Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 


Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads
Reload this Page Popups from Heavy.com and partypoker.com and others
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read


Resolved HJT Threads Resolved spyware and popup issues.

 
 
LinkBack Thread Tools
Old 08-29-2006, 06:36 AM   #1 (permalink)
Registered User
 
Join Date: Aug 2006
Posts: 5
OS: Windows XP


Popups from Heavy.com and partypoker.com and others
I was attacked by malware/adware the other day and have run Norton, Spy Sweeper and Ewido and they have removed quite a few infections but I am still having problems with popups from places like heavy.com and partypoker. com and many others and occasionally my internet explorer just shuts down. In addition my system seems to be running very slow and keeps freezing up. Any help would be greatly appreciated :) Here is my HijackThis log...


Logfile of HijackThis v1.99.1
Scan saved at 8:19:09 AM, on 8/29/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\COMMON~1\AOL\113517~1\EE\AOLHOS~1.EXE
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\COMMON~1\AOL\113517~1\EE\AOLServiceHost.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\BigFix\BigFix.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\ICQLite\ICQLite.exe
F:\My Documents\Installers\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Messenger\msmsgs.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.weather.com/weather/local...from=whatwhere
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSL encrypt - {746455FE-D059-47e7-AF0E-140E03F5A447} - C:\WINDOWS\system32\nsa7B4.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1135175064\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Norton AntiVirus\CfgWiz.exe" /GUID {0D7956A2-5A08-4ec2-A72C-DF8495A66016} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.sxload.com
O16 - DPF: {09F1ADAC-76D8-4D0F-99A5-5C907DADB988} - http://www.systemdoctor.com/download...reeInstall.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache...up1.0.0.15.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/40...02/Coupons.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} (CGameManagerCtrl Object) - https://disney.go.com/games/download...ameManager.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - mk:@MSITStore:C:\DOCUME~1\Owner\LOCALS~1\Temp\winfix.chm::/SystemDoctor2006FreeInstall.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
chelle0372 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Important Information
Join the #1 Tech Support Forum Today - It's Totally Free!

TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free.

Join TechSupportforum.com Today - Click Here

Old 08-29-2006, 04:02 PM   #2 (permalink)
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
 
Glaswegian's Avatar
 
Join Date: Sep 2005
Location: Glasgow
Posts: 25,488
OS: Win XP Pro SP3 / Win 7 Pro

My System

Blog Entries: 10
Hi chelle0372 and welcome to TSF.

You may wish to Subscribe to this thread (Thread Tools) so that you are notified when you receive a reply.


Please read these instructions carefully and then print out or copy this page to Notepad in order to assist you when carrying out the fix. You should not have any open browsers when you are following the procedures below.

Note that the fix may take several posts. Please continue to respond to my instructions until I confirm that your system is clean.


Show Hidden Files
Go to My Computer > Tools > Folder Options > View tab and make sure that Show hidden files and folders is enabled. Also make sure that the System files and Folders are showing / visible. Uncheck the Hide protected operating system files option.



Disable EwidoGuard
Please disable Ewido Anti-Malware's Guard, as it may hinder the removal of some entries. You can re-enable it after you're clean.
  • Double-click the icon on Desktop to launch Ewido
  • On the top of the main screen click Shield
  • Click the word active to change it to inactive
  • Exit Ewido



Disable Webroot SpySweeper
Please disable Webroot SpySweeper, as it may hinder the removal of some entries. You can re-enable it after you're clean.
To disable Webroot SpySweeper:
  • Go to the Options > Program Options
  • Uncheck Load at Windows Startup
  • Click Shields & uncheck all items there
  • Uncheck Home page shield.
  • Automatically restore default without notification
  • Exit the program.



Downloads
Please download Cleanup! or use this Alternate Link if the main link does not work and install it. You will use this later.
*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does NOT make backups. If you have any files in any TEMP directory and you need to keep them, then please MOVE THEM NOW!


