Author Topic: Trojan downloader/dropper/virus(es) (Read 6250 times)

Quinncest · « **on:** June 04, 2011, 11:38:13 PM »

So Windows Security Essentials has been detecting trojan viruses lately, which I have been removing/quarantining as appropriate and then following up with a MBAM scan and removing whatever is shown there. Last night, however, a virus Trojan:DOS/Alureon.A was detected and can't be deleted. I also noticed that a number of programs have been installed without my permission, namely SweetIM for Messenger 3.4, SweetIM Toobal for Internet Explorer 4.1, Whitesmoke (which seems to be a big problem), and Street-Ads Browser Enhancer, none of which I am able to uninstall. I also seem to have a Google redirect virus, but only when I am using Astrill (VPN) which I use as I am in China currently.

I have already run CCleaner, SUPERAntivirus and MBAM, but the link for HJT brings up nothing but random characters for me.

If necessary, I guess I would be willing to have a new hard drive installed (if this would remedy the problem) or reformat the current one, but I have no recovery disks. However, if it is possible to get rid of the problem without doing this, I would prefer to do it that way. However, to my (untrained) eye, it looks pretty severe, hence me looking here for help. Thanks in advance.

Here is the SUPERAntivirus log

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 06/05/2011 at 01:13 PM

Application Version : 4.53.1000

Core Rules Database Version : 7202
Trace Rules Database Version: 5014

Scan type : Complete Scan
Total Scan Time : 00:57:29

Memory items scanned : 378
Memory threats detected : 1
Registry items scanned : 7734
Registry threats detected : 56
File items scanned : 81773
File threats detected : 1133

Trojan.Downloader-SVCHost/Fake
   C:\WINDOWS\WINUPDATERSTD\SVCHOST.EXE
   C:\WINDOWS\WINUPDATERSTD\SVCHOST.EXE
   [Speaker] C:\WINDOWS\WINUPDATERSTD\SVCHOST.EXE

Worm.SYSHost
   [SysRestore] C:\WINDOWS\..\SBRB\SYSHOST.EXE
   C:\WINDOWS\..\SBRB\SYSHOST.EXE

Rogue.Agent/Gen
   HKLM\Software\Classes\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}
   HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}
   HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}
   HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}#AppID
   HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}\InprocServer32
   HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}\InprocServer32#ThreadingModel
   HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}\ProgID
   HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}\Programmable
   HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}\TypeLib
   HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}\VersionIndependentProgID
   HKCR\chkavwqhhst.chkavwqhhst.1.0
   HKCR\chkavwqhhst.chkavwqhhst.1.0\CLSID
   HKCR\chkavwqhhst.chkavwqhhst
   HKCR\chkavwqhhst.chkavwqhhst\CLSID
   HKCR\chkavwqhhst.chkavwqhhst\CurVer
   HKCR\TypeLib\{18B5BB0D-DC38-4611-B16C-2A6A82FECAE5}
   C:\WINDOWS\$XNTUNINSTALL643$\WKTLY.DLL
   HKLM\Software\Classes\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}
   HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}
   HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}
   HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}#AppID
   HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}\InprocServer32
   HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}\InprocServer32#ThreadingModel
   HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}\ProgID
   HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}\Programmable
   HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}\TypeLib
   HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}\VersionIndependentProgID
   HKCR\adfavwqhpr.adfavwqhpr.1.0
   HKCR\adfavwqhpr.adfavwqhpr.1.0\CLSID
   HKCR\adfavwqhpr.adfavwqhpr
   HKCR\adfavwqhpr.adfavwqhpr\CLSID
   HKCR\adfavwqhpr.adfavwqhpr\CurVer
   HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}
   HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}
   HKU\S-1-5-21-3945443218-3704102702-969017525-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}
   HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}

Trojan.Agent/Gen-Nullo[Short]
   HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CD4CBA5A-14F6-88A6-0037-59505B26C86C}
   HKCR\CLSID\{CD4CBA5A-14F6-88A6-0037-59505B26C86C}
   HKCR\CLSID\{CD4CBA5A-14F6-88A6-0037-59505B26C86C}
   HKCR\CLSID\{CD4CBA5A-14F6-88A6-0037-59505B26C86C}\InprocServer32
   HKCR\CLSID\{CD4CBA5A-14F6-88A6-0037-59505B26C86C}\InprocServer32#ThreadingModel
   HKCR\CLSID\{CD4CBA5A-14F6-88A6-0037-59505B26C86C}\ProgID
   HKCR\Mqublrsv
   HKCR\Mqublrsv\CLSID
   C:\WINDOWS\SYSTEM32\LWWHZYYW.DLL
   HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CD4CBA5A-14F6-88A6-0037-59505B26C86C}
   HKU\S-1-5-21-3945443218-3704102702-969017525-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CD4CBA5A-14F6-88A6-0037-59505B26C86C}
   HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CD4CBA5A-14F6-88A6-0037-59505B26C86C}
   HKLM\System\ControlSet001\Services\otwxoqqw
   HKLM\System\ControlSet001\Enum\Root\LEGACY_otwxoqqw
   HKLM\System\ControlSet002\Services\otwxoqqw
   HKLM\System\ControlSet002\Enum\Root\LEGACY_otwxoqqw
   HKLM\System\CurrentControlSet\Services\otwxoqqw
   HKLM\System\CurrentControlSet\Enum\Root\LEGACY_otwxoqqw

Malware.Trace
   HKU\.DEFAULT\Software\5GUTNY6MFK
   HKU\S-1-5-18\Software\5GUTNY6MFK

