Alway new files in windows/system32

Computing.Net > Forums > Security and Virus > Alway new files in windows/system32

Alway new files in windows/system32

Original Message

Name: prl
Date: December 24, 2007 at 08:32:41 Pacific
Subject: Alway new files in windows/system32
OS: Windows XP Home edition 2
CPU/Ram: Pentium 4 1.6 GHz / 348 M
Model/Manufacturer: Intel

Comment:

Some days ago I found a Virus Win32 SecBar-B (adware) on my PC. Avast removed it but since than I always find new files in windows/system32. Scanning with highjackthis for example now I have found qtbbpvut.dll. I cannot delete it in normal operation and I have to restart and enter in safe operation to remove it. Sometimes the pointer of the mouse moves frreely without my control. Any idea to solve this problem? Thanks.

prl

Report Offensive Message For Removal

Response Number 1

Name: jabuck
Date: December 24, 2007 at 09:07:04 Pacific
Subject: Alway new files in windows/system32

Reply: (edit)

We will need to run a few scans but need to start with a Hijack This log as it looks like Trojan Vundo.
Please download and install the latest version of HijackThis v2.0.2:

Download the "HijackThis" Installer from this link:
Hijack This

1. Save " HJTInstall.exe" to your desktop.
2. Double click on HJTInstall.exe to run the program.
3. By default it will install to C:\Program Files\Trend Micro\HijackThis.
4. Accept the license agreement by clicking the "I Accept" button.
5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log.
6. Click "Save log" to save the log file and then the log will open in Notepad.
7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
8. Paste the log in your next reply.
9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.

Report Offensive Follow Up For Removal

Response Number 2

Name: prl
Date: December 24, 2007 at 10:08:34 Pacific
Subject: Alway new files in windows/system32

Reply: (edit)

Hallo! This is the log file from HighjackThis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19.05.23, on 24/12/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\D-Link\DSL-200\dslstat.exe
C:\Program Files\D-Link\DSL-200\dslagent.exe
C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmi\MSN Messenger\MsnMsgr.Exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\wuauclt.exe
D:\DOCUME~1\0-PIGI\PROGRA~1\POSTAT~1\THUNDE~1\THUNDE~1.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programmi\Microsoft Office\Office10\WINWORD.EXE
C:\Programmi\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\tutto\Desktop\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\D-Link\DSL-200\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\D-Link\DSL-200\dslagent.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [149973e7] rundll32.exe "C:\WINDOWS\System32\qtbbpvut.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{5F363C6D-B030-4DED-A289-C6B4046F6F97}: NameServer = 193.12.150.2 212.247.152.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{5F363C6D-B030-4DED-A289-C6B4046F6F97}: NameServer = 193.12.150.2 212.247.152.2
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe
--
End of file - 3528 bytes

prl

Report Offensive Follow Up For Removal

Response Number 3

Name: jabuck
Date: December 24, 2007 at 11:07:28 Pacific
Subject: Alway new files in windows/system32

Reply: (edit)

Please download ComboFix to the desktop from this link: ComboFix

Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running, it may cause your system to hang.)
Please post the log it produces.

Report Offensive Follow Up For Removal

Response Number 4

Name: prl
Date: December 24, 2007 at 11:36:17 Pacific
Subject: Alway new files in windows/system32

Reply: (edit)

Hallo jabuck, thanks for your very quick replies. This is the log file from combofix: seems to have deleted many files! What do you think about it?
ComboFix 07-12-25.2 - tutto 2007-12-24 20.17.33.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.0.1252.1.1040.18.122 [GMT 1:00]
Eseguito da: C:\Documents and Settings\tutto\Desktop\ComboFix.exe
* Creato nuovo punto di ripristino
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\ababrafl.exe
C:\WINDOWS\system32\aeafhiwi.exe
C:\WINDOWS\system32\arjpvcww.dll
C:\WINDOWS\system32\bqrmodne.ini
C:\WINDOWS\system32\cnnxkmex.dll
C:\WINDOWS\system32\edykvxut.exe
C:\WINDOWS\system32\endomrqb.dll
C:\WINDOWS\system32\fccbbyx.dll
C:\WINDOWS\system32\gvxtyouw.dll
C:\WINDOWS\system32\imgkymwp.exe
C:\WINDOWS\system32\jixosybl.ini
C:\WINDOWS\system32\jkklk.dll
C:\WINDOWS\system32\jsxgbyyk.dll
C:\WINDOWS\system32\kctrqkdj.exe
C:\WINDOWS\system32\klkkj.ini
C:\WINDOWS\system32\klkkj.ini2
C:\WINDOWS\system32\kyybgxsj.ini
C:\WINDOWS\system32\lbysoxij.dll
C:\WINDOWS\system32\leiooyxa.dll
C:\WINDOWS\system32\lhorsqgg.dll
C:\WINDOWS\system32\ljpdqmqm.ini
C:\WINDOWS\system32\lsmlyewn.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mfbklevh.ini
C:\WINDOWS\system32\mhjguejl.ini
C:\WINDOWS\system32\nornravl.exe
C:\WINDOWS\system32\nweylmsl.ini
C:\WINDOWS\system32\nxdjrqwv.exe
C:\WINDOWS\system32\oklqgvfv.exe
C:\WINDOWS\system32\ouutwcvj.dll
C:\WINDOWS\system32\pjiqdfwm.exe
C:\WINDOWS\system32\pnebqncc.dll
C:\WINDOWS\system32\qtbbpvut.dll
C:\WINDOWS\system32\qyshejyb.ini
C:\WINDOWS\system32\takfofky.dll
C:\WINDOWS\system32\tkkeqskx.dll
C:\WINDOWS\system32\tuvpbbtq.ini
C:\WINDOWS\system32\twowwilr.dll
C:\WINDOWS\system32\utqdxjyl.exe
C:\WINDOWS\system32\utvsxvyv.exe
C:\WINDOWS\system32\vdugvbtr.dll
C:\WINDOWS\system32\vqmqlgby.exe
C:\WINDOWS\system32\wcapdnpv.dll
C:\WINDOWS\system32\wqawjprn.ini
C:\WINDOWS\system32\wqgsxrpr.dll
C:\WINDOWS\system32\xemkxnnc.ini
C:\WINDOWS\system32\yrshbfms.ini
C:\WINDOWS\system32\yrywbsxq.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_DOMAINSERVICE
-------\DomainService

