|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
10-01-2007, 04:36 PM
|
#1 (permalink) |
|
Registered User
Join Date: Dec 2004
Location: Mid-West
Posts: 180
OS: 2003/XP/Vista
|
Need a binary shotgun for Trojan.Vundo
This is a mother. I do spyware removal on the side and this thing is whipping me like Miss South Carolina in a geography bee.
Symantec first detected Trojan.Vundo and "removed" it. As we know, Symantec really leaves a lot to be desired when it comes to Adware removal, so I launched a few "company approved" tools. I cold booted to safe mode, ran Spybot, ran Symantec full scan. Came back clean. Booted up and it was back. I cold booted back to safe mode. Stopped Symantec from partially removing it. Looked at a Hijack This log. Saw the .dll entries. Removed them. Ran Symantec, VundoFix, and VirtumundoBeGone tools (from numerous websites.) Vundofix found and removed 4 additional files. The rest of the scans were clean. Booted back up, it was back again. Ran RootkitRevealer, ran Symantec, Both were clean. Now I'm posting a HiJack This log in hopes someone sees something I don't. I'm out of ideas and am about to reinstall. Something is hiding in there or I'm losing my mind!! Anyone? Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 5:19:27 PM, on 10/1/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\Cpqdiag\Cpqdfwag.exe C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe C:\Program Files\Dantz\Retrospect\retrorun.exe C:\Program Files\Symantec AntiVirus\SavRoam.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\igfxtray.exe C:\WINDOWS\System32\hkcmd.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\Analog Devices\SoundMAX\SMTray.exe C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe C:\WINDOWS\system32\userinit.exe C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE C:\PROGRA~1\SYMANT~2\VPTray.exe C:\Compaq\EAKDRV\EAUSBKBD.EXE C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\Symantec AntiVirus\DoScan.exe C:\Program Files\palmOne\Hotsync.exe C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe E:\HiJackThis.exe C:\WINDOWS\system32\wuauclt.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0409/bl8.asp R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.compaq.com/1Q00CDT/0409/bl7.asp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0409/bl8.asp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon O4 - HKLM\..\RunServices: [CPQDFWAG] C:\WINDOWS\Cpqdiag\CpqDfwAg.exe O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: kwqc.adconnections.com O15 - Trusted Zone: secure-kwqc.adconnections.com O15 - Trusted Zone: *.kwqc-camio O15 - Trusted Zone: www.nfcimages.com O15 - Trusted Zone: *.web01nyc O15 - Trusted Zone: http://*.web01nyc O15 - Trusted Zone: install.worldnow.com O15 - Trusted Zone: managekwqc.worldnow.com O15 - Trusted IP range: 192.168.15.84 O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {4346AA08-289A-499A-AAA5-F3BF3FD2E48A} (AdConnections.c02) - http://logon.adconnections.com/compo...ectionsC02.CAB O16 - DPF: {BB45984B-5D74-44D3-9171-77D785D3A30A} (AdConnections.c01) - http://logon.adconnections.com/compo...ectionsC01.CAB O16 - DPF: {D30CA0FD-1CA0-11D4-AC78-006008A9A8BC} (WebBasedClientInstall Class) - http://dbierman/nav98clientinstall/webinst.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = kwqc.com O17 - HKLM\Software\..\Telephony: DomainName = kwqc.com O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = kwqc.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = kwqc.com O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Remote Diagnostics Enabling Agent (DfwWebAgent) - Hewlett-Packard - C:\WINDOWS\Cpqdiag\Cpqdfwag.exe O23 - Service: EGXHXEFWZF - Unknown owner - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\EGXHXEFWZF.exe (file missing) O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\retrorun.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe -- End of file - 7323 bytes |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
10-01-2007, 08:55 PM
|
#4 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,350
OS: N/A
|
Re: Need a binary shotgun for Trojan.Vundo
Please post ComboFix's log
__________________
Question - what have you done for the community today? |
|
|
|
|
10-02-2007, 09:52 AM
|
#5 (permalink) |
|
Registered User
Join Date: Dec 2004
Location: Mid-West
Posts: 180
OS: 2003/XP/Vista
|
Re: Need a binary shotgun for Trojan.Vundo
Certainly! Was the .sys file the root of the infection or the S3 entry .exe file? All scans would be clean and then reinstall after a reboot. Typical Malware behavior, but strange not to be able to find the root of the infection even with a Hijack This and a rootkit scan.