PUP.Whitesmoke
   C:\Program Files\WHITESMOKE\buy.ico
   C:\Program Files\WHITESMOKE\ComVistaElevator.dll
   C:\Program Files\WHITESMOKE\FloatButtonWhiteApps.txt
   C:\Program Files\WHITESMOKE\FuncServer_WDC_x64.exe
   C:\Program Files\WHITESMOKE\HookDllOE.dll
   C:\Program Files\WHITESMOKE\HookDllOE64.dll
   C:\Program Files\WHITESMOKE\html\english\common\iepngfix\blank.gif
   C:\Program Files\WHITESMOKE\html\english\common\iepngfix\checkerboard.gif
   C:\Program Files\WHITESMOKE\html\english\common\iepngfix\helix.gif
   C:\Program Files\WHITESMOKE\html\english\common\iepngfix\iepngfix.htc
   C:\Program Files\WHITESMOKE\html\english\common\iepngfix\iepngfix.html
   C:\Program Files\WHITESMOKE\html\english\common\iepngfix\opacity.png
   C:\Program Files\WHITESMOKE\html\english\common\iepngfix
   C:\Program Files\WHITESMOKE\html\english\common\js\common.js
   C:\Program Files\WHITESMOKE\html\english\common\js\pngfix.js
   C:\Program Files\WHITESMOKE\html\english\common\js\prototype.js
   C:\Program Files\WHITESMOKE\html\english\common\js\xmlhttp.js
   C:\Program Files\WHITESMOKE\html\english\common\js
   C:\Program Files\WHITESMOKE\html\english\common
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\dictionary.html
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\ajax-loader.gif
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\corner_bottom_left.png
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\corner_bottom_right.png
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\corner_top_left.png
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\corner_top_right.png
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\down_arrow.png
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\input_bg.png
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\input_bg_old.png
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\leftSide.png
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\leftSide2.png
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\left_input.gif
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\loading_dictionary.gif
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\rightSide.png
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\right_input.gif
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background\search_strip_bg3.gif
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Background
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Buttons\down_arrow.png
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Buttons\go_over.gif
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Buttons\go_press.gif
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Buttons\go_up.gif
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Buttons\humanTranslation_press.gif
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Buttons\humanTranslation_roll.gif
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Buttons\humanTranslation_up.gif
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Buttons\moreLang_press.gif
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Buttons\moreLang_roll.gif
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Buttons\moreLang_up.gif
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\Buttons
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img\spacer.gif
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\img
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\index.html
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\js\common.js
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\js\Contextmenu.js
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\js\dictInterface.js
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\js\jquery-1.4.2.min.js
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\js\jquery.combobox.js
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\js\jquery.js
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\js\prototype.js
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\js\transInterface.js
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\js\xmlhttp.js
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\js
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\style\combobox.css
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\style\Contextmenu.css
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\style\dictionary.css
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\style
   C:\Program Files\WHITESMOKE\html\english\dictClientDic\translator.html
   C:\Program Files\WHITESMOKE\html\english\dictClientDic
   C:\Program Files\WHITESMOKE\html\english\floatingButton\blue-Q-rollover.gif
   C:\Program Files\WHITESMOKE\html\english\floatingButton\blue-rollover.gif
   C:\Program Files\WHITESMOKE\html\english\floatingButton\blue-X-rollover.gif
   C:\Program Files\WHITESMOKE\html\english\floatingButton\blue.gif
   C:\Program Files\WHITESMOKE\html\english\floatingButton\index.html
   C:\Program Files\WHITESMOKE\html\english\floatingButton\red&blue.gif
   C:\Program Files\WHITESMOKE\html\english\floatingButton\Thumbs.db
   C:\Program Files\WHITESMOKE\html\english\floatingButton
   C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\img\Background\howto_bg.gif
   C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\img\Background
   C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\img\spacer.gif
   C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\img\Thumbs.db
   C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\img
   C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\index.html
   C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\js\iepngfix\blank.gif
   C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\js\iepngfix\checkerboard.gif
   C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\js\iepngfix\helix.gif
   C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\js\iepngfix\iepngfix.htc
   C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\js\iepngfix\iepngfix.html
   C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\js\iepngfix\opacity.png
   C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\js\iepngfix
   C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\js\index.js
   C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\js
   C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\style\style.css
   C:\Program Files\WHITESMOKE\html\english\floatingButton_howto\style
   C:\Program Files\WHITESMOKE\html\english\floatingButton_howto
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\ajax-loader.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\base_fade_px.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\blue.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\blue_bg_.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\blue_dark_bg.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\blue_dark_bg_.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\blue_top_bg_.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\bottom_grey_strip.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\buttons_tray_px.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\buttons_tray_px.p_goldng
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\caption_bar_re_down.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\caption_bar_re_over.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\caption_bar_re_up.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\caption_bottom_px.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\caption_px.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\caption_strip_right_corner.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\cascade.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\collapse.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\context_bl2.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\context_br2.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\context_dot.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\context_menu_bg.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\context_submenu.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\context_submenu_dis.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\context_sub_menu_bg.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\context_tl2.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\context_tr2.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\Copy of notice_right_top_bg.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\down_arrow.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\dpreloader.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\edit_footer_left.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\edit_footer_px.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\edit_footer_right.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\edit_header_left.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\edit_header_px.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\edit_header_right.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\edit_sidefade.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\feather.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\green.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\inputline_fade_px.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\input_bg.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\leftBottom3.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\leftSide.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\leftSide2.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\leftSide3.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\left_input.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\logo.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\logo.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\logo2.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\main_background.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\main_background_11.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\main_background_old.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\notice_checkbox_checked.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\notice_checkbox_unchecked.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\red.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\red2.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\resize_gripper.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\result_area_top_bg.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\rightBottom.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\rightSide.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\rightSide2.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\rightSide2_11.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\right_input.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\spacer.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\spacer_.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\strike_blue.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\strike_green.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\strike_green2.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\strike_purple.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\strike_red.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\summaryline_apply_down.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\summaryline_apply_roll.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\summaryline_apply_up.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\summaryline_check_down.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\summaryline_check_roll.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\summaryline_check_up.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\summaryline_left_corner.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\summaryline_px.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\summaryline_right_corner.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\ticket.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\topButtonsLeft.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\topButtonsLeft_from_home.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\topButtonsLeft__.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\topButtonsRight.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\topRightBorder.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\top_grey_strip.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background\wslogo.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Background