((((((((((((((((((((((((( Files Creati Da 2007-11-25 al 2007-12-25 )))))))))))))))))))))))))))))))))))
.
2007-12-25 20:25 . 2007-12-25 20:25 268 --ah----- C:\sqmdata02.sqm
2007-12-25 20:25 . 2007-12-25 20:25 244 --ah----- C:\sqmnoopt02.sqm
2007-12-24 00:23 . 2007-12-24 00:23 268 --ah----- C:\sqmdata01.sqm
2007-12-24 00:23 . 2007-12-24 00:23 244 --ah----- C:\sqmnoopt01.sqm
2007-12-23 18:49 . 2007-12-23 18:49 268 --ah----- C:\sqmdata00.sqm
2007-12-23 18:49 . 2007-12-23 18:49 244 --ah----- C:\sqmnoopt00.sqm
2007-12-23 18:49 . 2007-12-23 18:49 0 --a------ C:\WINDOWS\RegMaid.INI
2007-12-21 12:50 . 2007-12-21 12:56 <DIR> d-------- C:\EDUIT3
2007-12-21 12:50 . 2007-12-21 12:52 82 -r------- C:\EDUIT3.BAT
2007-12-19 21:59 . 2007-12-19 21:59 <DIR> d--h----- C:\WINDOWS\system32\CanonIJ Uninstaller Information
2007-12-19 21:59 . 2007-12-19 21:59 <DIR> d--h----- C:\Documents and Settings\All Users\Dati applicazioni\CanonBJ
2007-12-19 21:59 . 2006-04-23 21:00 161,792 --a------ C:\WINDOWS\system32\CNMLM84.DLL
2007-12-19 21:58 . 2007-12-19 21:58 <DIR> d--h----- C:\Programmi\CanonBJ
2007-12-18 21:19 . 2002-11-14 20:43 221,696 --a------ C:\WINDOWS\system32\srrstr.dll
2007-12-18 21:19 . 2002-11-14 20:43 221,696 --a------ C:\WINDOWS\system32\dllcache\srrstr.dll
2007-12-18 21:16 . 2007-12-18 21:43 <DIR> d--h-c--- C:\WINDOWS\$xpsp1hfm$
2007-12-18 21:16 . 2004-01-10 06:11 26,112 --a------ C:\WINDOWS\system32\xpsp1hfm.exe
2007-12-13 23:07 . 2007-07-30 19:19 203,096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-12-13 14:17 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-12-13 14:17 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-13 14:17 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-13 14:17 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-13 14:17 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-13 14:17 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-13 14:16 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-12-13 14:16 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2007-12-12 21:18 . 2007-12-12 21:18 <DIR> d-------- C:\Documents and Settings\Administrator\Dati applicazioni\MalwareBot
2007-12-11 23:24 . 2007-12-13 14:08 <DIR> d-------- C:\Programmi\RegistrySmart
2007-12-11 23:24 . 2007-12-11 23:24 <DIR> d-------- C:\Documents and Settings\tutto\Dati applicazioni\RegistrySmart
2007-12-11 23:19 . 2007-12-13 14:07 <DIR> d-------- C:\Documents and Settings\tutto\Dati applicazioni\MalwareBot
2007-12-11 23:18 . 2007-12-13 14:05 <DIR> d-------- C:\Documents and Settings\tutto\Dati applicazioni\AntiSpyware
2007-12-11 23:14 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-12-11 23:00 . 2007-12-13 14:08 <DIR> d-------- C:\Programmi\Antispy antivirus
2007-12-10 22:44 . 2007-12-10 22:44 <DIR> d-------- C:\Programmi\IKEA HomePlanner
2007-12-10 22:43 . 2007-12-10 22:43 <DIR> d-------- C:\Programmi\File comuni\Wise Installation Wizard
2007-12-10 22:21 . 2007-12-11 10:21 414 --ahs---- C:\WINDOWS\system32\gbqlynfy.ini
2007-12-10 22:14 . 2007-01-14 11:08 <DIR> d--h----- C:\Documents and Settings\Administrator\Risorse di stampa
2007-12-10 22:14 . 2007-01-14 11:08 <DIR> d--h----- C:\Documents and Settings\Administrator\Risorse di rete
2007-12-10 22:14 . 2007-01-14 11:08 <DIR> d-------- C:\Documents and Settings\Administrator\Preferiti
2007-12-10 22:14 . 2007-01-14 11:08 <DIR> d--h----- C:\Documents and Settings\Administrator\Modelli
2007-12-10 22:14 . 2007-01-14 11:08 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Avvio
2007-12-10 22:14 . 2007-12-25 20:22 <DIR> d--h----- C:\Documents and Settings\Administrator\Impostazioni locali
2007-12-10 22:14 . 2007-01-14 11:08 <DIR> d-------- C:\Documents and Settings\Administrator\Documenti
2007-12-10 22:14 . 2007-12-12 21:18 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dati applicazioni
2007-12-09 19:06 . 2007-12-09 19:07 <DIR> d-------- C:\WINDOWS\system32\Color
2007-12-09 19:06 . 2007-12-09 19:06 <DIR> d-------- C:\Microtek
2007-12-09 19:06 . 2001-03-22 16:03 15,531 --a------ C:\WINDOWS\SN32LAN.INF
2007-12-09 18:40 . 1998-08-20 15:47 167,936 --a------ C:\WINDOWS\system32\EventMgr.exe
2007-12-09 18:40 . 2001-11-09 08:37 15,387 --a------ C:\WINDOWS\system32\msmusd.dll
2007-12-09 18:05 . 2001-08-30 23:08 54,272 --a------ C:\WINDOWS\system32\wiamsmud.dll
2007-12-09 18:05 . 2001-08-30 23:08 54,272 --a------ C:\WINDOWS\system32\dllcache\wiamsmud.dll
2007-12-09 18:05 . 2001-08-30 23:08 45,568 --a------ C:\WINDOWS\system32\SMB3w.dll
2007-12-09 18:05 . 2001-08-30 23:08 45,568 --a------ C:\WINDOWS\system32\dllcache\smb3w.dll
2007-12-09 18:05 . 2001-08-17 21:53 13,824 --a------ C:\WINDOWS\system32\drivers\USBSCAN.SYS
2007-12-09 18:05 . 2001-08-17 21:53 13,824 --a------ C:\WINDOWS\system32\dllcache\usbscan.sys
2007-12-07 23:20 . 2007-12-07 23:20 <DIR> d-------- C:\Documents and Settings\tutto\Dati applicazioni\SpywareBot
2007-12-07 23:02 . 2007-12-07 23:02 <DIR> d-------- C:\WINDOWS\system32\bits
2007-12-07 23:01 . 2004-07-01 23:05 360,448 --a------ C:\WINDOWS\system32\dllcache\qmgr.dll
2007-12-07 23:01 . 2004-07-01 23:05 331,776 --a------ C:\WINDOWS\system32\winhttp.dll
2007-12-07 23:01 . 2004-07-01 23:05 17,408 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2007-12-07 23:01 . 2004-07-01 23:05 17,408 --a------ C:\WINDOWS\system32\dllcache\qmgrprxy.dll
2007-12-07 23:01 . 2004-07-01 23:05 7,680 --------- C:\WINDOWS\system32\dllcache\bitsprx2.dll
2007-12-07 23:01 . 2004-07-01 23:05 7,680 --a------ C:\WINDOWS\system32\bitsprx2.dll
2007-12-07 23:01 . 2004-07-01 23:05 7,168 --------- C:\WINDOWS\system32\dllcache\bitsprx3.dll
2007-12-07 23:01 . 2004-07-01 23:05 7,168 --a------ C:\WINDOWS\system32\bitsprx3.dll
2007-12-07 22:59 . 2007-07-30 19:19 549,720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-12-07 22:59 . 2007-07-30 19:19 325,976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-12-07 22:59 . 2007-07-30 19:19 216,408 --a------ C:\WINDOWS\system32\wuaucpl.cpl
2007-12-07 22:59 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2007-12-07 22:59 . 2007-07-30 19:19 38,232 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2007-12-07 22:59 . 2007-07-30 19:18 33,624 --a------ C:\WINDOWS\system32\wups.dll
2007-12-07 22:59 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2007-12-07 22:59 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2007-12-07 22:59 . 2007-07-30 19:18 21,336 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2007-12-06 23:36 . 2007-12-06 23:36 <DIR> d-------- C:\WINDOWS\Preferiti
2007-12-06 23:36 . 2007-12-06 23:36 <DIR> dr------- C:\Documents and Settings\LocalService\Preferiti
2007-12-06 23:13 . 2007-12-06 23:13 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\MailFrontier
2007-12-06 23:13 . 2007-06-21 21:54 75,248 --a------ C:\WINDOWS\zllsputility.exe
2007-12-06 23:13 . 2007-06-21 21:55 42,384 --a------ C:\WINDOWS\zllsputility_loc0410.dll
2007-12-06 23:13 . 2007-06-21 21:55 21,904 --a------ C:\WINDOWS\system32\imsinstall_loc0410.dll
2007-12-06 23:13 . 2007-06-21 21:55 17,808 --a------ C:\WINDOWS\system32\imslsp_install_loc0410.dll
2007-12-06 23:13 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
2007-12-03 21:13 . 2007-12-03 21:13 <DIR> d-------- C:\Programmi\DVD Shrink
2007-12-03 21:13 . 2007-12-03 21:19 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\DVD Shrink
2007-12-02 14:51 . 2005-09-07 07:10 173,494 --a------ C:\WINDOWS\system32\drivers\mon_ac_w.bin
2007-12-02 14:51 . 2005-09-22 09:31 158,592 --a------ C:\WINDOWS\system32\drivers\gwausb.sys
2007-12-02 14:51 . 2005-08-25 10:48 25,600 --a------ C:\WINDOWS\system32\CoInst.dll
2007-12-02 14:51 . 2006-04-28 09:44 19,404 --------- C:\WINDOWS\wwdslcfg.ini
2007-12-02 11:34 . 2007-12-02 14:51 <DIR> d-------- C:\Program Files
2007-12-01 16:15 . 2007-12-01 16:17 <DIR> d-------- C:\Programmi\Harry Potter Creative CD
2007-12-01 12:40 . 2007-12-01 13:09 <DIR> d-------- C:\Programmi\DVDFab
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-18 20:13 2,523,136 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2007-12-13 13:06 --------- d-----w C:\Programmi\Canon
2007-12-09 17:53 --------- d--h--w C:\Programmi\InstallShield Installation Information
2007-12-06 22:32 24,608 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2007-12-06 22:32 2,592 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2007-12-06 22:32 1,364 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2007-12-06 22:32 1,316 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2007-12-06 22:12 75,932 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2007-12-06 22:12 74,396 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2007-12-02 10:11 64,824 ----a-w C:\Documents and Settings\tutto\Dati applicazioni\GDIPFONTCACHEV1.DAT
2007-11-05 20:31 --------- d-----w C:\Documents and Settings\tutto\Dati applicazioni\Nokia Multimedia Player
2007-11-05 19:59 --------- d-----w C:\Documents and Settings\tutto\Dati applicazioni\Nokia
2007-11-05 19:55 --------- d-----w C:\Documents and Settings\tutto\Dati applicazioni\DataLayer
2007-11-05 19:52 --------- d-----w C:\Documents and Settings\tutto\Dati applicazioni\PC Suite
2007-11-05 19:51 --------- d-----w C:\Programmi\File comuni\PCSuite
2007-11-05 19:51 --------- d-----w C:\Programmi\File comuni\Nokia
2007-11-05 19:51 --------- d-----w C:\Programmi\DIFX
2007-11-05 19:51 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\PC Suite
2007-11-05 19:49 --------- d-----w C:\Programmi\Nokia
2007-11-05 19:47 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Downloaded Installations
2007-05-19 08:14 32,103 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_05_18_17_20_24_small.dmp.zip
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-08-31 12:00]
"MsnMsgr"="C:\Programmi\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:54]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NWEReboot"="" []
"DSLSTATEXE"="C:\Program Files\D-Link\DSL-200\dslstat.exe" [2005-12-12 08:44]
"DSLAGENTEXE"="C:\Program Files\D-Link\DSL-200\dslagent.exe" [2005-08-25 10:47]
"ZoneAlarm Client"="C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-08-31 12:00]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rlsxvzvn]
rlsxvzvn.dll

