BitDefender 7.2 2007.12.19 -
CAT-QuickHeal 9.00 2007.12.18 Trojan.VB.kpu
ClamAV 0.91.2 2007.12.19 -
DrWeb 4.44.0.09170 2007.12.18 -
eSafe 7.0.15.0 2007.12.18 suspicious Trojan/Worm
eTrust-Vet 31.3.5386 2007.12.18 -
Ewido 4.0 2007.12.18 -
FileAdvisor 1 2007.12.19 -
Fortinet 3.14.0.0 2007.12.19 -
F-Prot 4.4.2.54 2007.12.18 W32/Heuristic-KPP!Eldorado
F-Secure 6.70.13030.0 2007.12.19 -
Ikarus T3.1.1.15 2007.12.19 not-a-virus:AdWare.Win32.Agent.xz
Kaspersky 7.0.0.125 2007.12.19 not-a-virus:AdWare.Win32.Agent.xz
McAfee 5188 2007.12.18 -
Microsoft 1.3109 2007.12.18 Trojan:Win32/AgentBypass.gen!G
NOD32v2 2732 2007.12.19 -
Norman 5.80.02 2007.12.18 W32/Agent.DQCQ
Panda 9.0.0.4 2007.12.18 Trj/Agent.HKA
Prevx1 V2 2007.12.19 Trojan.Gorhax
Rising 20.23.20.00 2007.12.19 -
Sophos 4.24.0 2007.12.18 Mal/Behav-119
Sunbelt 2.2.907.0 2007.12.19 VIPRE.Suspicious
Symantec 10 2007.12.19 -
TheHacker 6.2.9.164 2007.12.18 -
VBA32 3.12.2.5 2007.12.18 -
VirusBuster 4.3.26:9 2007.12.18 -
Webwasher-Gateway 6.6.2 2007.12.19 Trojan.Crypt.ULPM.Gen

Additional information
File size: 28929 bytes
MD5: b0bd9eae6323e800586da747b6d5d96d
SHA1: 7ab98d8b957f88aa440ecc5d2457d53212efa8e3
PEiD: RCryptor v1.5 --&gt; Vaska
packers: UPX
packers: SuperCrypt, PE_Patch.UPX, UPX
Prevx info: http://info.prevx.com/aboutprogramtext.asp...6CC0200B3E2345E
Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics.
---------------------------------


File windisk.dll received on 12.19.2007 05:32:06 (CET)Antivirus Version Last Update Result
AhnLab-V3 2007.12.19.10 2007.12.18 -
AntiVir 7.6.0.45 2007.12.18 HEUR/Malware
Authentium 4.93.8 2007.12.19 -
Avast 4.7.1098.0 2007.12.18 -
AVG 7.5.0.503 2007.12.19 -
BitDefender 7.2 2007.12.19 -
CAT-QuickHeal 9.00 2007.12.18 -
ClamAV 0.91.2 2007.12.19 -
DrWeb 4.44.0.09170 2007.12.18 DLOADER.Trojan
eSafe 7.0.15.0 2007.12.18 -
eTrust-Vet 31.3.5386 2007.12.18 -
Ewido 4.0 2007.12.18 -
FileAdvisor 1 2007.12.19 -
Fortinet 3.14.0.0 2007.12.19 -
F-Prot 4.4.2.54 2007.12.18 W32/Heuristic-KPP!Eldorado
F-Secure 6.70.13030.0 2007.12.19 -
Ikarus T3.1.1.15 2007.12.19 -
Kaspersky 7.0.0.125 2007.12.19 not-a-virus:AdWare.Win32.Agent.xz
McAfee 5188 2007.12.18 -
Microsoft 1.3109 2007.12.18 -
NOD32v2 2732 2007.12.19 -
Norman 5.80.02 2007.12.18 -
Panda 9.0.0.4 2007.12.18 -
Prevx1 V2 2007.12.19 Generic.Malware
Rising 20.23.20.00 2007.12.19 -
Sophos 4.24.0 2007.12.18 Mal/Behav-119
Sunbelt 2.2.907.0 2007.12.19 -
Symantec 10 2007.12.19 -
TheHacker 6.2.9.164 2007.12.18 -
VBA32 3.12.2.5 2007.12.18 -
VirusBuster 4.3.26:9 2007.12.18 -
Webwasher-Gateway 6.6.2 2007.12.19 Heuristic.Malware

Additional information
File size: 15872 bytes
MD5: 8a5f12d9abb47ea6de1c367dcd46e23b
SHA1: eb78c9d2466ed469f64d9fda9883b1e335aaec49
PEiD: -
packers: UPX
packers: UPX
packers: PE_Patch.UPX, UPX
Prevx info: http://info.prevx.com/aboutprogramtext.asp...F05C7007941A005


---------------------------------

File wn852.exe received on 12.19.2007 04:58:49 (CET)Antivirus Version Last Update Result
AhnLab-V3 2007.12.19.10 2007.12.18 -
AntiVir 7.6.0.45 2007.12.18 TR/Crypt.ULPM.Gen
Authentium 4.93.8 2007.12.19 -
Avast 4.7.1098.0 2007.12.18 -
AVG 7.5.0.503 2007.12.19 Downloader.Small.60.W
BitDefender 7.2 2007.12.19 -
CAT-QuickHeal 9.00 2007.12.18 Trojan.VB.kpu
ClamAV 0.91.2 2007.12.19 -
DrWeb 4.44.0.09170 2007.12.18 -
eSafe 7.0.15.0 2007.12.18 suspicious Trojan/Worm
eTrust-Vet 31.3.5386 2007.12.18 -
Ewido 4.0 2007.12.18 -
FileAdvisor 1 2007.12.19 -
Fortinet 3.14.0.0 2007.12.19 -
F-Prot 4.4.2.54 2007.12.18 W32/Heuristic-KPP!Eldorado
F-Secure 6.70.13030.0 2007.12.19 -
Ikarus T3.1.1.15 2007.12.19 not-a-virus:AdWare.Win32.Agent.xz
Kaspersky 7.0.0.125 2007.12.19 not-a-virus:AdWare.Win32.Agent.xz
McAfee 5188 2007.12.18 -
Microsoft 1.3109 2007.12.18 Trojan:Win32/AgentBypass.gen!G
NOD32v2 2732 2007.12.19 -
Norman 5.80.02 2007.12.18 W32/Agent.DQCQ
Panda 9.0.0.4 2007.12.18 Trj/Agent.HKA
Prevx1 V2 2007.12.19 Trojan.Gorhax
Rising 20.23.20.00 2007.12.19 -
Sophos 4.24.0 2007.12.18 Mal/Behav-119
Sunbelt 2.2.907.0 2007.12.19 VIPRE.Suspicious
Symantec 10 2007.12.19 -
TheHacker 6.2.9.164 2007.12.18 -
VBA32 3.12.2.5 2007.12.18 -
VirusBuster 4.3.26:9 2007.12.18 -
Webwasher-Gateway 6.6.2 2007.12.19 Trojan.Crypt.ULPM.Gen

Additional information
File size: 28929 bytes
MD5: b0bd9eae6323e800586da747b6d5d96d
SHA1: 7ab98d8b957f88aa440ecc5d2457d53212efa8e3
PEiD: RCryptor v1.5 --&gt; Vaska
packers: UPX
packers: SuperCrypt, PE_Patch.UPX, UPX
Prevx info: http://info.prevx.com/aboutprogramtext.asp...6CC0200B3E2345E
Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics.

Attached Files






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users