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\blue.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\bottom_right_corner.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\buttons_tray_px.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\caption_bar_re_down.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\caption_bar_re_over.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\caption_bar_re_up.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\caption_bottom_px.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\caption_px.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\caption_strip_right_corner.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\get-full.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\get-full3.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\green.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\help_down.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\help_roll.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\help_up.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\left_input.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\logo.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\logo.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\logo2.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\main_background.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_dictionary_down.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_dictionary_on.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_dictionary_roll.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_dictionary_up.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_templates_down.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_templates_on.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_templates_roll.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_templates_up.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_toolkit_down.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_toolkit_on.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_toolkit_roll.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_toolkit_up.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_translator_down.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_translator_on.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_translator_roll.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_translator_up.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_tutorials_down.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_tutorials_on.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_tutorials_roll.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_tutorials_up.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_writer_down.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_writer_on.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_writer_roll.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\menuline_writer_up.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\red.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\red2.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\right_input.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\sitting_down.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\sitting_roll.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\sitting_up.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\smallclosebutton.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\store_down.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\store_roll.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\store_up.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\summaryline_apply_down.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\summaryline_apply_roll.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\summaryline_apply_up.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\summaryline_check_down.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\summaryline_check_roll.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\summaryline_check_up.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\summaryline_px.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\x.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\x.jpg
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\x_hover.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\x_hover_old.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons\x_old.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\Buttons
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\blue.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\bottom_right_corner.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\buttons_tray_px.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\caption_bar_close_down.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\caption_bar_close_over.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\caption_bar_close_up.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\caption_bar_max_down.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\caption_bar_max_over.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\caption_bar_max_up.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\caption_bar_re_down.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\caption_bar_re_over.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\caption_bar_re_up.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\caption_bottom_px.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\caption_px.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\caption_px_11.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\green.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\leftCaptionCorner.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\leftCaptionCorner2.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\left_input.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\logo.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\logo3.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\logologo2_11.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\logo_1.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\main_background.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_dictionary_down.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_dictionary_on.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_dictionary_roll.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_dictionary_up.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_templates_down.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_templates_on.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_templates_roll.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_templates_up.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_toolkit_down.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_toolkit_on.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_toolkit_roll.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_toolkit_up.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_translator_down.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_translator_on.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_translator_roll.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_translator_up.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_tutorials_down.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_tutorials_on.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_tutorials_roll.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_tutorials_up.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_writer_down.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_writer_on.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_writer_roll.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\menuline_writer_up.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\red.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\red2.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\rightCaptionCorner.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\rightCaptionCorner.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\rightCaptionCorner2.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\rightCaptionCorner3.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\rightCaptionCorner3_11.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\right_input.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\store_down.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\store_roll.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\store_up.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\summaryline_apply_down.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\summaryline_apply_roll.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\summaryline_apply_up.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\summaryline_check_down.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\summaryline_check_roll.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\summaryline_check_up.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar\summaryline_px.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\captionbar
   C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\addto_disabled.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\addto_hover.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\addto_up.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\definition_disabled.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\definition_hover.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\definition_up.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\enrichment_disabled.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\enrichment_hover.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\enrichment_up.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\explanation_disabled.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\explanation_hover.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\explanation_up.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\grammarexpclosebutton.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\howto_disabled.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\howto_hover.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\howto_up.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\search_disabled.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\search_hover.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\search_up.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\thesaurus_disabled.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\thesaurus_hover.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\grammar\thesaurus_up.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\grammar