.
Contenuto della cartella 'Scheduled Tasks'
"2007-12-24 18:27:01 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Programmi\Windows Live Toolbar\MSNTBUP.EXE
"2007-12-19 02:00:00 C:\WINDOWS\Tasks\MalwareBot Scheduled Scan.job"
- C:\Programmi\MalwareBot\MalwareBot.ex
- C:\Programmi\MalwareBot
"2007-12-19 02:30:00 C:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.job"
- C:\Programmi\RegistrySmart\RegistrySmart.ex
- C:\Programmi\RegistrySmart
.
**************************************************************************
catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-25 20:28:31
Windows 5.1.2600 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
.
Ora fine scansione: 2007-12-25 20:30:58 - machine was rebooted
.
2007-12-18 20:44:36 --- E O F ---

prl

Report Offensive Follow Up For Removal

Response Number 5

Name: jabuck
Date: December 24, 2007 at 12:27:27 Pacific
Subject: Alway new files in windows/system32

Reply: (edit)

Open Notepad and copy/paste everything between the X"s into it and make sure "File::" is at the very top of the page.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
File::
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\ababrafl.exe
C:\WINDOWS\system32\aeafhiwi.exe
C:\WINDOWS\system32\arjpvcww.dll
C:\WINDOWS\system32\bqrmodne.ini
C:\WINDOWS\system32\cnnxkmex.dll
C:\WINDOWS\system32\edykvxut.exe
C:\WINDOWS\system32\endomrqb.dll
C:\WINDOWS\system32\fccbbyx.dll
C:\WINDOWS\system32\gvxtyouw.dll
C:\WINDOWS\system32\imgkymwp.exe
C:\WINDOWS\system32\jixosybl.ini
C:\WINDOWS\system32\jkklk.dll
C:\WINDOWS\system32\jsxgbyyk.dll
C:\WINDOWS\system32\kctrqkdj.exe
C:\WINDOWS\system32\klkkj.ini
C:\WINDOWS\system32\klkkj.ini2
C:\WINDOWS\system32\kyybgxsj.ini
C:\WINDOWS\system32\lbysoxij.dll
C:\WINDOWS\system32\leiooyxa.dll
C:\WINDOWS\system32\lhorsqgg.dll
C:\WINDOWS\system32\ljpdqmqm.ini
C:\WINDOWS\system32\lsmlyewn.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mfbklevh.ini
C:\WINDOWS\system32\mhjguejl.ini
C:\WINDOWS\system32\nornravl.exe
C:\WINDOWS\system32\nweylmsl.ini
C:\WINDOWS\system32\nxdjrqwv.exe
C:\WINDOWS\system32\oklqgvfv.exe
C:\WINDOWS\system32\ouutwcvj.dll
C:\WINDOWS\system32\pjiqdfwm.exe
C:\WINDOWS\system32\pnebqncc.dll
C:\WINDOWS\system32\qtbbpvut.dll
C:\WINDOWS\system32\qyshejyb.ini
C:\WINDOWS\system32\takfofky.dll
C:\WINDOWS\system32\tkkeqskx.dll
C:\WINDOWS\system32\tuvpbbtq.ini
C:\WINDOWS\system32\twowwilr.dll
C:\WINDOWS\system32\utqdxjyl.exe
C:\WINDOWS\system32\utvsxvyv.exe
C:\WINDOWS\system32\vdugvbtr.dll
C:\WINDOWS\system32\vqmqlgby.exe
C:\WINDOWS\system32\wcapdnpv.dll
C:\WINDOWS\system32\wqawjprn.ini
C:\WINDOWS\system32\wqgsxrpr.dll
C:\WINDOWS\system32\xemkxnnc.ini
C:\WINDOWS\system32\yrshbfms.ini
C:\WINDOWS\system32\yrywbsxq.dll
C:\WINDOWS\system32\gbqlynfy.ini
Driver::
rlsxvzvn

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rlsxvzvn]

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop.
Then drag/drop the CFScript.txt onto ComboFix.exe (the red X on your desktop) if combofix does not auto start click "run".
Please go to Virus Total and upload the following file for analysis:
C:\EDUIT3.BAT

Post the results in your reply.
Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.
Download ATF Cleaner from this link:
ATF Cleaner
Run ATF-Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

Report Offensive Follow Up For Removal


Trojan Trat BHO exe files added in windows/system32 C:\WINDOWS\System32\IEsp.mht HELP! .tmp files in c: drive POS. tmp files in C drive, Red X ic	Trojan in Windows folder Blue files in windows folder? strange auto typing in Windows Logo AIM Myspace Virus Bloodhound.Exploit.109 virus

Response Number 6

Name: jabuck
Date: December 24, 2007 at 12:29:35 Pacific
Subject: Alway new files in windows/system32

Reply: (edit)

Please post a new Hijack This log.

Report Offensive Follow Up For Removal

Response Number 7

Name: prl
Date: December 24, 2007 at 12:50:42 Pacific
Subject: Alway new files in windows/system32

Reply: (edit)

This is the last log file from Hijackthis, now completing steps of your last message. The mouse pointer is even more difficult to control.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21.48.56, on 25/12/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\D-Link\DSL-200\dslstat.exe
C:\Program Files\D-Link\DSL-200\dslagent.exe
C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmi\MSN Messenger\MsnMsgr.Exe
C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Documents and Settings\tutto\Desktop\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\D-Link\DSL-200\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\D-Link\DSL-200\dslagent.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [updateMgr] C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{5F363C6D-B030-4DED-A289-C6B4046F6F97}: NameServer = 193.12.150.2 212.247.152.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{5F363C6D-B030-4DED-A289-C6B4046F6F97}: NameServer = 193.12.150.2 212.247.152.2
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe
--
End of file - 3990 bytes

prl

Report Offensive Follow Up For Removal

Response Number 8

Name: prl
Date: December 24, 2007 at 13:04:13 Pacific
Subject: Alway new files in windows/system32

Reply: (edit)

Result from virustotal:
Antivirus Version Last Update Result
AhnLab-V3 2007.12.25.10 2007.12.24 -
AntiVir 7.6.0.46 2007.12.24 -
Authentium 4.93.8 2007.12.23 -
Avast 4.7.1098.0 2007.12.24 -
AVG 7.5.0.516 2007.12.24 -
BitDefender 7.2 2007.12.24 -
CAT-QuickHeal 9.00 2007.12.24 -
ClamAV 0.91.2 2007.12.24 -
DrWeb 4.44.0.09170 2007.12.24 -
eSafe 7.0.15.0 2007.12.24 -
eTrust-Vet 31.3.5400 2007.12.24 -
Ewido 4.0 2007.12.24 -
FileAdvisor 1 2007.12.24 -
Fortinet 3.14.0.0 2007.12.24 -
F-Prot 4.4.2.54 2007.12.23 -
F-Secure 6.70.13030.0 2007.12.24 -
Ikarus T3.1.1.15 2007.12.24 -
Kaspersky 7.0.0.125 2007.12.24 -
McAfee 5192 2007.12.24 -
Microsoft 1.3109 2007.12.24 -
NOD32v2 2745 2007.12.24 -
Norman 5.80.02 2007.12.24 -
Panda 9.0.0.4 2007.12.24 -
Prevx1 V2 2007.12.24 -
Rising 20.24.02.00 2007.12.24 -
Sophos 4.24.0 2007.12.24 -
Sunbelt 2.2.907.0 2007.12.21 -
Symantec 10 2007.12.24 -
TheHacker 6.2.9.168 2007.12.22 -
VBA32 3.12.2.5 2007.12.24 -
VirusBuster 4.3.26:9 2007.12.24 -
Webwasher-Gateway 6.6.2 2007.12.24 -
Additional information
File size: 82 bytes
MD5: a11e3f1c2601b3d7ae3a4b0ab9745c78
SHA1: 421227c528eb8343c218b201c2520b130eb7152a
PEiD: -
ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.
prl