I see you already have Ewido. Please update Ewido to the latest definition files.
  • Double-click the icon on Desktop to launch Ewido
  • On the top of the main screen click Update.
  • Then click on Start Update.
    The update will start and a progress bar will show the updates being installed.

If you are having problems with the updater, you can use this link to manually update Ewido.
When you have finished updating, EXIT Ewido.



Reboot
Reboot your system in Safe Mode.
  • Restart the computer. The computer begins processing a set of instructions known as BIOS.
  • After hearing your computer beep once during startup, but before the Windows icon appears, press F8 (dependent on your system this may be F5 or another key)
  • Instead of Windows loading as normal, a menu should appear
  • Use the arrow key to highlight Safe Mode and press Enter.



Uninstall Programmes
Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs (if present):

Weather or WeatherBug



HijackThis Entries
Open Hijack This and click on Scan. Check the following entries (if they still exist) (make sure you do not miss any)

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: SSL encrypt - {746455FE-D059-47e7-AF0E-140E03F5A447} - C:\WINDOWS\system32\nsa7B4.dll
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe
O15 - Trusted Zone: *.sxload.com
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache...up1.0.0.15.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/40...02/Coupons.cab
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - mk:@MSITStore:C:\DOCUME~1\Owner\LOCALS~1\Temp\winf ix.chm::/SystemDoctor2006FreeInstall.cab
The following entries are not needed at start up and can be accessed via Start > All programs – most are just resource hogs.
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe

Please remember to close all other windows, including browsers then click Fix checked.




File Deletions
Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

C:\WINDOWS\system32\nsa7B4.dll
C:\Program Files\AWS




Run CleanUp!
*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does NOT make backups. If you have any files in any TEMP directory and you need to keep them, then please MOVE THEM NOW!

Open Cleanup! by double-clicking the icon on your desktop (or from Start > All Programs). Set the program up as follows:

Click Options
Move the slider button down to Custom CleanUp!
Check the following:
  • Empty Recycle Bins
  • Delete Cookies
  • Delete Prefetch files
  • Cleanup! All Users
  • Click on the “Temporary Files” tab and uncheck the box for “Scan drives for file matching” if it’s checked.

Click OK, Press the CleanUp! button to start the program and DO NOT REBOOT when prompted.
Note: CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these BEFORE running CleanUp! If you have a 64 bit Operating System do NOT run Cleanup and let me know as we will use another utility.




Run Ewido
Run Ewido with it's updated definitions:(...it's important that all windows must be closed)
  • Click Scanner
  • Click on the Scan tab
  • Click Complete System Scan to begin scanning.
  • When the scan is complete click Recommended Action and change it to Quarantine
  • Then click Apply all actions
Once finished, click the Save report button, then click Save Report As and save it to your desktop.

NOTE: Ewido scan may require an hour.



Reboot
Reboot your system in Normal Mode.



Online Scan

Perform an online scan with Internet Explorer with Panda ActiveScan

Click on the "Free To Use ActiveScan" located on the top right hand corner.

1. Click Check Now and a "pop up" window will appear. *Please ensure that your pop up blocker doesn't block it *
2. Enter your e-mail address, country, and state & click Scan Now * The download of the 8 MB Panda's ActiveX control will take place *

Begin the scan by selecting My Computer
  • If it finds any malware, it will offer you a report.
  • Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
  • Click on See report then click Save report

*You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
*Turn off the real time scanner of any existing antivirus program while performing the online scan




Logs required
Ewido Log
Panda Log
HijackThis Log

Please also let me know how your system is performing now and if you have any specific problems.
__________________
Iain - Defender of the Haggis and all things Scottish.
I don't help by PM - post in the Forums.



PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner
Glaswegian is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-30-2006, 10:15 AM   #3 (permalink)
Registered User
 
Join Date: Aug 2006
Posts: 5
OS: Windows XP


This may sound dumb but how do I know if I am running a 64 bit OS? I have an Emachine T3414 running Windows XP.
chelle0372 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-30-2006, 01:39 PM   #4 (permalink)
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
 
Glaswegian's Avatar
 
Join Date: Sep 2005
Location: Glasgow
Posts: 25,488
OS: Win XP Pro SP3 / Win 7 Pro

My System

Blog Entries: 10
If you don't know then you probably won't have a 64bit OS. However, you can check using IE to download this script and then running it.
__________________
Iain - Defender of the Haggis and all things Scottish.
I don't help by PM - post in the Forums.



PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner
Last edited by Glaswegian; 08-30-2006 at 01:42 PM.
Glaswegian is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-30-2006, 06:08 PM   #5 (permalink)
Registered User
 
Join Date: Aug 2006
Posts: 5
OS: Windows XP


Ok I have run everything and here are the new logs...My system seems to be running faster now.

Ewido

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 5:29:37 PM 8/30/2006

+ Scan result:



F:\My Documents\Installers\backups\backup-20060830-133319-112.dll -> Adware.Coupons : No action taken.


::Report end




Panda


Incident Status Location

Potentially unwanted tool:application/funweb Not disinfected c:\program files\FunWebProducts
Potentially unwanted tool:application/mywebsearch Not disinfected c:\program files\MyWebSearch
Dialer:dialer.su Not disinfected hkey_local_machine\software\microsoft\windows\currentversion\uninstall\Switch
Spyware:spyware/media-motor Not disinfected Windows Registry
Adware:adware/adrotator Not disinfected Windows Registry
Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\Owner\Cookies\owner@ads.addynamix[1].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Owner\Cookies\owner@atdmt[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Owner\Cookies\owner@doubleclick[1].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Owner\Cookies\owner@mediaplex[1].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Owner\Cookies\owner@tribalfusion[2].txt

HijackThis

Logfile of HijackThis v1.99.1
Scan saved at 8:01:58 PM, on 8/30/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\COMMON~1\AOL\113517~1\EE\AOLHOS~1.EXE
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Trillian\trillian.exe
C:\PROGRA~1\COMMON~1\AOL\113517~1\EE\AOLServiceHost.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Messenger\msmsgs.exe
F:\My Documents\Installers\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.weather.com/weather/local...from=whatwhere
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1135175064\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Norton AntiVirus\CfgWiz.exe" /GUID {0D7956A2-5A08-4ec2-A72C-DF8495A66016} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {09F1ADAC-76D8-4D0F-99A5-5C907DADB988} - http://www.systemdoctor.com/download...reeInstall.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} (CGameManagerCtrl Object) - https://disney.go.com/games/download...ameManager.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
chelle0372 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-31-2006, 01:41 PM   #6 (permalink)
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
 
Glaswegian's Avatar
 
Join Date: Sep 2005
Location: Glasgow
Posts: 25,488
OS: Win XP Pro SP3 / Win 7 Pro

My System

Blog Entries: 10
Hi again

Looking better.

Incredimail is resource hog as well – and not very private. I used to have a couple of links but they basically can do anything with any e-mail you send using their software. Try something like Thunderbird.


Clear your IE cookies. Start > Settings > Control Panel > Internet Options > General tab > under Temporary files, click on Delete Cookies.


Please delete the following files/folders (if they still exist)

F:\My Documents\Installers\backups\ backup-20060830-133319-112.dll
c:\program files\ FunWebProducts
c:\program files\ MyWebSearch

Note: if they resist, you may need to boot to Safe Mode to delete them.


Let’s do another online scan.

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky WebScanner

Next Click on Launch Kaspersky Anti-Virus Web Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
Scan using the following Anti-Virus database:
  • Extended
Scan Options:
  • Scan Archives
  • Scan Mail Bases
Click OK

Now under select a target to scan: Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post.
Take note of the name(s) and location(s) of any file(s) it detects but fails to clean.

* Turn off the real time scanner of any existing antivirus program while performing the online scan


Please post back with the Kaspersky Log and a fresh HijackThis Log. Please also let me know how your system is performing now and if you have any specific problems.
__________________
Iain - Defender of the Haggis and all things Scottish.
I don't help by PM - post in the Forums.



PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner
Glaswegian is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 09-01-2006, 08:24 PM   #7 (permalink)
Registered User
 
Join Date: Aug 2006
Posts: 5
OS: Windows XP


OK back on track...we had a power outage in the middle of my Kaspersky Scan so I had to start all over!! Took over 4 hrs for the scan...Here are the new logs.

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Friday, September 01, 2006 10:13:48 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 1/09/2006
Kaspersky Anti-Virus database records: 220165
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\
L:\

Scan Statistics:
Total number of scanned objects: 338088
Number of viruses found: 25
Number of infected objects: 86 / 0
Number of suspicious objects: 0
Duration of the scan process: 04:41:13

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\AOL\TopSpeed\2.0\aolstderr.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\TopSpeed\2.0\aolstdout.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\TopSpeed\2.0\cache.db Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\TopSpeed\2.0\server.lock Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\HPPAppActivity.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\HPPHomePageActivity.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2006-09-01_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\27FF79E0.exe Infected: Worm.Win32.VB.an skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\38A713D6.zip/1.wmv Infected: Trojan-Downloader.WMA.Wimad.d skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\38A713D6.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\38A713D6.zip CryptFF: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3DCF40BF.exe Infected: Trojan-Downloader.Win32.VB.wz skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\47B82FD6.exe Infected: not-a-virus:AdWare.Win32.MediaMotor.l skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\53823ADE.exe Infected: Trojan-Downloader.Win32.VB.wz skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5F953669.exe Infected: Worm.Win32.VB.an skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\69E00D64.dll Infected: not-a-virus:AdWare.Win32.Mirar.a skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6B7C37A0.exe Infected: Trojan-Downloader.Win32.Dyfuca.ey skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6BF87317.ocx Infected: not-a-virus:AdWare.Win32.MediaMotor.p skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6C156CF7.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\78B55E32.tmp Infected: Worm.Win32.VB.an skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Application Data\Symantec\PendingAlertsQueue.log Object is locked skipped
C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012006090120060902\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temp\~DF6DCC.tmp Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temp\~DF6DDF.tmp Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temp\~DF775E.tmp Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg2.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMNot.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMReg.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMRSt.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped
C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked skipped
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\BWKDLogs\BWTargetInf.log Object is locked skipped
C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\chandir.dat Object is locked skipped
C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\chandir.idx Object is locked skipped
C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\chn.dat Object is locked skipped
C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\chn.idx Object is locked skipped
C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\D0000000.FCS Object is locked skipped
C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\inuse.txt Object is locked skipped
C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\L0000010.FCS Object is locked skipped
C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\main.log Object is locked skipped
C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs.dat Object is locked skipped
C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs.idx Object is locked skipped
C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_die.dat Object is locked skipped
C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_die.idx Object is locked skipped
C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_dnd.dat Object is locked skipped
C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_dnd.idx Object is locked skipped
C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_ext.dat Object is locked skipped
C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_ext.idx Object is locked skipped
C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_rcv.dat Object is locked skipped
C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_rcv.idx Object is locked skipped
C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\storydb.dat Object is locked skipped
C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\storydb.idx Object is locked skipped
C:\Program Files\Norton AntiVirus\AVApp.log Object is locked skipped
C:\Program Files\Norton AntiVirus\AVError.log Object is locked skipped
C:\Program Files\Norton AntiVirus\AVVirus.log Object is locked skipped
C:\Program Files\Norton AntiVirus\Savrt\0465NAV~.TMP Object is locked skipped
C:\Program Files\Norton AntiVirus\Savrt\0685NAV~.TMP Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP180\A0029974.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP180\A0029975.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP180\A0029984.ocx Infected: not-a-virus:AdWare.Win32.MediaMotor.p skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP180\A0029985.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0029988.exe/data.rar/WhAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.351 skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0029988.exe/data.rar/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0029988.exe/data.rar/WhSurvey.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0029988.exe/data.rar/Webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0029988.exe/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0029988.exe/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0029988.exe RarSFX: infected - 6 skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0029992.exe Infected: not-a-virus:AdWare.Win32.WebHancer.351 skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0029993.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0029994.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0029997.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0029998.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0029999.exe Infected: Trojan-Downloader.Win32.Dyfuca.ey skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030000.exe Infected: not-a-virus:AdWare.Win32.MediaMotor.o skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030001.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030004.exe Infected: Trojan-Downloader.Win32.Dyfuca.ey skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030066.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030068.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030078.ocx Infected: not-a-virus:AdWare.Win32.MediaMotor.p skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030079.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030081.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030202.exe Infected: Trojan-Downloader.Win32.VB.wz skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030206.exe Infected: not-a-virus:AdWare.Win32.MediaMotor.l skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030207.dll Infected: not-a-virus:AdWare.Win32.Mirar.a skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030208.dll Infected: not-a-virus:AdWare.Win32.Mirar.a skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030209.dll Infected: not-a-virus:AdWare.Win32.Mirar.e skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030210.exe Infected: not-a-virus:AdWare.Win32.SaveNow.bj skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030211.exe Infected: not-a-virus:AdWare.Win32.SaveNow.bj skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030212.exe Infected: Trojan-Downloader.Win32.Dyfuca.ey skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030213.dll Infected: Trojan-Downloader.Win32.Dyfuca.gen skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030214.exe Infected: not-a-virus:AdWare.Win32.MediaMotor.o skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030215.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030216.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030217.exe Infected: not-a-virus:AdWare.Win32.WebHancer.351 skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030218.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030219.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030220.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030221.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030222.exe/data.rar/WhAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.351 skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030222.exe/data.rar/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030222.exe/data.rar/WhSurvey.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030222.exe/data.rar/Webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030222.exe/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030222.exe/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP181\A0030222.exe RarSFX: infected - 6 skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP183\A0031284.dll Infected: not-a-virus:AdWare.Win32.TrafficSol.c skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP189\A0033550.ocx Infected: not-a-virus:AdWare.Win32.Coupons.h skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP191\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
F:\64d4d5dfa35fa602f087e799c3\sp1\lsasrv.dll Object is locked skipped
F:\My Documents\Angie Stuff\Skins\ICQ Skins\17614.exe/WISE0015.BIN Infected: not-a-virus:AdWare.Win32.IGetNet skipped
F:\My Documents\Angie Stuff\Skins\ICQ Skins\17614.exe WiseSFX: infected - 1 skipped
F:\My Documents\Angie Stuff\Skins\ICQ Skins\angelinajolie15.exe/WISE0018.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
F:\My Documents\Angie Stuff\Skins\ICQ Skins\angelinajolie15.exe WiseSFX: infected - 1 skipped
F:\My Documents\Incredimail\315.exe/WISE0019.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
F:\My Documents\Incredimail\315.exe/WISE0020.BIN Infected: not-a-virus:AdWare.Win32.Gator.3103 skipped
F:\My Documents\Incredimail\315.exe/WISE0021.BIN Infected: not-a-virus:AdWare.Win32.EZula.z skipped
F:\My Documents\Incredimail\315.exe/WISE0022.BIN Infected: Trojan-Dropper.Win32.Agent.pd skipped
F:\My Documents\Incredimail\315.exe WiseSFX: infected - 4 skipped
F:\My Documents\Kate Stuff\kate2ss.exe/WISE0017.BIN Infected: not-a-virus:AdTool.Win32.WhenU.a skipped
F:\My Documents\Kate Stuff\kate2ss.exe/WISE0018.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
F:\My Documents\Kate Stuff\kate2ss.exe/WISE0019.BIN/WISE0001.BIN Infected: not-a-virus:AdWare.Win32.Accoona.b skipped