I've cold booted and Symantec is not hitting on it at all any more. All subsequent scans have been clean. Thanks for your attention. :) Here's the log from last night: ComboFix 07-10-02.2 - Administrator 2007-10-01 21:18:39.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.629 [GMT -5:00] Running from: E:\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\smsmith\Application Data\Hotbar C:\Documents and Settings\smsmith\Application Data\SpamBlocker C:\WINDOWS\system32\drivers\fad.sys C:\WINDOWS\system32\ssttu.dll . ((((((((((((((((((((((((( Files Created from 2007-09-02 to 2007-10-02 ))))))))))))))))))))))))))))))) . 2007-10-01 21:17 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-01 17:01 <DIR> d-------- C:\Documents and Settings\engineeradmin\Application Data\HotSync 2007-10-01 17:00 <DIR> d-------- C:\Documents and Settings\engineeradmin\Application Data\Real 2007-10-01 15:36 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\HotSync 2007-09-26 09:26 26,496 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys 2007-09-26 07:49 296,244 --a------ C:\WINDOWS\system32\ddcya.dll 2007-09-25 18:15 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe 2007-09-25 18:13 <DIR> d-------- C:\VundoFix Backups 2007-09-25 18:07 296,436 --a------ C:\WINDOWS\system32\awtqq.dll 2007-09-25 18:03 <DIR> d-------- C:\WINDOWS\pss 2007-09-25 17:21 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\HotSync 2007-09-25 17:14 <DIR> dr-h----- C:\Documents and Settings\smsmith\Application Data\Andersson Digital Design 2007-09-25 17:14 <DIR> d--hs---- C:\Documents and Settings\smsmith\UserData 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\SecurityScans 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Contacts 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\XnView 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\Sonic 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\Share-to-Web Upload Folder 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\Real 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\Raptisoft 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\Media Player Classic 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\Leadertech 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\Lavasoft 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\InterVideo 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\InterTrust 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\Help 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\Google 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\Ethereal 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\Apple Computer 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\APC 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\AdobeUM 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\AdobeAUM 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\ActiveState 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\.gaim 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\.lincity 2007-09-25 14:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-09-25 13:56 <DIR> d-------- C:\Program Files\Enigma Software Group 2007-09-25 13:35 296,804 --a------ C:\WINDOWS\system32\geedd.dll 2007-09-25 13:14 <DIR> d-------- C:\WINDOWS\system32\vMW10a 2007-09-25 13:14 <DIR> d-------- C:\TEMP\xOe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-01 21:23 --------- d-------- C:\Program Files\Symantec AntiVirus 2007-09-28 18:00 --------- d-------- C:\Documents and Settings\All Users\Application Data\Retrospect . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-03-11 05:24] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-03-11 05:11] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 18:48] "Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [2003-01-31 19:49] "DrvLsnr"="C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe" [2002-05-28 03:37] "srmclean"="C:\Cpqs\Scom\srmclean.exe" [2001-07-24 16:34] "SetRefresh"="C:\Program Files\Compaq\SetRefresh\SetRefresh.exe" [2002-08-07 09:24] "CPQEASYACC"="C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe" [2001-12-14 17:01] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-06-02 09:47] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2004-07-09 08:10] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-11-21 20:38] "vptray"="C:\PROGRA~1\SYMANT~2\VPTray.exe" [2006-12-20 13:29] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06] "Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-04 00:56] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] "CPQDFWAG"=C:\WINDOWS\Cpqdiag\CpqDfwAg.exe C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ HotSync Manager.lnk - C:\Program Files\palmOne\Hotsync.exe [2004-06-09 15:16:08] Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 18:23:32] C:\Documents and Settings\smsmith\Start Menu\Programs\Startup\ PowerReg Scheduler.exe [2006-04-09 18:30:45] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ HotSync Manager.lnk - C:\Program Files\palmOne\Hotsync.exe [2004-06-09 15:16:08] Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 18:23:32] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "disablecad"=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{F884BE4E-64D5-43FE-80A4-DB8D63C748F0}"= C:\WINDOWS\system32\hggfcyw.dll [ ] R1 EAWDMFD;EAWDMFD;C:\WINDOWS\system32\drivers\EAWDMFD.sys R2 cpqdfw;Diagnostics Driver;\??\C:\WINDOWS\System32\drivers\cpqdfw.sys R2 cq_mem;Diagnostics Memory Driver;\??\C:\WINDOWS\System32\drivers\cq_mem.sys R2 cqcpu;Diagnostics CPU Driver;\??\C:\WINDOWS\System32\drivers\cqcpu.sys R2 DfwWebAgent;Remote Diagnostics Enabling Agent;C:\WINDOWS\Cpqdiag\Cpqdfwag.exe R3 eaps2kbd;Compaq Easy Access PS2 Internet Keyboard (Win2K);C:\WINDOWS\system32\DRIVERS\eaps2kbd.sys S3 EGXHXEFWZF;EGXHXEFWZF;C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\EGXHXEFWZF.exe . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-01 21:24:24 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-01 21:25:52 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-10-01 21:25 . --- E O F --- Last edited by Cleffer; 10-02-2007 at 09:54 AM. |
|
|
|
|
10-02-2007, 10:05 AM
|
#6 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,350
OS: N/A
|
Re: Need a binary shotgun for Trojan.Vundo
Go to Start > Control Panel > Add or Remove Programs and uninstall the following programs:
--------------- Open notepad and copy/paste the text in the quotebox below into it: Code:
File::
C:\WINDOWS\system32\ddcya.dll
C:\WINDOWS\system32\VundoFixSVC.exe
C:\WINDOWS\system32\awtqq.dll
C:\WINDOWS\system32\geedd.dll
Folder::
C:\WINDOWS\system32\vMW10a
C:\TEMP\xOe
C:\Program Files\Enigma Software Group
C:\VundoFix Backups
Driver::
EGXHXEFWZF
Registry::
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F884BE4E-64D5-43FE-80A4-DB8D63C748F0}]
 Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. --------------- Click here perform an online scan >> Online Scanner --------------- In your next post, please include fresh logs from:
__________________
Question - what have you done for the community today? |
|
|
|
|
10-02-2007, 10:05 AM
|
#7 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,350
OS: N/A
|
Re: Need a binary shotgun for Trojan.Vundo
This is to be performed after you have posted the required logs.