Report Offensive Follow Up For Removal

Response Number 9

Name: prl
Date: December 24, 2007 at 13:14:51 Pacific
Subject: Alway new files in windows/system32

Reply: (edit)

Completed all other steps (Empty the restore folder and run with ATF). Waiting for your reply. Thanks.
prl

Report Offensive Follow Up For Removal

Response Number 10

Name: jabuck
Date: December 24, 2007 at 13:31:43 Pacific
Subject: Alway new files in windows/system32

Reply: (edit)

The Hijack This log is clean.
Please post a new Combofix log.
Please run the BitDefender online scan this link:
Bitdefender Online Scanner

You will need to allow an active x install for the scan to run.
Leave the scanning options at default and press "click here to scan"
When finished scanning, click on "click here to export the scan report"
Save it to your desktop, at "file name" type in "bdscan" then click save.
Post a log in your reply.

Report Offensive Follow Up For Removal

Response Number 11

Name: prl
Date: December 24, 2007 at 13:44:46 Pacific
Subject: Alway new files in windows/system32

Reply: (edit)

Question: zonealarm has asked me the permission for the ipconfig.exe to acces internet, I have given the ok, was it wrong? Now refusing connection to internet. Had to disconnect and reconnect again. Mouse pointer always "slipping".
New combofix log (now performing bitdefender scan):
ComboFix 07-12-25.2 - tutto 2007-12-25 22.34.03.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.0.1252.1.1040.18.147 [GMT 1:00]
Eseguito da: C:\Documents and Settings\tutto\Desktop\ComboFix.exe
.
((((((((((((((((((((((((( Files Creati Da 2007-11-25 al 2007-12-25 )))))))))))))))))))))))))))))))))))
.
2007-12-25 21:41 . 2007-12-25 21:41 268 --ah----- C:\sqmdata03.sqm
2007-12-25 21:41 . 2007-12-25 21:41 244 --ah----- C:\sqmnoopt03.sqm
2007-12-25 20:25 . 2007-12-25 20:25 268 --ah----- C:\sqmdata02.sqm
2007-12-25 20:25 . 2007-12-25 20:25 244 --ah----- C:\sqmnoopt02.sqm
2007-12-24 00:23 . 2007-12-24 00:23 268 --ah----- C:\sqmdata01.sqm
2007-12-24 00:23 . 2007-12-24 00:23 244 --ah----- C:\sqmnoopt01.sqm
2007-12-23 18:49 . 2007-12-23 18:49 268 --ah----- C:\sqmdata00.sqm
2007-12-23 18:49 . 2007-12-23 18:49 244 --ah----- C:\sqmnoopt00.sqm
2007-12-23 18:49 . 2007-12-23 18:49 0 --a------ C:\WINDOWS\RegMaid.INI
2007-12-21 12:50 . 2007-12-21 12:56 <DIR> d-------- C:\EDUIT3
2007-12-21 12:50 . 2007-12-21 12:52 82 -r------- C:\EDUIT3.BAT
2007-12-19 21:59 . 2007-12-19 21:59 <DIR> d--h----- C:\WINDOWS\system32\CanonIJ Uninstaller Information
2007-12-19 21:59 . 2007-12-19 21:59 <DIR> d--h----- C:\Documents and Settings\All Users\Dati applicazioni\CanonBJ
2007-12-19 21:59 . 2006-04-23 21:00 161,792 --a------ C:\WINDOWS\system32\CNMLM84.DLL
2007-12-19 21:58 . 2007-12-19 21:58 <DIR> d--h----- C:\Programmi\CanonBJ
2007-12-18 21:19 . 2002-11-14 20:43 221,696 --a------ C:\WINDOWS\system32\srrstr.dll
2007-12-18 21:19 . 2002-11-14 20:43 221,696 --a------ C:\WINDOWS\system32\dllcache\srrstr.dll
2007-12-18 21:16 . 2007-12-18 21:43 <DIR> d--h-c--- C:\WINDOWS\$xpsp1hfm$
2007-12-18 21:16 . 2004-01-10 06:11 26,112 --a------ C:\WINDOWS\system32\xpsp1hfm.exe
2007-12-13 23:07 . 2007-07-30 19:19 203,096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-12-13 14:17 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-12-13 14:17 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-13 14:17 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-13 14:17 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-13 14:17 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-13 14:17 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-13 14:16 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-12-13 14:16 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2007-12-12 21:18 . 2007-12-12 21:18 <DIR> d-------- C:\Documents and Settings\Administrator\Dati applicazioni\MalwareBot
2007-12-11 23:24 . 2007-12-13 14:08 <DIR> d-------- C:\Programmi\RegistrySmart
2007-12-11 23:24 . 2007-12-11 23:24 <DIR> d-------- C:\Documents and Settings\tutto\Dati applicazioni\RegistrySmart
2007-12-11 23:19 . 2007-12-13 14:07 <DIR> d-------- C:\Documents and Settings\tutto\Dati applicazioni\MalwareBot
2007-12-11 23:18 . 2007-12-13 14:05 <DIR> d-------- C:\Documents and Settings\tutto\Dati applicazioni\AntiSpyware
2007-12-11 23:14 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-12-11 23:00 . 2007-12-13 14:08 <DIR> d-------- C:\Programmi\Antispy antivirus
2007-12-10 22:44 . 2007-12-10 22:44 <DIR> d-------- C:\Programmi\IKEA HomePlanner
2007-12-10 22:43 . 2007-12-10 22:43 <DIR> d-------- C:\Programmi\File comuni\Wise Installation Wizard
2007-12-10 22:14 . 2007-01-14 11:08 <DIR> d--h----- C:\Documents and Settings\Administrator\Risorse di stampa
2007-12-10 22:14 . 2007-01-14 11:08 <DIR> d--h----- C:\Documents and Settings\Administrator\Risorse di rete
2007-12-10 22:14 . 2007-01-14 11:08 <DIR> d-------- C:\Documents and Settings\Administrator\Preferiti
2007-12-10 22:14 . 2007-01-14 11:08 <DIR> d--h----- C:\Documents and Settings\Administrator\Modelli
2007-12-10 22:14 . 2007-01-14 11:08 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Avvio
2007-12-10 22:14 . 2007-12-25 21:36 <DIR> d--h----- C:\Documents and Settings\Administrator\Impostazioni locali
2007-12-10 22:14 . 2007-01-14 11:08 <DIR> d-------- C:\Documents and Settings\Administrator\Documenti
2007-12-10 22:14 . 2007-12-12 21:18 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dati applicazioni
2007-12-09 19:06 . 2007-12-09 19:07 <DIR> d-------- C:\WINDOWS\system32\Color
2007-12-09 19:06 . 2007-12-09 19:06 <DIR> d-------- C:\Microtek
2007-12-09 19:06 . 2001-03-22 16:03 15,531 --a------ C:\WINDOWS\SN32LAN.INF
2007-12-09 18:40 . 1998-08-20 15:47 167,936 --a------ C:\WINDOWS\system32\EventMgr.exe
2007-12-09 18:40 . 2001-11-09 08:37 15,387 --a------ C:\WINDOWS\system32\msmusd.dll
2007-12-09 18:05 . 2001-08-30 23:08 54,272 --a------ C:\WINDOWS\system32\wiamsmud.dll
2007-12-09 18:05 . 2001-08-30 23:08 54,272 --a------ C:\WINDOWS\system32\dllcache\wiamsmud.dll
2007-12-09 18:05 . 2001-08-30 23:08 45,568 --a------ C:\WINDOWS\system32\SMB3w.dll
2007-12-09 18:05 . 2001-08-30 23:08 45,568 --a------ C:\WINDOWS\system32\dllcache\smb3w.dll
2007-12-09 18:05 . 2001-08-17 21:53 13,824 --a------ C:\WINDOWS\system32\drivers\USBSCAN.SYS
2007-12-09 18:05 . 2001-08-17 21:53 13,824 --a------ C:\WINDOWS\system32\dllcache\usbscan.sys
2007-12-07 23:20 . 2007-12-07 23:20 <DIR> d-------- C:\Documents and Settings\tutto\Dati applicazioni\SpywareBot
2007-12-07 23:02 . 2007-12-07 23:02 <DIR> d-------- C:\WINDOWS\system32\bits
2007-12-07 23:01 . 2004-07-01 23:05 360,448 --a------ C:\WINDOWS\system32\dllcache\qmgr.dll
2007-12-07 23:01 . 2004-07-01 23:05 331,776 --a------ C:\WINDOWS\system32\winhttp.dll
2007-12-07 23:01 . 2004-07-01 23:05 17,408 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2007-12-07 23:01 . 2004-07-01 23:05 17,408 --a------ C:\WINDOWS\system32\dllcache\qmgrprxy.dll