F:\My Documents\Kate Stuff\kate2ss.exe/WISE0019.BIN Infected: not-a-virus:AdWare.Win32.Accoona.b skipped
F:\My Documents\Kate Stuff\kate2ss.exe/WISE0020.BIN Infected: Trojan-Downloader.Win32.Small.bke skipped
F:\My Documents\Kate Stuff\kate2ss.exe/WISE0021.BIN/data0002 Infected: not-a-virus:AdTool.Win32.WebRebates.r skipped
F:\My Documents\Kate Stuff\kate2ss.exe/WISE0021.BIN/data0003 Infected: not-a-virus:AdWare.Win32.WebRebates.p skipped
F:\My Documents\Kate Stuff\kate2ss.exe/WISE0021.BIN/data0004 Infected: not-a-virus:AdWare.Win32.WebRebates.p skipped
F:\My Documents\Kate Stuff\kate2ss.exe/WISE0021.BIN/data0005 Infected: not-a-virus:AdWare.Win32.WebRebates.p skipped
F:\My Documents\Kate Stuff\kate2ss.exe/WISE0021.BIN Infected: not-a-virus:AdWare.Win32.WebRebates.p skipped
F:\My Documents\Kate Stuff\kate2ss.exe WiseSFX: infected - 10 skipped
F:\My Documents\Kate Stuff\kate2ss.exe WiseSFX Dropper: infected - 10 skipped
F:\RECYCLER\S-1-5-21-3140988423-3360265237-1532863237-1003\Df1.dll Infected: not-a-virus:AdWare.Win32.Coupons.h skipped
F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP38\A0010945.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP38\A0010946.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP38\A0010947.sys Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP38\A0010948.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP38\A0010949.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP38\A0010950.ver Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP38\A0010951.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP38\A0010952.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP38\A0010953.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP38\A0010954.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP38\A0010955.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP38\A0010956.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP38\A0010957.ver Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP38\A0010958.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP38\A0010959.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP38\A0010960.sys Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP38\A0010961.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP38\A0010962.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP38\A0010963.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP38\A0010964.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP38\A0010965.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP39\A0010973.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP39\A0010974.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP39\A0010975.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP39\A0010976.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP39\A0010977.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP39\A0010978.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP39\A0010979.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP39\A0010980.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP39\A0010981.ver Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP39\A0010982.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP39\A0010983.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP39\A0010984.sys Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP39\A0010985.ver Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP39\A0010986.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP39\A0010987.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP39\A0010988.sys Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP39\A0010989.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP39\A0010990.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP39\A0010991.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP39\A0010992.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP39\A0010993.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP40\A0011001.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP40\A0011002.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP40\A0011003.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP40\A0011004.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP40\A0011005.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP40\A0011006.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP40\A0011007.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP40\A0011008.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP40\A0011009.ver Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP40\A0011010.ver Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP40\A0011011.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP40\A0011012.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP40\A0011013.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP40\A0011014.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP40\A0011015.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP40\A0011016.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP40\A0011017.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP40\A0011018.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP40\A0011019.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP40\A0011020.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP40\A0011021.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011035.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011036.ocx Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011037.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011038.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011039.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011040.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011041.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011042.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011043.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011044.ver Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011045.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011046.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011047.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011048.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011049.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011050.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011051.ver Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011052.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011053.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011054.ocx Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011055.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011056.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011057.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011058.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011059.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011060.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011061.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011062.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP41\A0011063.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP42\A0011071.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP42\A0011072.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP42\A0011073.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP42\A0011074.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP42\A0011075.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP42\A0011076.ver Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP42\A0011077.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP42\A0011078.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP42\A0011079.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP42\A0011080.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP42\A0011081.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP42\A0011082.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP42\A0011083.ver Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP42\A0011084.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP42\A0011085.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP42\A0011086.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP42\A0011087.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP42\A0011088.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP42\A0011089.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP42\A0011090.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP42\A0011091.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP43\A0011098.sys Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP43\A0011099.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP43\A0011100.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP43\A0011101.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP43\A0011102.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP43\A0011103.ver Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP43\A0011104.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP43\A0011105.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP43\A0011106.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP43\A0011107.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP43\A0011108.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP43\A0011109.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP43\A0011110.ver Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP43\A0011111.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP43\A0011112.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP43\A0011113.sys Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP43\A0011114.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP43\A0011115.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP43\A0011116.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP43\A0011117.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP43\A0011118.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP44\A0011144.ver Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP44\A0011145.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP44\A0011146.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP44\A0011147.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP44\A0011148.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP44\A0011149.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP44\A0011150.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP44\A0011151.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP44\A0011152.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP44\A0011153.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP44\A0011154.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP44\A0011155.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP44\A0011156.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP44\A0011157.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP44\A0011158.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP44\A0011159.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP44\A0011160.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP44\A0011161.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP44\A0011162.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP44\A0011163.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP45\A0011172.ver Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP45\A0011173.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP45\A0011174.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP45\A0011175.