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. Updating Java:
__________________
Question - what have you done for the community today? |
|
|
|
|
10-02-2007, 12:33 PM
|
#8 (permalink) |
|
Registered User
Join Date: Dec 2004
Location: Mid-West
Posts: 180
OS: 2003/XP/Vista
|
Re: Need a binary shotgun for Trojan.Vundo
SpyHunter not found in Add/Remove programs list. I *did* find it at C:\Program Files\Enigma Software
Group\SpyHunter. The only thing the folder contained was a .log file (which I have kept in case you want to see it.) I had to boot into safe mode to remove the file folder. I removed it, warm booted, and it remained gone. All other programs in the Add/Remove Programs list appear legit. ~~:~~ Here is the result for the last run of ComboFix. ComboFix 07-10-02.2 - Administrator 2007-10-02 11:34:39.2 - NTFSx86 MINIMAL Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.839 [GMT -5:00] Running from: C:\Documents and Settings\smsmith\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt FILE:: C:\WINDOWS\system32\ddcya.dll C:\WINDOWS\system32\VundoFixSVC.exe C:\WINDOWS\system32\awtqq.dll C:\WINDOWS\system32\geedd.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\smsmith\Application Data\Hotbar C:\Documents and Settings\smsmith\Application Data\SpamBlocker C:\TEMP\xOe C:\VundoFix Backups C:\VundoFix Backups\ghkmp.bak2.bad C:\VundoFix Backups\ghkmp.ini.bad C:\WINDOWS\system32\awtqq.dll C:\WINDOWS\system32\ddcya.dll C:\WINDOWS\system32\geedd.dll C:\WINDOWS\system32\vMW10a C:\WINDOWS\system32\VundoFixSVC.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_EGXHXEFWZF -------\EGXHXEFWZF ((((((((((((((((((((((((( Files Created from 2007-09-02 to 2007-10-02 ))))))))))))))))))))))))))))))) . 2007-10-01 21:17 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-01 17:01 <DIR> d-------- C:\Documents and Settings\engineeradmin\Application Data\HotSync 2007-10-01 17:00 <DIR> d-------- C:\Documents and Settings\engineeradmin\Application Data\Real 2007-10-01 15:36 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\HotSync 2007-09-26 09:26 26,496 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys 2007-09-25 18:03 <DIR> d-------- C:\WINDOWS\pss 2007-09-25 17:21 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\HotSync 2007-09-25 17:14 <DIR> dr-h----- C:\Documents and Settings\smsmith\Application Data\Andersson Digital Design 2007-09-25 17:14 <DIR> d--hs---- C:\Documents and Settings\smsmith\UserData 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\SecurityScans 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Contacts 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\XnView 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\Sonic 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\Share-to-Web Upload Folder 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\Real 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\Raptisoft 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\Media Player Classic 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\Leadertech 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\Lavasoft 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\InterVideo 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\InterTrust 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\Help 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\Google 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\Ethereal 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\Apple Computer 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\APC 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\AdobeUM 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\AdobeAUM 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\ActiveState 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\Application Data\.gaim 2007-09-25 17:14 <DIR> d-------- C:\Documents and Settings\smsmith\.lincity 2007-09-25 14:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-02 11:39 --------- d-------- C:\Program Files\Symantec AntiVirus 2007-09-28 18:00 --------- d-------- C:\Documents and Settings\All Users\Application Data\Retrospect . ((((((((((((((((((((((((((((( snapshot@2007-10-01_21.25.12.25 ))))))))))))))))))))))))))))))))))))))))) . ----atw 16,384 2007-10-02 16:39:02 C:\WINDOWS\Temp\Perflib_Perfdata_1d4.dat . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-03-11 05:24] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-03-11 05:11] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 18:48] "Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [2003-01-31 19:49] "DrvLsnr"="C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe" [2002-05-28 03:37] "srmclean"="C:\Cpqs\Scom\srmclean.exe" [2001-07-24 16:34] "SetRefresh"="C:\Program Files\Compaq\SetRefresh\SetRefresh.exe" [2002-08-07 09:24] "CPQEASYACC"="C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe" [2001-12-14 17:01] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-06-02 09:47] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2004-07-09 08:10] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-11-21 20:38] "vptray"="C:\PROGRA~1\SYMANT~2\VPTray.exe" [2006-12-20 13:29] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06] "Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-04 00:56] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] "CPQDFWAG"=C:\WINDOWS\Cpqdiag\CpqDfwAg.exe C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ HotSync Manager.lnk - C:\Program Files\palmOne\Hotsync.exe [2004-06-09 15:16:08] Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 18:23:32] C:\Documents and Settings\smsmith\Start Menu\Programs\Startup\ PowerReg Scheduler.exe [2006-04-09 18:30:45] Shortcut to ISCAlert.exe.lnk - \\Engineersparexp\c$\Program Files\ISC Alert\ISCAlert.exe [2006-08-14 14:26:27] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ HotSync Manager.lnk - C:\Program Files\palmOne\Hotsync.exe [2004-06-09 15:16:08] Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 18:23:32] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "disablecad"=0 (0x0) R1 EAWDMFD;EAWDMFD;C:\WINDOWS\system32\drivers\EAWDMFD.sys R2 cpqdfw;Diagnostics Driver;\??\C:\WINDOWS\System32\drivers\cpqdfw.sys R2 cq_mem;Diagnostics Memory Driver;\??\C:\WINDOWS\System32\drivers\cq_mem.sys R2 cqcpu;Diagnostics CPU Driver;\??\C:\WINDOWS\System32\drivers\cqcpu.sys R2 DfwWebAgent;Remote Diagnostics Enabling Agent;C:\WINDOWS\Cpqdiag\Cpqdfwag.exe R3 eaps2kbd;Compaq Easy Access PS2 Internet Keyboard (Win2K);C:\WINDOWS\system32\DRIVERS\eaps2kbd.sys . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-02 11:39:51 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-02 11:42:19 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-10-02 11:41 C:\ComboFix2.txt ... 2007-10-01 21:25 . --- E O F --- (Continued) |
|
|
|
|
10-02-2007, 12:35 PM
|
#9 (permalink) |
|
Registered User
Join Date: Dec 2004
Location: Mid-West
Posts: 180
OS: 2003/XP/Vista
|
Re: Need a binary shotgun for Trojan.Vundo
Here is the result for the Kaspersky Online scan (Netsky?? What's the deal with Symanec not hitting on this?!?!)