2007-12-07 23:01 . 2004-07-01 23:05 7,680 --------- C:\WINDOWS\system32\dllcache\bitsprx2.dll
2007-12-07 23:01 . 2004-07-01 23:05 7,680 --a------ C:\WINDOWS\system32\bitsprx2.dll
2007-12-07 23:01 . 2004-07-01 23:05 7,168 --------- C:\WINDOWS\system32\dllcache\bitsprx3.dll
2007-12-07 23:01 . 2004-07-01 23:05 7,168 --a------ C:\WINDOWS\system32\bitsprx3.dll
2007-12-07 22:59 . 2007-07-30 19:19 549,720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-12-07 22:59 . 2007-07-30 19:19 325,976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-12-07 22:59 . 2007-07-30 19:19 216,408 --a------ C:\WINDOWS\system32\wuaucpl.cpl
2007-12-07 22:59 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2007-12-07 22:59 . 2007-07-30 19:19 38,232 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2007-12-07 22:59 . 2007-07-30 19:18 33,624 --a------ C:\WINDOWS\system32\wups.dll
2007-12-07 22:59 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2007-12-07 22:59 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2007-12-07 22:59 . 2007-07-30 19:18 21,336 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2007-12-06 23:36 . 2007-12-06 23:36 <DIR> d-------- C:\WINDOWS\Preferiti
2007-12-06 23:36 . 2007-12-06 23:36 <DIR> dr------- C:\Documents and Settings\LocalService\Preferiti
2007-12-06 23:13 . 2007-12-06 23:13 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\MailFrontier
2007-12-06 23:13 . 2007-06-21 21:54 75,248 --a------ C:\WINDOWS\zllsputility.exe
2007-12-06 23:13 . 2007-06-21 21:55 42,384 --a------ C:\WINDOWS\zllsputility_loc0410.dll
2007-12-06 23:13 . 2007-06-21 21:55 21,904 --a------ C:\WINDOWS\system32\imsinstall_loc0410.dll
2007-12-06 23:13 . 2007-06-21 21:55 17,808 --a------ C:\WINDOWS\system32\imslsp_install_loc0410.dll
2007-12-06 23:13 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
2007-12-03 21:13 . 2007-12-03 21:13 <DIR> d-------- C:\Programmi\DVD Shrink
2007-12-03 21:13 . 2007-12-03 21:19 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\DVD Shrink
2007-12-02 14:51 . 2005-09-07 07:10 173,494 --a------ C:\WINDOWS\system32\drivers\mon_ac_w.bin
2007-12-02 14:51 . 2005-09-22 09:31 158,592 --a------ C:\WINDOWS\system32\drivers\gwausb.sys
2007-12-02 14:51 . 2005-08-25 10:48 25,600 --a------ C:\WINDOWS\system32\CoInst.dll
2007-12-02 14:51 . 2006-04-28 09:44 19,404 --------- C:\WINDOWS\wwdslcfg.ini
2007-12-02 11:34 . 2007-12-02 14:51 <DIR> d-------- C:\Program Files
2007-12-01 16:15 . 2007-12-01 16:17 <DIR> d-------- C:\Programmi\Harry Potter Creative CD
2007-12-01 12:40 . 2007-12-01 13:09 <DIR> d-------- C:\Programmi\DVDFab
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-25 20:45 --------- d-----w C:\Documents and Settings\tutto\Dati applicazioni\AdobeUM
2007-12-18 20:13 2,523,136 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2007-12-13 13:06 --------- d-----w C:\Programmi\Canon
2007-12-09 17:53 --------- d--h--w C:\Programmi\InstallShield Installation Information
2007-12-06 22:32 24,608 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2007-12-06 22:32 2,592 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2007-12-06 22:32 1,364 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2007-12-06 22:32 1,316 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2007-12-06 22:12 75,932 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2007-12-06 22:12 74,396 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2007-12-02 10:11 64,824 ----a-w C:\Documents and Settings\tutto\Dati applicazioni\GDIPFONTCACHEV1.DAT
2007-11-24 15:08 10,752 --sha-r C:\WINDOWS\system32\wsrsvc.exe
2007-11-05 20:31 --------- d-----w C:\Documents and Settings\tutto\Dati applicazioni\Nokia Multimedia Player
2007-11-05 19:59 --------- d-----w C:\Documents and Settings\tutto\Dati applicazioni\Nokia
2007-11-05 19:55 --------- d-----w C:\Documents and Settings\tutto\Dati applicazioni\DataLayer
2007-11-05 19:52 --------- d-----w C:\Documents and Settings\tutto\Dati applicazioni\PC Suite
2007-11-05 19:51 --------- d-----w C:\Programmi\File comuni\PCSuite
2007-11-05 19:51 --------- d-----w C:\Programmi\File comuni\Nokia
2007-11-05 19:51 --------- d-----w C:\Programmi\DIFX
2007-11-05 19:51 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\PC Suite
2007-11-05 19:49 --------- d-----w C:\Programmi\Nokia
2007-11-05 19:47 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Downloaded Installations
2007-05-19 08:14 32,103 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_05_18_17_20_24_small.dmp.zip
.
((((((((((((((((((((((((((((( snapshot@2007-12-25_20.29.04.73 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-12-25 20:25:01 25,214 ----a-r C:\WINDOWS\Installer\{AC76BA86-7AD7-1040-7B44-A70900000002}\SC_Reader.exe
- 2007-12-24 19:17:18 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\NtUser.dat
+ 2007-12-25 20:32:53 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\NtUser.dat
+ 2007-12-25 20:46:15 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_618.dat
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-08-31 12:00]
"MsnMsgr"="C:\Programmi\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:54]
"updateMgr"="C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NWEReboot"="" []
"DSLSTATEXE"="C:\Program Files\D-Link\DSL-200\dslstat.exe" [2005-12-12 08:44]
"DSLAGENTEXE"="C:\Program Files\D-Link\DSL-200\dslagent.exe" [2005-08-25 10:47]
"ZoneAlarm Client"="C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-08-31 12:00]
R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\System32\DRIVERS\Amps2prt.sys [2002-12-31 19:35]
S3 lanusb;D-Link DSL-200 USB ADSL LAN Modem;C:\WINDOWS\System32\DRIVERS\glausb.sys []
.
Contenuto della cartella 'Scheduled Tasks'
"2007-12-25 21:27:01 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Programmi\Windows Live Toolbar\MSNTBUP.EXE
"2007-12-19 02:00:00 C:\WINDOWS\Tasks\MalwareBot Scheduled Scan.job"
- C:\Programmi\MalwareBot\MalwareBot.ex
- C:\Programmi\MalwareBot
"2007-12-19 02:30:00 C:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.job"
- C:\Programmi\RegistrySmart\RegistrySmart.ex
- C:\Programmi\RegistrySmart
.
**************************************************************************
catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-25 22:35:52
Windows 5.1.2600 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
.
Ora fine scansione: 2007-12-25 22.36.49
C:\ComboFix2.txt ... 2007-12-25 21:36
C:\ComboFix3.txt ... 2007-12-25 20:30
.
2007-12-18 20:44:36 --- E O F ---

prl

Report Offensive Follow Up For Removal

Response Number 12

Name: jabuck
Date: December 24, 2007 at 14:13:51 Pacific
Subject: Alway new files in windows/system32

Reply: (edit)

Ipconfig.exe should not need to call out unless you manually ask it to.
Run the Bitdefender scanner and see if it finds a trojan.