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP45\A0011176.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP45\A0011177.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP45\A0011178.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP45\A0011179.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP45\A0011180.cnv Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP46\A0011188.TTF Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP46\A0011189.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP46\A0011190.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP46\A0011191.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP46\A0011192.CAT Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP46\A0011193.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP46\A0011194.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP46\A0011195.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP46\A0011196.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP46\A0011197.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP46\A0011198.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP46\A0011199.ver Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP48\A0011349.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP48\A0011350.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP48\A0011351.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP48\A0011352.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP48\A0011353.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP48\A0011354.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP48\A0011355.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP48\A0011356.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP48\A0011357.ver Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP48\A0011358.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP48\A0011359.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP48\A0011360.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP48\A0011361.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP48\A0011362.ver Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP48\A0011363.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP48\A0011364.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP48\A0011365.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP48\A0011366.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP48\A0011367.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP48\A0011368.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP48\A0011369.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP48\A0011370.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP48\A0011371.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011420.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011421.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011422.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011423.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011424.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011425.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011426.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011427.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011428.ver Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011429.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011430.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011431.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011432.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011433.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011434.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011435.ver Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011436.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011437.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011438.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011439.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011440.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011441.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011442.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011443.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011444.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011445.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP49\A0011446.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011487.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011488.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011489.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011490.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011491.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011492.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011493.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011494.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011495.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011496.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011497.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011498.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011499.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011500.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011501.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011502.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011503.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011504.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011505.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011506.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011507.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011508.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011509.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011510.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011511.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011512.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011513.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011514.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011515.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011516.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011517.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011518.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011519.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011520.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011521.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011522.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011523.tsp Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011524.TSP Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011525.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011526.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011527.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011528.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011529.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011530.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011531.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011532.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011533.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011534.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011535.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011536.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011537.ver Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011538.ver Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP50\A0011539.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011583.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011584.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011585.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011586.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011587.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011588.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011589.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011590.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011591.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011592.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011593.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011594.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011595.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011596.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011597.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011598.inf Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011599.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011600.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011601.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011602.cat Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011603.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011604.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011605.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011606.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011607.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011608.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011609.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011610.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011611.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011612.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011613.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011614.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011615.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011616.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011617.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011618.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011619.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011620.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011621.ver Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011622.ver Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011623.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011624.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011625.exe Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011626.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011627.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011628.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011629.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011630.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011631.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011632.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011633.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011634.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011635.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011636.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011637.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011638.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011639.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011640.dll Object is locked skipped
F:\System Volume Information\_restore{F09FE81C-12BE-42BD-9FC0-04BE31C20344}\RP51\A0011641.dll Object is locked skipped
F:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP191\change.log Object is locked skipped
K:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
K:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP191\change.log Object is locked skipped