------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Tuesday, October 02, 2007 1:26:26 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.1 Kaspersky Anti-Virus database last update: 2/10/2007 Kaspersky Anti-Virus database records: 426364 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 78351 Number of viruses found: 10 Number of infected objects: 80 Number of suspicious objects: 8 Duration of the scan process: 01:10:31 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\Admin\Application Data\desktop.ini Object is locked skipped C:\Documents and Settings\Admin\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol Object is locked skipped C:\Documents and Settings\Admin\Application Data\Microsoft\HTML Help\hh.dat Object is locked skipped C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\brndlog.bak Object is locked skipped C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\brndlog.txt Object is locked skipped C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Desktop.htt Object is locked skipped C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini Object is locked skipped C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk Object is locked skipped C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf Object is locked skipped C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk Object is locked skipped C:\Documents and Settings\Admin\Application Data\Microsoft\Media Player\01C35283.wpl Object is locked skipped C:\Documents and Settings\Admin\Application Data\Microsoft\MMC\secpol Object is locked skipped C:\Documents and Settings\Admin\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\adcontroller.jar-60614507-510d3cec.idx Object is locked skipped C:\Documents and Settings\Admin\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\adcontroller.jar-60614507-510d3cec.zip Object is locked skipped C:\Documents and Settings\Admin\Application Data\Sun\Java\Deployment\deployment.properties Object is locked skipped C:\Documents and Settings\Admin\Application Data\Sun\Java\Deployment\log\plugin142_03.trace Object is locked skipped C:\Documents and Settings\Admin\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Admin\Cookies\tv6admin@2o7[1].txt Object is locked skipped C:\Documents and Settings\Admin\Cookies\tv6admin@30848670[2].txt Object is locked skipped C:\Documents and Settings\Admin\Cookies\tv6admin@a.as-us.falkag[1].txt Object is locked skipped C:\Documents and Settings\Admin\Cookies\tv6admin@advertising[1].txt Object is locked skipped C:\Documents and Settings\Admin\Cookies\tv6admin@atdmt[2].txt Object is locked skipped C:\Documents and Settings\Admin\Cookies\tv6admin@bluestreak[1].txt Object is locked skipped C:\Documents and Settings\Admin\Cookies\tv6admin@bravenet[1].txt Object is locked skipped C:\Documents and Settings\Admin\Cookies\tv6admin@doubleclick[1].txt Object is locked skipped C:\Documents and Settings\Admin\Cookies\tv6admin@fastclick[2].txt Object is locked skipped C:\Documents and Settings\Admin\Cookies\tv6admin@google[1].txt Object is locked skipped C:\Documents and Settings\Admin\Cookies\tv6admin@ninjai[2].txt Object is locked skipped C:\Documents and Settings\Admin\Cookies\tv6admin@servedby.advertising[1].txt Object is locked skipped C:\Documents and Settings\Admin\Cookies\tv6admin@server.iad.liveperson[1].txt Object is locked skipped C:\Documents and Settings\Admin\Cookies\tv6admin@shockwave[1].txt Object is locked skipped C:\Documents and Settings\Admin\Cookies\tv6admin@tribalfusion[1].txt Object is locked skipped C:\Documents and Settings\Admin\Cookies\tv6admin@www.burstbeacon[1].txt Object is locked skipped C:\Documents and Settings\Admin\Cookies\tv6admin@www.shockwave[1].txt Object is locked skipped C:\Documents and Settings\Admin\Cookies\tv6admin@yahoo[1].txt Object is locked skipped C:\Documents and Settings\Admin\Favorites\Desktop.ini Object is locked skipped C:\Documents and Settings\Admin\Favorites\Hewlett-Packard Recommended Sites\AltaVista Live.URL Object is locked skipped C:\Documents and Settings\Admin\Favorites\Hewlett-Packard Recommended Sites\AltaVista Search.URL Object is locked skipped C:\Documents and Settings\Admin\Favorites\Hewlett-Packard Recommended Sites\AltaVista.URL Object is locked skipped C:\Documents and Settings\Admin\Favorites\Hewlett-Packard Recommended Sites\Business Community.URL Object is locked skipped C:\Documents and Settings\Admin\Favorites\Hewlett-Packard Recommended Sites\eCommerce.URL Object is locked skipped C:\Documents and Settings\Admin\Favorites\Hewlett-Packard Recommended Sites\Hewlett-Packard.URL Object is locked skipped C:\Documents and Settings\Admin\Favorites\Links\Customize Links.url Object is locked skipped C:\Documents and Settings\Admin\Favorites\Links\Free Hotmail.url Object is locked skipped C:\Documents and Settings\Admin\Favorites\Links\Windows Media.url Object is locked skipped C:\Documents and Settings\Admin\Favorites\Links\Windows.url Object is locked skipped C:\Documents and Settings\Admin\Favorites\MSN.com.url Object is locked skipped C:\Documents and Settings\Admin\Favorites\Radio Station Guide.url Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Application Data\IconCache.db Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\HelpCtr\HelpSessionHistory.dat Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_59R.wmdb Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.DTD Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.XML Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNSD.XML Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142010}\1033.MST Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142010}\Java 2 Runtime Environment, SE v1.4.2_01.msi Object is locked skipped C:\Documents and Settings\Admin\Local Settings\desktop.ini Object is locked skipped C:\Documents and Settings\Admin\Local Settings\History\desktop.ini Object is locked skipped C:\Documents and Settings\Admin\Local Settings\History\History.IE5\desktop.ini Object is locked skipped C:\Documents and Settings\Admin\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temp\jusched.log Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\0220_beachball[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\040429_april_price_lrec_avail[1].swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\040429_april_price_super[1].swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\040510_300x250_27k_h_c_y_mar29[1].swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\118000[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\18x18_v3[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\1[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\1_stat[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\282153_021004ratemymortgage21_25x25[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\34[2].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\42[2].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\50704_thomp_ya728_08[1].swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\73[2].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\74[2].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\74[3].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\asldata[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\atb_help[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\at_work[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\autos[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\B1336939;abr=!ie;sz=468x60;ord=999540245[1] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\Behaviors[1].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\bgl[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\bl7[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\browser[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\button_writereview_sw[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\CA23CDIN.swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\CA2BW5U3.swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\CA94K355.swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\CAAF8PYZ.swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\cc_b_25x25_0803_17[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\cnet_ed3[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\code[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\Common[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\complete_icon[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\Compose[1] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\Compose[2] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\computer[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\contentview[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\coUA[1].