Report Offensive Follow Up For Removal

Response Number 13

Name: prl
Date: December 24, 2007 at 15:31:29 Pacific
Subject: Alway new files in windows/system32

Reply: (edit)

Hallo! Bitdefender has finished (after more than one hour). It found many trojans, seems that all are deleted, here is the log (copy and paste from html file, ok?). Do you think I'm ok now? ...Here it's past midnight so...marry Xmas! And many thanks again, very helpful!
BitDefender Online Scanner

Scan report generated at: Wed, Dec 26, 2007 - 00:21:23

Scan path: A:\;C:\;D:\;E:\;F:\;

Statistics
Time

01:21:30
Files

156756
Folders

2618
Boot Sectors

3
Archives

22562
Packed Files

5750

Results
Identified Viruses

7
Infected Files

32
Suspect Files

0
Warnings

0
Disinfected

0
Deleted Files

32

Engines Info
Virus Definitions

884190
Engine build

AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
Scan plugins

14
Archive plugins

38
Unpack plugins

7
E-mail plugins

6
System plugins

1

Scan Settings
First Action

Disinfect
Second Action

Delete
Heuristics

Yes
Enable Warnings

Yes
Scanned Extensions

*;
Exclude Extensions

Scan Emails

Yes
Scan Archives

Yes
Scan Packed

Yes
Scan Files

Yes
Scan Boot

Yes

Scanned File

Status
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail\mail.interfree-1.it\Inbox=>(message 53)=>[Subject: Compleanno][Date: Sat, 10 Mar 2007 22:29:21 +0100]=>(MIME part)=>filmato.asx

Infected with: Trojan.Downloader.JS.V
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail\mail.interfree-1.it\Inbox=>(message 53)=>[Subject: Compleanno][Date: Sat, 10 Mar 2007 22:29:21 +0100]=>(MIME part)=>filmato.asx

Disinfection failed
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail\mail.interfree-1.it\Inbox=>(message 53)=>[Subject: Compleanno][Date: Sat, 10 Mar 2007 22:29:21 +0100]=>(MIME part)=>filmato.asx

Deleted
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail\mail.interfree-1.it\Inbox=>(message 53)=>[Subject: Compleanno][Date: Sat, 10 Mar 2007 22:29:21 +0100]=>(MIME part)

Updated
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail\mail.interfree-1.it\Inbox=>(message 53)

Updated
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail\mail.interfree-1.it\Inbox

Updated
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail\mail.interfree.it\Inbox=>(message 17)=>[Subject: Sadam Hussein alive!][Date: Fri, 19 Jan 2007 23:52:25 -0500]=>(MIME part)=>Full Clip.exe

Infected with: Trojan.Generic.20242
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail\mail.interfree.it\Inbox=>(message 17)=>[Subject: Sadam Hussein alive!][Date: Fri, 19 Jan 2007 23:52:25 -0500]=>(MIME part)=>Full Clip.exe

Disinfection failed
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail\mail.interfree.it\Inbox=>(message 17)=>[Subject: Sadam Hussein alive!][Date: Fri, 19 Jan 2007 23:52:25 -0500]=>(MIME part)=>Full Clip.exe

Deleted
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail\mail.interfree.it\Inbox=>(message 17)=>[Subject: Sadam Hussein alive!][Date: Fri, 19 Jan 2007 23:52:25 -0500]=>(MIME part)

Updated
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail\mail.interfree.it\Inbox=>(message 17)

Updated
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail\mail.interfree.it\Inbox

Updated
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 241)=>[Subject: I seminari estivi di TP][Date: Mon, 24 Apr 2006 08:27:22 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 241)=>[Subject: I seminari estivi di TP][Date: Mon, 24 Apr 2006 08:27:22 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 241)=>[Subject: I seminari estivi di TP][Date: Mon, 24 Apr 2006 08:27:22 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 241)=>[Subject: I seminari estivi di TP][Date: Mon, 24 Apr 2006 08:27:22 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 241)=>[Subject: I seminari estivi di TP][Date: Mon, 24 Apr 2006 08:27:22 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 242)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 242)=>[Subject: Volantino per gruppo di genitori di fi][Date: Thu, 27 Apr 2006 15:35:38 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 242)=>[Subject: Volantino per gruppo di genitori di fi][Date: Thu, 27 Apr 2006 15:35:38 +0200]=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 242)=>[Subject: Volantino per gruppo di genitori di fi][Date: Thu, 27 Apr 2006 15:35:38 +0200]=>(MIME part)=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 242)=>[Subject: Volantino per gruppo di genitori di fi][Date: Thu, 27 Apr 2006 15:35:38 +0200]=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 242)=>[Subject: Volantino per gruppo di genitori di fi][Date: Thu, 27 Apr 2006 15:35:38 +0200]=>(MIME part)=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 242)=>[Subject: Volantino per gruppo di genitori di fi][Date: Thu, 27 Apr 2006 15:35:38 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 242)=>[Subject: Volantino per gruppo di genitori di fi][Date: Thu, 27 Apr 2006 15:35:38 +0200]=>(MIME part)=>Volantino gr.genit adolescenza P.F..doc

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 242)=>[Subject: Volantino per gruppo di genitori di fi][Date: Thu, 27 Apr 2006 15:35:38 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 242)=>[Subject: Volantino per gruppo di genitori di fi][Date: Thu, 27 Apr 2006 15:35:38 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 242)=>[Subject: Volantino per gruppo di genitori di fi][Date: Thu, 27 Apr 2006 15:35:38 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 243)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 244)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 244)=>[Subject: Conferenza Medicina per la Terra, Ver][Date: Fri, 28 Apr 2006 23:41:35 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 244)=>[Subject: Conferenza Medicina per la Terra, Ver][Date: Fri, 28 Apr 2006 23:41:35 +0200]=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 244)=>[Subject: Conferenza Medicina per la Terra, Ver][Date: Fri, 28 Apr 2006 23:41:35 +0200]=>(MIME part)=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 244)=>[Subject: Conferenza Medicina per la Terra, Ver][Date: Fri, 28 Apr 2006 23:41:35 +0200]=>(MIME part)=>(MIME part)=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 244)=>[Subject: Conferenza Medicina per la Terra, Ver][Date: Fri, 28 Apr 2006 23:41:35 +0200]=>(MIME part)=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 244)=>[Subject: Conferenza Medicina per la Terra, Ver][Date: Fri, 28 Apr 2006 23:41:35 +0200]=>(MIME part)=>(MIME part)=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 244)=>[Subject: Conferenza Medicina per la Terra, Ver][Date: Fri, 28 Apr 2006 23:41:35 +0200]=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 244)=>[Subject: Conferenza Medicina per la Terra, Ver][Date: Fri, 28 Apr 2006 23:41:35 +0200]=>(MIME part)=>(MIME part)=>clip_image002.gif

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 244)=>[Subject: Conferenza Medicina per la Terra, Ver][Date: Fri, 28 Apr 2006 23:41:35 +0200]=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 244)=>[Subject: Conferenza Medicina per la Terra, Ver][Date: Fri, 28 Apr 2006 23:41:35 +0200]=>(MIME part)=>(MIME part)=>clip_image003.gif

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 244)=>[Subject: Conferenza Medicina per la Terra, Ver][Date: Fri, 28 Apr 2006 23:41:35 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 244)=>[Subject: Conferenza Medicina per la Terra, Ver][Date: Fri, 28 Apr 2006 23:41:35 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 244)=>[Subject: Conferenza Medicina per la Terra, Ver][Date: Fri, 28 Apr 2006 23:41:35 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 245)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 245)=>[Subject: Bologna 9.5.2006 Scrivo con le mani le][Date: Sat, 29 Apr 2006 15:55:10 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 245)=>[Subject: Bologna 9.5.2006 Scrivo con le mani le][Date: Sat, 29 Apr 2006 15:55:10 +0200]=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 245)=>[Subject: Bologna 9.5.2006 Scrivo con le mani le][Date: Sat, 29 Apr 2006 15:55:10 +0200]=>(MIME part)=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 245)=>[Subject: Bologna 9.5.2006 Scrivo con le mani le][Date: Sat, 29 Apr 2006 15:55:10 +0200]=>(MIME part)=>(MIME part)=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 245)=>[Subject: Bologna 9.5.2006 Scrivo con le mani le][Date: Sat, 29 Apr 2006 15:55:10 +0200]=>(MIME part)=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 245)=>[Subject: Bologna 9.5.2006 Scrivo con le mani le][Date: Sat, 29 Apr 2006 15:55:10 +0200]=>(MIME part)=>(MIME part)=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 245)=>[Subject: Bologna 9.5.2006 Scrivo con le mani le][Date: Sat, 29 Apr 2006 15:55:10 +0200]=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 245)=>[Subject: Bologna 9.5.2006 Scrivo con le mani le][Date: Sat, 29 Apr 2006 15:55:10 +0200]=>(MIME part)=>(MIME part)=>Sfondo Cielo blu.JPG