   C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\closedy2.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\content-review4.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\dot.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\down-content.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\down.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\grade1.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\grade2.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\grade3.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\grade4.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\grade5.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\li-content.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\opencq8.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\report.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\score1.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\score2.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\score3.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\score4.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\score5.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\shadow.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\shadow2.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\shdow.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\review-section\shdow_good.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\review-section
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\button_no_down.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\button_no_up.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\button_yes_down.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\button_yes_up.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\caption_bar_close_over.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\ico_analyze.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\ico_complete.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\ico_connection.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\ico_expired.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\loading_window.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\loading_window.swf
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\myWelcome.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_bg.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_bg_bottom.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_bg_gold.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_bg_old.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_bg_top.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_captionbar_press.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_captionbar_up.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_getitnow_press.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_getitnow_up.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_ok_press.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_ok_press.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_ok_up.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_ok_up.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\screen_ok_up_11.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\welcomeClose_down.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\welcomeClose_over.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\welcomeClose_up.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\welcomeGo_down.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\welcomeGo_over.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens\welcomeGo_up.png
   C:\Program Files\WHITESMOKE\html\english\gui\img\screens
   C:\Program Files\WHITESMOKE\html\english\gui\img\spacer.gif
   C:\Program Files\WHITESMOKE\html\english\gui\img
   C:\Program Files\WHITESMOKE\html\english\gui\index.html
   C:\Program Files\WHITESMOKE\html\english\gui\js\appInterface.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\builder.pack.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\common.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\Contextmenu.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\controls.pack.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\dictionaryContextMenu.class.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\dragdrop.pack.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\effects.pack.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\enrichmentContextMenu.class.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\enrichmentsContextMenu.class.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\final.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\gmonitor.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\grammarCache.class.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\grammarContextMenu.class.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\iepngfix\blank.gif
   C:\Program Files\WHITESMOKE\html\english\gui\js\iepngfix\checkerboard.gif
   C:\Program Files\WHITESMOKE\html\english\gui\js\iepngfix\helix.gif
   C:\Program Files\WHITESMOKE\html\english\gui\js\iepngfix\iepngfix.htc
   C:\Program Files\WHITESMOKE\html\english\gui\js\iepngfix\iepngfix.html
   C:\Program Files\WHITESMOKE\html\english\gui\js\iepngfix\opacity.png
   C:\Program Files\WHITESMOKE\html\english\gui\js\iepngfix
   C:\Program Files\WHITESMOKE\html\english\gui\js\iframeTest.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\jqModal.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\jquery-1.2.6.pack.NotUSED.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\jquery-1.3.2.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\jquery-1.3.2.min.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\jquery.ba-throttle-debounce.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\jquery.jeegoocontext.min.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\monitor.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\NonPackedVersion\builder.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\NonPackedVersion\controls.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\NonPackedVersion\dragdrop.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\NonPackedVersion\effects.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\NonPackedVersion\prototype.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\NonPackedVersion\slider.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\NonPackedVersion\sound.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\NonPackedVersion
   C:\Program Files\WHITESMOKE\html\english\gui\js\prototype.pack.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\scriptaculous.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\slider.pack.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\sound.pack.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\spellingContextMenu.class.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\summary.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\supersleight.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\switchcontent.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\tooltip.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\unittest.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\ws_content_manager.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\ws_functions.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\ws_links.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\x.gif
   C:\Program Files\WHITESMOKE\html\english\gui\js\xmlhttp.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\ypSlideOutMenus.js
   C:\Program Files\WHITESMOKE\html\english\gui\js\ypSlideOutMenusContext.js
   C:\Program Files\WHITESMOKE\html\english\gui\js
   C:\Program Files\WHITESMOKE\html\english\gui\style\combobox.css
   C:\Program Files\WHITESMOKE\html\english\gui\style\Contextmenu.css
   C:\Program Files\WHITESMOKE\html\english\gui\style\dictionary.css
   C:\Program Files\WHITESMOKE\html\english\gui\style\enrichment.css
   C:\Program Files\WHITESMOKE\html\english\gui\style\enrichments.css
   C:\Program Files\WHITESMOKE\html\english\gui\style\grammar.css
   C:\Program Files\WHITESMOKE\html\english\gui\style\iframeTest.css
   C:\Program Files\WHITESMOKE\html\english\gui\style\indexnew.css
   C:\Program Files\WHITESMOKE\html\english\gui\style\jeegoo.css
   C:\Program Files\WHITESMOKE\html\english\gui\style\jqModal.css
   C:\Program Files\WHITESMOKE\html\english\gui\style\screens.css
   C:\Program Files\WHITESMOKE\html\english\gui\style\spelling.css
   C:\Program Files\WHITESMOKE\html\english\gui\style
   C:\Program Files\WHITESMOKE\html\english\gui
   C:\Program Files\WHITESMOKE\html\english\registration\img\banner.gif
   C:\Program Files\WHITESMOKE\html\english\registration\img\banner.png
   C:\Program Files\WHITESMOKE\html\english\registration\img\captionbar\caption_bar_close_down.gif
   C:\Program Files\WHITESMOKE\html\english\registration\img\captionbar\caption_bar_close_up.gif
   C:\Program Files\WHITESMOKE\html\english\registration\img\captionbar\caption_bar_close_up_over.gif
   C:\Program Files\WHITESMOKE\html\english\registration\img\captionbar
   C:\Program Files\WHITESMOKE\html\english\registration\img\continue_button_click.gif
   C:\Program Files\WHITESMOKE\html\english\registration\img\continue_button_over.gif
   C:\Program Files\WHITESMOKE\html\english\registration\img\continue_button_up.gif
   C:\Program Files\WHITESMOKE\html\english\registration\img\down.gif
   C:\Program Files\WHITESMOKE\html\english\registration\img\down.png
   C:\Program Files\WHITESMOKE\html\english\registration\img\f2.gif
   C:\Program Files\WHITESMOKE\html\english\registration\img
   C:\Program Files\WHITESMOKE\html\english\registration\index.html
   C:\Program Files\WHITESMOKE\html\english\registration\js\regInterface.js
   C:\Program Files\WHITESMOKE\html\english\registration\js
   C:\Program Files\WHITESMOKE\html\english\registration\style\registration.css
   C:\Program Files\WHITESMOKE\html\english\registration\style
   C:\Program Files\WHITESMOKE\html\english\registration
   C:\Program Files\WHITESMOKE\html\english\settings\css\index.css
   C:\Program Files\WHITESMOKE\html\english\settings\css
   C:\Program Files\WHITESMOKE\html\english\settings\img\Background\logo.png
   C:\Program Files\WHITESMOKE\html\english\settings\img\Background\main_bg.png
   C:\Program Files\WHITESMOKE\html\english\settings\img\Background
   C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\cancel_disabled.png
   C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\cancel_down.png
   C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\cancel_over.png
   C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\cancel_up.png
   C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\save_disabled.png
   C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\save_down.png
   C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\save_over.png
   C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\save_up.png
   C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_connection_disabled.png
   C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_connection_off.png
   C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_connection_on.png
   C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_content_disabled.png
   C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_content_off.png
   C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_content_on.png
   C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_general_disabled.png
   C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_general_off.png
   C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_general_on.png
   C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_info_disabled.png
   C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_info_off.png
   C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_info_on.png
   C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_shortcut_disabled.png
   C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_shortcut_off.png
   C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons\tab_shortcut_on.png
   C:\Program Files\WHITESMOKE\html\english\settings\img\Buttons
   C:\Program Files\WHITESMOKE\html\english\settings\img\captionbar\caption_bar_close_down.gif
   C:\Program Files\WHITESMOKE\html\english\settings\img\captionbar\caption_bar_close_over.gif
   C:\Program Files\WHITESMOKE\html\english\settings\img\captionbar\caption_bar_close_up.gif
   C:\Program Files\WHITESMOKE\html\english\settings\img\captionbar