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\cpage_c10_11[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\cpage_c10_16[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\cpage_c10_20[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\cpage_c10_23[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\cpage_c10_23_on[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\cpage_c10_27[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\cpage_c10_27_on[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\cpage_c10_29_on[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\cpage_c10_31[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\cpage_c10_35[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\cpage_over_04[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\cpage_ver5b_06[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\cplay[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\desktop.ini Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\desktop_icon_01[1].bmp Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\dialog2[1].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\dirwings[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\dorks_side_s[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\firstpage[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\flight106[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\food[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\footer_japan[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\footer_sw[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\frame[1].swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\fs_pb_fitted_072002b[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\games_redline_rumble_400x300[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\harris[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\hd_mp_promo_3[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\historyt[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\holiday[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\hpweb_1-2_prnt_icn[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\hpweb_1-2_topnav_home[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\hpweb_styles_win_ie6[1].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\ien[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\inbo1[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\Index[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\info[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\internationalpop[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\invaders[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\JS[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\j[1].ad Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\language[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\login[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\login[2].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\logo4[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\logo_sw[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\luck[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\m6v9b[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\mailbr1[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\mc1[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\mc2[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\metricsNAsmbmktg[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\MiniNavBar[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\mstoolbar_curve[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\mstoolbar_icp[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\music[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\nav_m[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\ninjai_400x300[2].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\npdbr1[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\null[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\Options[2] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\optn=1[1] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\pacman[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\pacman[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\perc1[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\pim[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\pim_style_ie_blue[1].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\playfilm[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\plusCold[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\preloader[1].dir Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\pulldowns[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\p_aim[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\p_pm[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\quote[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\redirect[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\redlinerumble[1].dir Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\risque[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\rumors[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\search[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\search[2] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\shania00[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\shania02[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\shared[1].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\shared[2].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\shared[3].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\shared[4].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\shared[5].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\shim[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\shortcutCold[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\ShowFolder[1] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\ShowFolder[2] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\splash[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\splash[2].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\stickey25[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\sw_stars_4.0[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\toc[1].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\toc[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\toxin[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\tr14x15_1[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\tshc1[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\t_reply[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\UPO_9315a_425x600_01[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\warning_icon[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\watermark_300x[1].bmp Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\welcome20040329[1].dir Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\window[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\www[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\yahoo[2] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\yahoo_icon_question_25x25[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\45GH81XL\yhootiff0204_a_72890A_05_19_04[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\040429_april_price_mon[1].swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\040525_300x100[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\25[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\26[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\26[2].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\41304728_v9head[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\728x90_20k_15sec[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\89[2].