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 245)=>[Subject: Bologna 9.5.2006 Scrivo con le mani le][Date: Sat, 29 Apr 2006 15:55:10 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 245)=>[Subject: Bologna 9.5.2006 Scrivo con le mani le][Date: Sat, 29 Apr 2006 15:55:10 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 245)=>[Subject: Bologna 9.5.2006 Scrivo con le mani le][Date: Sat, 29 Apr 2006 15:55:10 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 246)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 246)=>[Subject: Notizie di Trasmutazione Maggio 2006-S][Date: Mon, 1 May 2006 23:05:28 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 246)=>[Subject: Notizie di Trasmutazione Maggio 2006-S][Date: Mon, 1 May 2006 23:05:28 +0200]=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 246)=>[Subject: Notizie di Trasmutazione Maggio 2006-S][Date: Mon, 1 May 2006 23:05:28 +0200]=>(MIME part)=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 246)=>[Subject: Notizie di Trasmutazione Maggio 2006-S][Date: Mon, 1 May 2006 23:05:28 +0200]=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 246)=>[Subject: Notizie di Trasmutazione Maggio 2006-S][Date: Mon, 1 May 2006 23:05:28 +0200]=>(MIME part)=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 246)=>[Subject: Notizie di Trasmutazione Maggio 2006-S][Date: Mon, 1 May 2006 23:05:28 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 246)=>[Subject: Notizie di Trasmutazione Maggio 2006-S][Date: Mon, 1 May 2006 23:05:28 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 246)=>[Subject: Notizie di Trasmutazione Maggio 2006-S][Date: Mon, 1 May 2006 23:05:28 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 247)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 247)=>[Subject: cambio insegnante][Date: Wed, 03 May 2006 10:53:00 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 247)=>[Subject: cambio insegnante][Date: Wed, 03 May 2006 10:53:00 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 247)=>[Subject: cambio insegnante][Date: Wed, 03 May 2006 10:53:00 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 247)=>[Subject: cambio insegnante][Date: Wed, 03 May 2006 10:53:00 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 247)=>[Subject: cambio insegnante][Date: Wed, 03 May 2006 10:53:00 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 248)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 248)=>[Subject: Guarigione Sciamanica ed Estrazione, 9][Date: Wed, 3 May 2006 19:16:37 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 248)=>[Subject: Guarigione Sciamanica ed Estrazione, 9][Date: Wed, 3 May 2006 19:16:37 +0200]=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 248)=>[Subject: Guarigione Sciamanica ed Estrazione, 9][Date: Wed, 3 May 2006 19:16:37 +0200]=>(MIME part)=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 248)=>[Subject: Guarigione Sciamanica ed Estrazione, 9][Date: Wed, 3 May 2006 19:16:37 +0200]=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 248)=>[Subject: Guarigione Sciamanica ed Estrazione, 9][Date: Wed, 3 May 2006 19:16:37 +0200]=>(MIME part)=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 248)=>[Subject: Guarigione Sciamanica ed Estrazione, 9][Date: Wed, 3 May 2006 19:16:37 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 248)=>[Subject: Guarigione Sciamanica ed Estrazione, 9][Date: Wed, 3 May 2006 19:16:37 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 248)=>[Subject: Guarigione Sciamanica ed Estrazione, 9][Date: Wed, 3 May 2006 19:16:37 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 249)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 249)=>[Subject: Newsletter maggio 2006][Date: Wed, 03 May 2006 21:56:06 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 249)=>[Subject: Newsletter maggio 2006][Date: Wed, 03 May 2006 21:56:06 +0200]=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 249)=>[Subject: Newsletter maggio 2006][Date: Wed, 03 May 2006 21:56:06 +0200]=>(MIME part)=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 249)=>[Subject: Newsletter maggio 2006][Date: Wed, 03 May 2006 21:56:06 +0200]=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 249)=>[Subject: Newsletter maggio 2006][Date: Wed, 03 May 2006 21:56:06 +0200]=>(MIME part)=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 249)=>[Subject: Newsletter maggio 2006][Date: Wed, 03 May 2006 21:56:06 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 249)=>[Subject: Newsletter maggio 2006][Date: Wed, 03 May 2006 21:56:06 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 249)=>[Subject: Newsletter maggio 2006][Date: Wed, 03 May 2006 21:56:06 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 250)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 250)=>[Subject: Pizza fine anno][Date: Thu, 04 May 2006 10:35:00 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 250)=>[Subject: Pizza fine anno][Date: Thu, 04 May 2006 10:35:00 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 250)=>[Subject: Pizza fine anno][Date: Thu, 04 May 2006 10:35:00 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 250)=>[Subject: Pizza fine anno][Date: Thu, 04 May 2006 10:35:00 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 250)=>[Subject: Pizza fine anno][Date: Thu, 04 May 2006 10:35:00 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 251)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 251)=>[Subject: =?iso-8859-1?Q?Rettifica_appuntamento_][Date: Thu, 4 May 2006 17:01:17 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 251)=>[Subject: =?iso-8859-1?Q?Rettifica_appuntamento_][Date: Thu, 4 May 2006 17:01:17 +0200]=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 251)=>[Subject: =?iso-8859-1?Q?Rettifica_appuntamento_][Date: Thu, 4 May 2006 17:01:17 +0200]=>(MIME part)=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 251)=>[Subject: =?iso-8859-1?Q?Rettifica_appuntamento_][Date: Thu, 4 May 2006 17:01:17 +0200]=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 251)=>[Subject: =?iso-8859-1?Q?Rettifica_appuntamento_][Date: Thu, 4 May 2006 17:01:17 +0200]=>(MIME part)=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 251)=>[Subject: =?iso-8859-1?Q?Rettifica_appuntamento_][Date: Thu, 4 May 2006 17:01:17 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 251)=>[Subject: =?iso-8859-1?Q?Rettifica_appuntamento_][Date: Thu, 4 May 2006 17:01:17 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 251)=>[Subject: =?iso-8859-1?Q?Rettifica_appuntamento_][Date: Thu, 4 May 2006 17:01:17 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 252)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 252)=>[Subject: cena][Date: Fri, 05 May 2006 10:37:00 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 252)=>[Subject: cena][Date: Fri, 05 May 2006 10:37:00 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 252)=>[Subject: cena][Date: Fri, 05 May 2006 10:37:00 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 252)=>[Subject: cena][Date: Fri, 05 May 2006 10:37:00 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 252)=>[Subject: cena][Date: Fri, 05 May 2006 10:37:00 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 253)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 253)=>[Subject: Biglietti ridotti per Far Veleno al Cu][Date: Sat, 6 May 2006 20:20:36 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 253)=>[Subject: Biglietti ridotti per Far Veleno al Cu][Date: Sat, 6 May 2006 20:20:36 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 253)=>[Subject: Biglietti ridotti per Far Veleno al Cu][Date: Sat, 6 May 2006 20:20:36 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 253)=>[Subject: Biglietti ridotti per Far Veleno al Cu][Date: Sat, 6 May 2006 20:20:36 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 253)=>[Subject: Biglietti ridotti per Far Veleno al Cu][Date: Sat, 6 May 2006 20:20:36 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 254)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 254)=>[Subject: Incontro domenica 14 Maggio sui Passi ][Date: Sun, 7 May 2006 21:07:55 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 254)=>[Subject: Incontro domenica 14 Maggio sui Passi ][Date: Sun, 7 May 2006 21:07:55 +0200]=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 254)=>[Subject: Incontro domenica 14 Maggio sui Passi ][Date: Sun, 7 May 2006 21:07:55 +0200]=>(MIME part)=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 254)=>[Subject: Incontro domenica 14 Maggio sui Passi ][Date: Sun, 7 May 2006 21:07:55 +0200]=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 254)=>[Subject: Incontro domenica 14 Maggio sui Passi ][Date: Sun, 7 May 2006 21:07:55 +0200]=>(MIME part)=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 254)=>[Subject: Incontro domenica 14 Maggio sui Passi ][Date: Sun, 7 May 2006 21:07:55 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 254)=>[Subject: Incontro domenica 14 Maggio sui Passi ][Date: Sun, 7 May 2006 21:07:55 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 254)=>[Subject: Incontro domenica 14 Maggio sui Passi ][Date: Sun, 7 May 2006 21:07:55 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 255)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 255)=>[Subject: Cerchio sciamanico Sabato 13 Maggio al][Date: Sun, 7 May 2006 21:15:23 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 255)=>[Subject: Cerchio sciamanico Sabato 13 Maggio al][Date: Sun, 7 May 2006 21:15:23 +0200]=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 255)=>[Subject: Cerchio sciamanico Sabato 13 Maggio al][Date: Sun, 7 May 2006 21:15:23 +0200]=>(MIME part)=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 255)=>[Subject: Cerchio sciamanico Sabato 13 Maggio al][Date: Sun, 7 May 2006 21:15:23 +0200]=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 255)=>[Subject: Cerchio sciamanico Sabato 13 Maggio al][Date: Sun, 7 May 2006 21:15:23 +0200]=>(MIME part)=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 255)=>[Subject: Cerchio sciamanico Sabato 13 Maggio al][Date: Sun, 7 May 2006 21:15:23 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 255)=>[Subject: Cerchio sciamanico Sabato 13 Maggio al][Date: Sun, 7 May 2006 21:15:23 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 255)=>[Subject: Cerchio sciamanico Sabato 13 Maggio al][Date: Sun, 7 May 2006 21:15:23 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 256)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 256)=>[Subject: invio ricetta.][Date: Tue, 9 May 2006 13:20:42 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 256)=>[Subject: invio ricetta.][Date: Tue, 9 May 2006 13:20:42 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 256)=>[Subject: invio ricetta.][Date: Tue, 9 May 2006 13:20:42 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 256)=>[Subject: invio ricetta.][Date: Tue, 9 May 2006 13:20:42 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 256)=>[Subject: invio ricetta.][Date: Tue, 9 May 2006 13:20:42 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 257)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 257)=>[Subject: Saggio Elena][Date: Tue, 9 May 2006 17:44:38 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 257)=>[Subject: Saggio Elena][Date: Tue, 9 May 2006 17:44:38 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 257)=>[Subject: Saggio Elena][Date: Tue, 9 May 2006 17:44:38 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 257)=>[Subject: Saggio Elena][Date: Tue, 9 May 2006 17:44:38 +0200]=>(MIME part)=>SDOC8635.pdf