   C:\Program Files\WHITESMOKE\html\english\settings\img
   C:\Program Files\WHITESMOKE\html\english\settings\index.html
   C:\Program Files\WHITESMOKE\html\english\settings\js\iepngfix\blank.gif
   C:\Program Files\WHITESMOKE\html\english\settings\js\iepngfix\checkerboard.gif
   C:\Program Files\WHITESMOKE\html\english\settings\js\iepngfix\helix.gif
   C:\Program Files\WHITESMOKE\html\english\settings\js\iepngfix\iepngfix.htc
   C:\Program Files\WHITESMOKE\html\english\settings\js\iepngfix\iepngfix.html
   C:\Program Files\WHITESMOKE\html\english\settings\js\iepngfix\opacity.png
   C:\Program Files\WHITESMOKE\html\english\settings\js\iepngfix
   C:\Program Files\WHITESMOKE\html\english\settings\js\settingsInterface.js
   C:\Program Files\WHITESMOKE\html\english\settings\js
   C:\Program Files\WHITESMOKE\html\english\settings
   C:\Program Files\WHITESMOKE\html\english\templates\dtree.css
   C:\Program Files\WHITESMOKE\html\english\templates\dtree.js
   C:\Program Files\WHITESMOKE\html\english\templates\General\Apologies\ApologyInnappropriateBehavior.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Apologies\ApologyUnjustBehavior.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Apologies
   C:\Program Files\WHITESMOKE\html\english\templates\General\Community Work\ResignationFromVoluntaryPosition.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Community Work
   C:\Program Files\WHITESMOKE\html\english\templates\General\Condolences\LetterOfCondolence.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Condolences
   C:\Program Files\WHITESMOKE\html\english\templates\General\Cover Letters\CoverLetter.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Cover Letters\GrantCoverSheet.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Cover Letters
   C:\Program Files\WHITESMOKE\html\english\templates\General\Family\FamilyNewsUpdate.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Family
   C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\AgreementToCompromiseDebt.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\BankError.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\DebtValidation.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\InvestigationOfBillingInquiry.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\LetterOfCreditGeneral.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\LetterOfCreditIrrevocable.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\LetterOfCreditRevolving.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\LetterOfDispute.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\RemovalOfInadequateInformation.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\ReplyToApplicationForCredit.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\RequestForIncreaseOfCreditLimit.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\ReturningUnsignedCheck.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Finance\UnauthorizedCreditInquiry.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Finance
   C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\AChristmasWish.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\ArrivalOfChristmas.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\BlessingsAtChristmas.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\ChristmasGreetings.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\ChristmasGreetingsMessage.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\ChristmasGreetingsToASpouse.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\ChristmasGreetingsToWorkers.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\ChristmasWishes.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\HappyChristmasGreeting.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\InTheStillOfTheNightChristmasGreeting.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\JoyousOccasion.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\LovePeaceAndJoy.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\MerryChristmasAndHappyNewYear.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas\MerryChristmasToFamily.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Christmas
   C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Graduation\CongratulationsOnYourGraduation.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Graduation\CongratulationsToTheGraduate.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Graduation\YouHaveGraduated.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings\Graduation
   C:\Program Files\WHITESMOKE\html\english\templates\General\Greetings
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Manual\EmployeePerformanceReviewAndPlanningSessions.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Manual\EmploymentApplications.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Manual\HealthRelatedIssues.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Manual\NewEmployeeOrientation.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Manual\TerminationOfEmployment.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Manual\TuitionReimbursementPolicy.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Manual
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Reference Letters\EmploymentReferenceLetter.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Reference Letters\JobReferenceLetter.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Reference Letters\LetterOfReference.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Reference Letters\ReferenceLetterByAcquaintance.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Reference Letters\RequestForEmployeeReferenceLetter.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Reference Letters\VerificationOfEmploymentLetter.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employee Reference Letters
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employment Requests\Letter Requesting Pay Raise.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employment Requests\Refusal of Resquest For Raise.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employment Requests\Request for Leave of Absence.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employment Requests\Request for Letter of Reference.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employment Requests\Request for Meeting Regarding Pay Raise.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employment Requests\Request for Paid or Unpaid Leave.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employment Requests\Request For Salary Increase.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employment Requests\Request to Schedule an Interview.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Employment Requests
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Dismissal and Rejection\Acknowledgment of Job Application.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Dismissal and Rejection\Confirmation of Job Dismissal.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Dismissal and Rejection\Final Warning Before Dismissal.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Dismissal and Rejection\Job Rejection Letter.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Dismissal and Rejection\Job Rejection Letter2.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Dismissal and Rejection\Rejection of Job Offer.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Dismissal and Rejection
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Employment Letters\Employment Letter.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Employment Letters\Introduction of New Employee.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Employment Letters\Letter for Assistant Professor.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Employment Letters\LetterForTenureTrackAssociateProfessor.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Employment Letters\Offer of Employment.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Employment Letters\Request for Employment Test.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Employment Letters
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Job Acceptance\Accept or Decline Job Offer.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Job Acceptance\Job Acceptance Letter 2.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Job Acceptance\Job Acceptance Letter.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Job Acceptance\Job Offer Acceptance.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Job Acceptance
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Thank You Letters\Thank You Letter After Interview.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Thank You Letters\Thank You to Applicant for Testing.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees\Thank You Letters
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Hiring Employees
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Resignation Letters\Acceptance of Employee's Resignation.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Resignation Letters\Employee Termination Notice.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Resignation Letters\Job Resignation Letter.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination\Resignation Letters
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Hiring and Termination
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Personnel Office\Notice of Decision to Reprimand.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Personnel Office
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Job Search Cover Letters\Cover Letter Auditor Development Program.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Job Search Cover Letters\Job Application Letter.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Job Search Cover Letters\Job Search Cover Letter - Disabled Citizens.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Job Search Cover Letters\Job Search Cover Letter - Software Employment.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Job Search Cover Letters\Law Internship Cover Letter.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Job Search Cover Letters\Resume Cover Letter.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Job Search Cover Letters\Resume Cover Letter2.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Job Search Cover Letters
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Letters of Recommendation\Letter of Recommendation.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Letters of Recommendation
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Accounting Resume.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Administrative Resume.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Banking Resume.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Customer Service Resume.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Database and Application Developer Resume.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\End User Trainer and Instructional Designer Resume.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Engineering Resume.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Freelance Marcom Resume.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\General CV Format.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Graphic Designer Resume.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Healthcare Resume.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Internship Resume.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Java Developer Resume.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Management Resume 2.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Management Resume.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Marketing Administrator Resume.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Marketing Director Resume.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human