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\ad[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\Anti-Theft_Monkey[1].wmv Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\asldata[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\aslmain[2].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\aslsubs111[2].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\asteroids[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\bandwidth[1].swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\blankhtml[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\blko1[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\BURSTURL=;ord=12843[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\BURSTURL=;ord=4817[1] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\button_go[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\calbr1[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\CAM7URQD.swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\caption[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\closebutton[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\college[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\cpage_c10_10[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\cpage_c10_14[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\cpage_c10_15[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\cpage_c10_21_on[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\cpage_c10_22[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\cpage_c10_26[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\cpage_c10_26_on[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\cpage_c10_30[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\cpage_c10_34[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\cpage_c10_36_on[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\cpage_c10_38[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\cpage_over_06[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\cpage_ver5b_03[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\cpage_ver5b_05[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\credits[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\critter[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\ct_lrec_031016[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\ct_yad_031016[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\desktop.ini Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\desktop_icon_04[1].bmp Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\detection[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\dialog2[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\die2[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\downbr1[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\down[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\foo[1].bar Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\fs_lrec_031223[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\games_redline_rumble_160x600[2].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\games_redline_rumble_468x60_dw[2].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\hcp[1].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\HHWRAPPER[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\history[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\HitCounter[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\HomePage[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\hpweb_1-2_topnav_hp_logo[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\hpweb_1-2_topnav_slutns[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\hpweb_utilities[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\icon1[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\icon[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\inboxer[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\indexfirstlevel[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\index[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\index[2].php Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\junk[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\j[1].ad Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\j[2].ad Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\login[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\logoneg2[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\logo[1].bmp Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\logo[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\love[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\mc[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\menubar[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\movies[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\mstoolbar[1].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\mstoolbar[2].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\naturalhandwriting[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\NavBar[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\nav[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\nav_page[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\note[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\optn=1[1] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\optn=1[2] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\optn=1[3] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\optn=1[4] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\pac-man[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\panda[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\parishilton50b[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\photo[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\picon_sw_redline_rumble_lrg[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\pim_style_blue[1].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\pip[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\pop[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\pregnant[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\protect[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\p_icq[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\question[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\radiotv[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\rating_bar[1].swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\referenc[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\reg2[1].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\religion[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\reusable[1].xml Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\searchhead[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\search[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\shania01[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\shania05[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\shared[1].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\shared[2].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\ShowFolder[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\ShowFolder[2] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\ShowFolder[3] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\show[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\Signature[1] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\Signature[2] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\sntc1[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\splash[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\splash[2].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\spoons[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\sp_mailplus_1[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\status[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\styles_sw[1].