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 257)=>[Subject: Saggio Elena][Date: Tue, 9 May 2006 17:44:38 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 257)=>[Subject: Saggio Elena][Date: Tue, 9 May 2006 17:44:38 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 257)=>[Subject: Saggio Elena][Date: Tue, 9 May 2006 17:44:38 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 258)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 258)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 10 May 2006 23:20:40 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 258)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 10 May 2006 23:20:40 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 258)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 10 May 2006 23:20:40 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 258)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 10 May 2006 23:20:40 +0200]=>(MIME part)=>(message)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 258)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 10 May 2006 23:20:40 +0200]=>(MIME part)=>(message)=>[Subject: Varie bambine][Date: Wed, 10 May 2006 23:20:28 +0200]=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 258)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 10 May 2006 23:20:40 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 259)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 259)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 10 May 2006 23:24:30 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 259)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 10 May 2006 23:24:30 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 259)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 10 May 2006 23:24:30 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 259)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 10 May 2006 23:24:30 +0200]=>(MIME part)=>(message)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 259)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 10 May 2006 23:24:30 +0200]=>(MIME part)=>(message)=>[Subject: Re: invio ricetta.][Date: Wed, 10 May 2006 23:24:08 +0200]=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 259)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 10 May 2006 23:24:30 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 260)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 260)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 10 May 2006 23:30:13 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 260)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 10 May 2006 23:30:13 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 260)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 10 May 2006 23:30:13 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 260)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 10 May 2006 23:30:13 +0200]=>(MIME part)=>(message)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 260)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 10 May 2006 23:30:13 +0200]=>(MIME part)=>(message)=>[Subject: Varie bambine][Date: Wed, 10 May 2006 23:30:10 +0200]=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 260)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 10 May 2006 23:30:13 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 261)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 261)=>[Subject: invio nominativo rivenditore prodotti ][Date: Thu, 11 May 2006 09:18:37 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 261)=>[Subject: invio nominativo rivenditore prodotti ][Date: Thu, 11 May 2006 09:18:37 +0200]=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 261)=>[Subject: invio nominativo rivenditore prodotti ][Date: Thu, 11 May 2006 09:18:37 +0200]=>(MIME part)=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 261)=>[Subject: invio nominativo rivenditore prodotti ][Date: Thu, 11 May 2006 09:18:37 +0200]=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 261)=>[Subject: invio nominativo rivenditore prodotti ][Date: Thu, 11 May 2006 09:18:37 +0200]=>(MIME part)=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 261)=>[Subject: invio nominativo rivenditore prodotti ][Date: Thu, 11 May 2006 09:18:37 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 261)=>[Subject: invio nominativo rivenditore prodotti ][Date: Thu, 11 May 2006 09:18:37 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 261)=>[Subject: invio nominativo rivenditore prodotti ][Date: Thu, 11 May 2006 09:18:37 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 262)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 262)=>[Subject: Undelivered Mail Returned to Sender][Date: Thu, 11 May 2006 10:23:22 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 262)=>[Subject: Undelivered Mail Returned to Sender][Date: Thu, 11 May 2006 10:23:22 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 262)=>[Subject: Undelivered Mail Returned to Sender][Date: Thu, 11 May 2006 10:23:22 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 262)=>[Subject: Undelivered Mail Returned to Sender][Date: Thu, 11 May 2006 10:23:22 +0200]=>(MIME part)=>(message)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 262)=>[Subject: Undelivered Mail Returned to Sender][Date: Thu, 11 May 2006 10:23:22 +0200]=>(MIME part)=>(message)=>[Subject: Varie bambine][Date: Thu, 11 May 2006 10:23:17 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 262)=>[Subject: Undelivered Mail Returned to Sender][Date: Thu, 11 May 2006 10:23:22 +0200]=>(MIME part)=>(message)=>[Subject: Varie bambine][Date: Thu, 11 May 2006 10:23:17 +0200]=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 262)=>[Subject: Undelivered Mail Returned to Sender][Date: Thu, 11 May 2006 10:23:22 +0200]=>(MIME part)=>(message)=>[Subject: Varie bambine][Date: Thu, 11 May 2006 10:23:17 +0200]=>(MIME part)=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 262)=>[Subject: Undelivered Mail Returned to Sender][Date: Thu, 11 May 2006 10:23:22 +0200]=>(MIME part)=>(message)=>[Subject: Varie bambine][Date: Thu, 11 May 2006 10:23:17 +0200]=>(MIME part)=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 262)=>[Subject: Undelivered Mail Returned to Sender][Date: Thu, 11 May 2006 10:23:22 +0200]=>(MIME part)=>(message)=>[Subject: Varie bambine][Date: Thu, 11 May 2006 10:23:17 +0200]=>(MIME part)=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 262)=>[Subject: Undelivered Mail Returned to Sender][Date: Thu, 11 May 2006 10:23:22 +0200]=>(MIME part)=>(message)=>[Subject: Varie bambine][Date: Thu, 11 May 2006 10:23:17 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 262)=>[Subject: Undelivered Mail Returned to Sender][Date: Thu, 11 May 2006 10:23:22 +0200]=>(MIME part)=>(message)=>[Subject: Varie bambine][Date: Thu, 11 May 2006 10:23:17 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 262)=>[Subject: Undelivered Mail Returned to Sender][Date: Thu, 11 May 2006 10:23:22 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 263)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 263)=>[Subject: Undelivered Mail Returned to Sender][Date: Thu, 11 May 2006 10:25:05 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 263)=>[Subject: Undelivered Mail Returned to Sender][Date: Thu, 11 May 2006 10:25:05 +0200]=>(MIME part)=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 263)=>[Subject: Undelivered Mail Returned to Sender][Date: Thu, 11 May 2006 10:25:05 +0200]=>(MIME part)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 263)=>[Subject: Undelivered Mail Returned to Sender][Date: Thu, 11 May 2006 10:25:05 +0200]=>(MIME part)=>(message)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Profiles\default\d260wxsr.slt\Mail old\mail.interfree-1.it\Inbox=>(message 263)=>[Subject: Undelivered Mail Returned to Sender][Date: Thu, 11 May 2006 10:25:05 +0200]=>(MIME part)=>(message)=>[Subject: ricetta][Date: Thu, 11 May 2006 10:25:04 +0200]=>(message body)

Clean
C:\Documents and Settings\tutto\Dati applicazioni\Thunderbird\Prof