Scan process completed.



Logfile of HijackThis v1.99.1
Scan saved at 10:15:39 PM, on 9/1/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\COMMON~1\AOL\113517~1\EE\AOLHOS~1.EXE
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\PROGRA~1\COMMON~1\AOL\113517~1\EE\AOLServiceHost.exe
C:\Program Files\Trillian\trillian.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\INCRED~1\bin\IncMail.exe
C:\Program Files\ICQLite\ICQLite.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\PROGRA~1\NORTON~1\Navw32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
F:\My Documents\Installers\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.weather.com/weather/local...from=whatwhere
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1135175064\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Norton AntiVirus\CfgWiz.exe" /GUID {0D7956A2-5A08-4ec2-A72C-DF8495A66016} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {09F1ADAC-76D8-4D0F-99A5-5C907DADB988} - http://www.systemdoctor.com/download...reeInstall.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} (CGameManagerCtrl Object) - https://disney.go.com/games/download...ameManager.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
chelle0372 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 09-02-2006, 07:34 AM   #8 (permalink)
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
 
Glaswegian's Avatar
 
Join Date: Sep 2005
Location: Glasgow
Posts: 25,488
OS: Win XP Pro SP3 / Win 7 Pro

My System

Blog Entries: 10
Hi again

Clear out Norton's Quarantine folder. If you're unsure on how to do it, you can use Symantec's guide.