Quinncest · « **Reply #1 on:** June 04, 2011, 11:58:51 PM »

It seems my post was too long, here's the rest of it:

   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Marketing Manager Resume.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Medical Essay Residency Experience.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Medical Resume - Physician.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Medical Resume Partnership in General Practice.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\PowerPoint Designer Resume.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Product Delivery Engineer Resume.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Sales Representative Resume.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Software QA Engineer Resume.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Technical Publication Manager Resume.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Technical Writer.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Web Developer Resume.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes\Web Maintainer Resume.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters\Resumes
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources\Resumes and Cover Letters
   C:\Program Files\WHITESMOKE\html\english\templates\General\Human Resources
   C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Advertising\Advertising Commitment Form.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Advertising\Art Advertising Flyer.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Advertising\Request for Advertising Rate.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Advertising\Subscriber Letter News Service.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Advertising
   C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Legal\Assignment of Literary Property.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Legal
   C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Promotions\Comments to Author Regarding Book.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Promotions\Introduction of Novel.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Promotions\Letter of Interest to Magazine.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Promotions\Letter of Recommendation.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Promotions\Magazine Review.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Promotions\Promotional Letter Antique Shop.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Promotions
   C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Resumes\Actor Resume.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Literary\Resumes
   C:\Program Files\WHITESMOKE\html\english\templates\General\Literary
   C:\Program Files\WHITESMOKE\html\english\templates\General\Personal Matters\Career Change.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Personal Matters\Letter to a Friend Regarding Change of Job.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Personal Matters\Sale of Automobile or Other Motor Vehicle.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Personal Matters\Upset Regarding Loss of Job.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Personal Matters
   C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Admissions Essays\Admissions Essay for Entrance to Theater Institute.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Admissions Essays\Essay - Describe Events.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Admissions Essays\Graduate School Literary Essay.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Admissions Essays
   C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Careers\Career Letter for Accounting Position.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Careers\Career Letter in Journalism.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Careers
   C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Personal Correspondence\Compliment Student on Graduation.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Personal Correspondence\Congratulations to High School Graduate.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Personal Correspondence\Personal Letter of Recommendation.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Personal Correspondence\Request for Financial Assistance from Parents.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Personal Correspondence
   C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Resumes\Resume for After-School Job.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Resumes\Student Resume Automotive Service Industry.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Resumes\Student Resume Forestry.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Resumes\Student Resume Wildlife.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Resumes\Student Resume.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Students\Resumes
   C:\Program Files\WHITESMOKE\html\english\templates\General\Students\University Correspondence\Appreciation of Scholarship.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Students\University Correspondence\Request for Reference.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Students\University Correspondence\Request for University Application Material.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Students\University Correspondence
   C:\Program Files\WHITESMOKE\html\english\templates\General\Students
   C:\Program Files\WHITESMOKE\html\english\templates\General\Thank You\Letter Thanking Coworker for Support.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Thank You\Message of Thanks.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Thank You\Thank You Staff for Emotional Support.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Thank You
   C:\Program Files\WHITESMOKE\html\english\templates\General\Well Wishes\Letter of Congratulations.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Well Wishes\Welcome New Tenants.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Well Wishes\Wishes for Speedy Recovery.html
   C:\Program Files\WHITESMOKE\html\english\templates\General\Well Wishes
   C:\Program Files\WHITESMOKE\html\english\templates\General
   C:\Program Files\WHITESMOKE\html\english\templates\images\jspDrag.gif
   C:\Program Files\WHITESMOKE\html\english\templates\images\jspVerticalBar.gif
   C:\Program Files\WHITESMOKE\html\english\templates\images
   C:\Program Files\WHITESMOKE\html\english\templates\img\apply_over.png
   C:\Program Files\WHITESMOKE\html\english\templates\img\apply_press.png
   C:\Program Files\WHITESMOKE\html\english\templates\img\apply_up.png
   C:\Program Files\WHITESMOKE\html\english\templates\img\atart_arrow.jpg
   C:\Program Files\WHITESMOKE\html\english\templates\img\base.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\borders.png
   C:\Program Files\WHITESMOKE\html\english\templates\img\borders2.png
   C:\Program Files\WHITESMOKE\html\english\templates\img\borders3.png
   C:\Program Files\WHITESMOKE\html\english\templates\img\borders_good.png
   C:\Program Files\WHITESMOKE\html\english\templates\img\bullet.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\cd.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\close.png
   C:\Program Files\WHITESMOKE\html\english\templates\img\close2.png
   C:\Program Files\WHITESMOKE\html\english\templates\img\dirClose.png
   C:\Program Files\WHITESMOKE\html\english\templates\img\dirOpen.png
   C:\Program Files\WHITESMOKE\html\english\templates\img\empty - Copy.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\empty.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\empty2.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\folder.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\folderopen.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\globe.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\img\base.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\img\cd.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\img\empty.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\img\folder.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\img\folderopen.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\img\globe.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\img\imgfolder.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\img\join.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\img\joinbottom.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\img\line.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\img\minus.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\img\minusbottom.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\img\musicfolder.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\img\nolines_minus.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\img\nolines_plus.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\img\page.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\img\plus.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\img\plusbottom.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\img\question.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\img\trash.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\img