You have files on your F: drive that should be cleared out, such as these

F:\My Documents\Angie Stuff\Skins\ICQ Skins\17614.exe
F:\My Documents\Angie Stuff\Skins\ICQ Skins\angelinajolie15.exe
F:\My Documents\Incredimail\315.exe
F:\My Documents\Kate Stuff\kate2ss.exe
F:\My Documents\Kate Stuff\kate2ss.exe Dropper


I assume this is a backup drive of some kind? Look through the Kaspersky log and delete all the F: drive items listed. Other than that you’re clean. Any more problems? If not we’ll just tidy up and I’ll let you go, along with my recommendations for staying safe and secure. Remember to re-enable Spysweeper.


Reset Hidden/System Files
To reset your hidden and system files:
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View tab.
  • Deselect the Show hidden files and folders option.
  • Select the Hide file extensions for known types option.
  • Select the Hide protected operating system files option.
  • Click Yes to confirm.
  • Click OK.


System Restore
To turn off System Restore click Start > Right Click My Computer > Properties. Click the System Restore tab and Check "Turn off System Restore" or "Turn off System Restore on all drives" Click Apply. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this then Click OK.

To turn on System Restore by Clicking Start. Right-click My Computer, and then click Properties. Click the System Restore tab. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives." Click Apply, and then OK.

This will create a new Restore Point.



IMPORTANT!!!
Please ensure that Windows is patched against the WMF exploit. This is a dangerous vulnerability that opens the door to multiple infections. Visit Window's Update to get the KB912919 patch if you have not already done so.



Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:

Spyware Blaster to help prevent spyware from installing in the first place.
Spyware Guard to catch and block spyware before it can execute.
Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here.


Ad-aware
Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here.


IE-SPYAD
IE-Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impairs attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. A tutorial on installing this product can be found here.


SnoopFree
SnoopFree is a real time monitor that notifies you when a programme wants to record your keystrokes or read your screen.


MVPS Hosts File
The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file.


Alternate Browsers
Try the following free alternate browsers rather than Internet Explorer
Firefox
Opera
Maxthon



Firewalls
A good firewall will monitor incoming and outgoing traffic. NOTE: Microsoft's Firewall does not monitor outgoing traffic. If you do not have a firewall, here are 3 free ones available for personal use:
Sygate Personal Firewall
ZoneAlarm
Tiny Personal Firewall


Anti Virus Software
It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See this link for a listing of some online antivirus scanners:
Anti-Spyware Tutorial

Here are two very good free Antivirus products which are available:
Avast!
AVG

It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.


Other Protection
Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here:
Using Winpatrol to protect your computer.


In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles

How Did I Get Infected In The First Place?
The Anti-Spyware Tutorial.
Making Internet Explorer Safer.

Keep clean and safe and enjoy your computing!

Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Iain - Defender of the Haggis and all things Scottish.
I don't help by PM - post in the Forums.



PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner
Glaswegian is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 09-02-2006, 08:27 PM   #9 (permalink)
Registered User
 
Join Date: Aug 2006
Posts: 5
OS: Windows XP


Thanks so much for all your help...It is much appreciated
chelle0372 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
 

« Previous Thread | Next Thread »

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



All times are GMT -7. The time now is 10:16 AM.

Contact Us - Tech Support Forum - Archive - Privacy Statement - Top


Copyright 2001 - 2009, Tech Support Forum
Home Tips Plus | Outdoor Basecamp | Automotive Support Forum

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85