   C:\Program Files\WHITESMOKE\html\english\templates\img\imgfolder.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\join.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\joinbottom.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\jspDrag.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\jspVerticalBar.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\line.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\minus.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\minusbottom.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\musicfolder.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\myEmpty.png
   C:\Program Files\WHITESMOKE\html\english\templates\img\neg_bullet.png
   C:\Program Files\WHITESMOKE\html\english\templates\img\nolines_minus.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\nolines_plus.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\open.png
   C:\Program Files\WHITESMOKE\html\english\templates\img\open2 - Copy.png
   C:\Program Files\WHITESMOKE\html\english\templates\img\open2.png
   C:\Program Files\WHITESMOKE\html\english\templates\img\p7t_minus.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\p7t_plus.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\page.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\plus.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\plusbottom.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\plus_bullet.png
   C:\Program Files\WHITESMOKE\html\english\templates\img\question.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img\top_close.png
   C:\Program Files\WHITESMOKE\html\english\templates\img\top_open.png
   C:\Program Files\WHITESMOKE\html\english\templates\img\trash.gif
   C:\Program Files\WHITESMOKE\html\english\templates\img
   C:\Program Files\WHITESMOKE\html\english\templates\index.html
   C:\Program Files\WHITESMOKE\html\english\templates\js\jquery-1.4.2.min.js
   C:\Program Files\WHITESMOKE\html\english\templates\js\jquery.jscrollpane.min.js
   C:\Program Files\WHITESMOKE\html\english\templates\js\jquery.mousewheel.js
   C:\Program Files\WHITESMOKE\html\english\templates\js\switchcontent.js
   C:\Program Files\WHITESMOKE\html\english\templates\js\templatesInterface.js
   C:\Program Files\WHITESMOKE\html\english\templates\js
   C:\Program Files\WHITESMOKE\html\english\templates\menu.htm
   C:\Program Files\WHITESMOKE\html\english\templates\objects\ebook_js.js
   C:\Program Files\WHITESMOKE\html\english\templates\objects\flashobject.js
   C:\Program Files\WHITESMOKE\html\english\templates\objects\mcl.css
   C:\Program Files\WHITESMOKE\html\english\templates\objects\navigation.js
   C:\Program Files\WHITESMOKE\html\english\templates\objects\p7tm\p7tmbasic.css
   C:\Program Files\WHITESMOKE\html\english\templates\objects\p7tm\p7tmscripts.js
   C:\Program Files\WHITESMOKE\html\english\templates\objects\p7tm\p7t_minus.gif
   C:\Program Files\WHITESMOKE\html\english\templates\objects\p7tm\p7t_plus.gif
   C:\Program Files\WHITESMOKE\html\english\templates\objects\p7tm
   C:\Program Files\WHITESMOKE\html\english\templates\objects\parseURL.js
   C:\Program Files\WHITESMOKE\html\english\templates\objects\utils.js
   C:\Program Files\WHITESMOKE\html\english\templates\objects\wm_cookies.js
   C:\Program Files\WHITESMOKE\html\english\templates\objects
   C:\Program Files\WHITESMOKE\html\english\templates\start.html
   C:\Program Files\WHITESMOKE\html\english\templates\style\jquery.jscrollpane.css
   C:\Program Files\WHITESMOKE\html\english\templates\style\style.css
   C:\Program Files\WHITESMOKE\html\english\templates\style\templates.css
   C:\Program Files\WHITESMOKE\html\english\templates\style
   C:\Program Files\WHITESMOKE\html\english\templates
   C:\Program Files\WHITESMOKE\html\english\userGuide\css\jquery.jscrollpane.css
   C:\Program Files\WHITESMOKE\html\english\userGuide\css\style - Copy.css
   C:\Program Files\WHITESMOKE\html\english\userGuide\css\style.css
   C:\Program Files\WHITESMOKE\html\english\userGuide\css
   C:\Program Files\WHITESMOKE\html\english\userGuide\faq.html
   C:\Program Files\WHITESMOKE\html\english\userGuide\images\arr.png
   C:\Program Files\WHITESMOKE\html\english\userGuide\images\arr2.gif
   C:\Program Files\WHITESMOKE\html\english\userGuide\images\bg - Copy.png
   C:\Program Files\WHITESMOKE\html\english\userGuide\images\bg-good.png
   C:\Program Files\WHITESMOKE\html\english\userGuide\images\bg.png
   C:\Program Files\WHITESMOKE\html\english\userGuide\images\boxBlackFix.png
   C:\Program Files\WHITESMOKE\html\english\userGuide\images\buttons.png
   C:\Program Files\WHITESMOKE\html\english\userGuide\images\ConfiguringWhiteSmoke.png
   C:\Program Files\WHITESMOKE\html\english\userGuide\images\correctionssuggestions.png
   C:\Program Files\WHITESMOKE\html\english\userGuide\images\dictionaryTab.png
   C:\Program Files\WHITESMOKE\html\english\userGuide\images\faq.png
   C:\Program Files\WHITESMOKE\html\english\userGuide\images\i.gif
   C:\Program Files\WHITESMOKE\html\english\userGuide\images\I.png
   C:\Program Files\WHITESMOKE\html\english\userGuide\images\jspDrag.gif
   C:\Program Files\WHITESMOKE\html\english\userGuide\images\jspVerticalBar.gif
   C:\Program Files\WHITESMOKE\html\english\userGuide\images\nav.jpg
   C:\Program Files\WHITESMOKE\html\english\userGuide\images\otk.png
   C:\Program Files\WHITESMOKE\html\english\userGuide\images\t.gif
   C:\Program Files\WHITESMOKE\html\english\userGuide\images\TheRight-clickMenu.png
   C:\Program Files\WHITESMOKE\html\english\userGuide\images\TheTemplatesTab.png
   C:\Program Files\WHITESMOKE\html\english\userGuide\images\translatorTab.png
   C:\Program Files\WHITESMOKE\html\english\userGuide\images\WhiteSmokeEmailCheck.png
   C:\Program Files\WHITESMOKE\html\english\userGuide\images\WhiteSmokeOverview.png
   C:\Program Files\WHITESMOKE\html\english\userGuide\images\WriterTab.png
   C:\Program Files\WHITESMOKE\html\english\userGuide\images
   C:\Program Files\WHITESMOKE\html\english\userGuide\js\jquery-1.4.2.min.js
   C:\Program Files\WHITESMOKE\html\english\userGuide\js\jquery.jscrollpane.min.js
   C:\Program Files\WHITESMOKE\html\english\userGuide\js\jquery.min.js
   C:\Program Files\WHITESMOKE\html\english\userGuide\js\jquery.mousewheel.js
   C:\Program Files\WHITESMOKE\html\english\userGuide\js\userGuide.js
   C:\Program Files\WHITESMOKE\html\english\userGuide\js
   C:\Program Files\WHITESMOKE\html\english\userGuide\troubleshooting.html
   C:\Program Files\WHITESMOKE\html\english\userGuide\userGuide.html
   C:\Program Files\WHITESMOKE\html\english\userGuide
   C:\Program Files\WHITESMOKE\html\english
   C:\Program Files\WHITESMOKE\html
   C:\Program Files\WHITESMOKE\Microsoft.VC80.CRT.manifest
   C:\Program Files\WHITESMOKE\msvcp80.dll
   C:\Program Files\WHITESMOKE\msvcr80.dll
   C:\Program Files\WHITESMOKE\NotifierWhiteApps.txt
   C:\Program Files\WHITESMOKE\osmax.ocx
   C:\Program Files\WHITESMOKE\osmax64.ocx
   C:\Program Files\WHITESMOKE\secman.dll
   C:\Program Files\WHITESMOKE\secman64.dll
   C:\Program Files\WHITESMOKE\settings.ini
   C:\Program Files\WHITESMOKE\TCCons.dll
   C:\Program Files\WHITESMOKE\TCCons_x64.dll
   C:\Program Files\WHITESMOKE\Uninst.exe
   C:\Program Files\WHITESMOKE\WCapture.dll
   C:\Program Files\WHITESMOKE\WCaptureX.dll
   C:\Program Files\WHITESMOKE\WCaptureX_x64.dll
   C:\Program Files\WHITESMOKE\WCapture_x64.dll
   C:\Program Files\WHITESMOKE\WCustom.dll
   C:\Program Files\WHITESMOKE\WCustom_x64.dll
   C:\Program Files\WHITESMOKE\WhiteSmokeRegistration.exe
   C:\Program Files\WHITESMOKE\WHook.dll
   C:\Program Files\WHITESMOKE\WHook_x64.dll
   C:\Program Files\WHITESMOKE\Writer.ico
   C:\Program Files\WHITESMOKE\WSDictHookDll.dll
   C:\Program Files\WHITESMOKE\WSEngine.dll
   C:\Program Files\WHITESMOKE\WSEnrichment.exe
   C:\Program Files\WHITESMOKE\WSLogger.exe
   C:\Program Files\WHITESMOKE\WSMouseHook.dll
   C:\Program Files\WHITESMOKE\WSTray64.exe
   C:\Program Files\WHITESMOKE

Trojan.Dropper/SVCHost-Fake
   C:\SBRB\SVCHOST.EXE

Adware.Tracking Cookie
   .eyewonder.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .eyewonder.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .revsci.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   ad.yieldmanager.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   in.getclicky.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .kontera.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .atdmt.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .imrworldwide.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .imrworldwide.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .mediaplex.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .invitemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .serving-sys.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .serving-sys.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .bs.serving-sys.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .content.yieldmanager.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .riverisland.122.2o7.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .mediav.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .adbrite.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .apmebf.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .fastclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .adxpose.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .collective-media.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .collective-media.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .zedo.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   user.lucidmedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .ads.pointroll.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .pointroll.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .mmstat.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .msnportal.112.2o7.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .advertising.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .kantarmedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .kantarmedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .www.burstnet.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .burstnet.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .burstnet.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .advertising.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .yieldmanager.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .doubleclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .insightexpressai.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .insightexpressai.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .insightexpressai.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .fastclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .invitemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   fidelity.rotator.hadj7.adjuggler.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .invitemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .googleads.g.doubleclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .adbrite.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .ads.pointroll.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .mediafire.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .interclick.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .interclick.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .mediafire.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .interclick.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .a1.interclick.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .collective-media.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .smartadserver.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .smartadserver.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .smartadserver.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .smartadserver.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   ext-us.bestofmedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .xiti.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .revsci.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .at.atwola.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .tacoda.at.atwola.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .tacoda.at.atwola.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .tacoda.at.atwola.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .at.atwola.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .tacoda.at.atwola.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .tacoda.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .specificmedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .legolas-media.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .legolas-media.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .legolas-media.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .ice.112.2o7.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .ru4.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .ru4.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .adbrite.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .invitemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .mediafire.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .ru4.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .clicksor.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .clicksor.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .clicksor.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   dc.tremormedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .myroitracking.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .clicksor.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .clicksor.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .lucidmedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .mediaplex.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .invitemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .invitemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .invitemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .invitemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .fuckyeahchesthair.tumblr.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   trekmedia.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .*adult URL* [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .*adult URL* [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .*adult URL* [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .*adult URL* [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .*adult URL* [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .*adult URL* [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .*adult URL* [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .*adult URL* [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .fuckyeahchesthair.tumblr.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .atdmt.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .atdmt.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .2o7.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .media6degrees.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .eyewonder.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .eyewonder.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .a1.interclick.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .a1.interclick.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .a1.interclick.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .a1.interclick.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .a1.interclick.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .pointroll.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .ads.pointroll.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .ads.pointroll.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .ads.pointroll.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .ads.pointroll.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .ads.pointroll.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .ads.pointroll.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .dmtracker.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .cracked.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .cracked.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   www.cracked.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   www.burstbeacon.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .burstbeacon.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   www.burstnet.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   www.cracked.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .cracked.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .cracked.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .advertising.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .cracked.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .collective-media.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .revsci.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .revsci.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .revsci.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .revsci.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .2o7.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .tribalfusion.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .tribalfusion.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .tribalfusion.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .tribalfusion.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .tribalfusion.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .mediabrandsww.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .ero-advertising.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .liveperson.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   server.iad.liveperson.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .adtech.de [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .tradedoubler.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .tradedoubler.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .tradedoubler.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .overture.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .adbrite.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .adbrite.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   delivery.trafficjunky.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   fidelity.rotator.hadj7.adjuggler.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   www.sublimemedia.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .tribalfusion.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .zedo.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .zedo.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   www.jscount.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   www.jscount.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   *Blocked Russian URL* [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   *Blocked Russian URL* [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .statcounter.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .adbrite.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   eas.apm.emediate.eu [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   eas.apm.emediate.eu [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   publishers.w00tmedia.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .revsci.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .pro-market.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .nike.112.2o7.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .invitemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .media6degrees.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .content.yieldmanager.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .atdmt.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .serving-sys.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .serving-sys.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .questionmarket.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .questionmarket.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   fr.sitestat.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   fr.sitestat.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   ad.yieldmanager.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   ad.yieldmanager.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   ad.yieldmanager.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   ad.yieldmanager.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .fastclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .fastclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .fastclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   bmuk.burstnet.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   bmuk.burstnet.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .adviva.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .specificclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .specificclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .specificclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .specificclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .specificclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .specificclick.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   stat.onestat.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   stat.onestat.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .zedo.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .zedo.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .zedo.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .zedo.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .advertising.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .advertising.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .advertising.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .advertising.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .mediafire.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .mediafire.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .mediafire.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   www.sublimemedia.net [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .casalemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .casalemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .casalemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .media6degrees.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .media6degrees.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .media6degrees.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .media6degrees.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .casalemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .casalemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .casalemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .casalemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .casalemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .casalemedia.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   ad.yieldmanager.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   ad.yieldmanager.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   ad.yieldmanager.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   ad.yieldmanager.com [ C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   C:\Users\1\AppData\Roaming\Microsoft\Windows\Cookies\Low\1@atdmt[2].txt
   C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies\system@atdmt[1].txt

And the MBAM log

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 6773

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

6/5/2011 1:33:43 PM
mbam-log-2011-06-05 (13-33-43).txt

Scan type: Quick scan
Objects scanned: 149488
Time elapsed: 2 minute(s), 42 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 11
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 3

Memory Processes Infected:
c:\Windows\winupdaterstd\svchost.exe (Backdoor.Agent) -> 3220 -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Context\Context-Ads (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF} (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\chkavwqhhst.chkavwqhhst.1.0 (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\chkavwqhhst.chkavwqhhst (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4} (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\adfavwqhpr.adfavwqhpr.1.0 (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\adfavwqhpr.adfavwqhpr (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4} (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4} (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4} (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$XNTUninstall643$ (Adware.AdRotator) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Speaker (Backdoor.Agent) -> Value: Speaker -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bipro (Trojan.Agent.Gen) -> Value: bipro -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

SuperDave · « **Reply #2 on:** June 05, 2011, 04:52:09 PM »

Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
******************************************************
Is this a business computer?
I am required to give you this information.
One or more of the identified infections is a backdoor trojan.

This allows hackers to remotely control your computer, steal critical system information and Download and Execute files

Read this article: Danger: Remote Access Trojans.

If your computer was used for online banking, has credit card information or other sensitive data on it, all passwords should be changed immediately to include those used for banking, email, eBay and forums. You should consider them to be compromised. They should be changed by using a different computer and not the infected one! If not, an attacker may get the new passwords and transaction information. Banking and credit card institutions should be notified of the possible security breach.

I would counsel you to disconnect this PC from the Internet immediately.

Though the Trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

When Should I Format, How Should I Reinstall?

We can attempt to clean this machine but i can't guarantee that it will be 100% secure afterwards.

Should you have any questions, please feel free to ask.

Please let us know what you have decided to do in your next post

Quinncest · « **Reply #3 on:** June 05, 2011, 06:34:49 PM »

It isn't a business computer. I would like to try and repair for now, I think. Since I am currently abroad and can't really reformat myself. I will definitely consider reformatting when I return home, but until then I need to use my computer. I wouldn't need to use it for banking or anything serious, just for university work mainly. For future reference, installing a new hard drive would fix the problem, right?

SuperDave · « **Reply #4 on:** June 06, 2011, 01:42:43 PM »

Quote

For future reference, installing a new hard drive would fix the problem, right?

Yes but you will need to install your OS and, from what I understand, the disk(s) are at home.

Download DDS from HERE or HERE and save it to your desktop.

Vista users right click on dds and select Run as administrator (you will receive a UAC prompt, please allow it)

* XP users Double click on dds to run it.
* If your antivirus or firewall try to block DDS then please allow it to run.
* When finished DDS will open two (2) logs.

1) DDS.txt
2) Attach.txt

* Save both logs to your desktop.
* Please copy and paste the entire contents of both logs in your next reply.

Note: DDS will instruct you to post the Attach.txt log as an attachment.
Please just post it as you would any other log by copying and pasting it into the reply.
***************************************************
Download Security Check by screen317 from one of the following links and save it to your desktop.

Link 1
Link 2

* Unzip SecurityCheck.zip and a folder named Security Check should appear.
* Open the Security Check folder and double-click Security Check.bat
* Follow the on-screen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt
* Post the contents of that document in your next reply.

Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.

Computer Hope Forum

News:

Author Topic: Trojan downloader/dropper/virus(es) (Read 6250 times)

Quinncest

Trojan downloader/dropper/virus(es)

Quinncest

Re: Trojan downloader/dropper/virus(es)

SuperDave

Re: Trojan downloader/dropper/virus(es)

Quinncest

Re: Trojan downloader/dropper/virus(es)

SuperDave

Re: Trojan downloader/dropper/virus(es)