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\survey[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\tag[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\tetris[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\tile_back[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\titanic[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\toc[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\uh_tcrn[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\ulrp[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\up[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\user_reviews_games[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\util[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\welcome[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\yaddfld[1].htc Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\yhoo0404_a_2525s[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\6X70NTL4\ylib_dom[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\020404_ym_25x25_explo[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\0919_icon3_25x25[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\1_preview[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\5-v1_freenov_468x60[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\68[2].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\;ord=999501496[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\activex[1].vbs Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\ad[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\anti-theft_monkey[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\arrow[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\arrow_green_normal[1].bmp Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\aslframe[1].html Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\aslframe[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\atb_members[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\atb_stats[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\autocomplete[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\back[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\bandwidthpixelsw_1x1[2].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\blank[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\bookworm[1].swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\browser[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\bulb1[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\button[1].swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\CA670HAF.swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\CA85M3IZ.swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\CAAVURED.swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\CAJ2SR75.swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\CAPSJMB5.swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\CAU7WXQZ.swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\CAZ2IL7F.swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\cc_b_25x25_0803_15[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\CH_UniversalStudent_hipster_120x600_33k[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\coke[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\Common[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\Common_CKC[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\Compose[1] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\Compose[2] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\Compose[3] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\Compose[4] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\Compose[5] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\Compose[6] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\cons_0120[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\content[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\Context[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\cpage_c10_13[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\cpage_c10_17[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\cpage_c10_19[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\cpage_c10_22_on[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\cpage_c10_25[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\cpage_c10_25_on[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\cpage_c10_29[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\cpage_c10_32_on[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\cpage_c10_33[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\cpage_c10_37[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\cpage_over_07[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\cpage_ver5b_04[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\cpage_ver5b_08[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\crimetop[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\daughterlogo[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\defaultsettings[1].xml Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\default[2].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\desktop.ini Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\desktop_icon_03[1].bmp Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\dftc1[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\dialog_download[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\dmheader[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\downplain_1[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\fax[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\flash_wrap_v4[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\footer[1].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\games_redline_rumble_728x90[2].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\glossary[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\glurge[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\golf00[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\hdr[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\hexxagon[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\hh_yahoo_mastercard_25x25[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\Homepage__DESKTOP[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\Homepage__SHARED[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\hpweb_1-2_arrw_sbmt[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\hpweb_1-2_topnav_supprt[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\humor[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\inbox_views_scripts[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\index[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\index[2].php Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\j[1].ad Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\landing_sw[1].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\Layout[1].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\link[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\lock_small[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\login[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\lost[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\mail.yahoo[2] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\mail[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\message[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\military[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\minusCold[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\navbar_sw[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\nav_first[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\nav_next[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\newreleases[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\news[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\optn=1[1] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\optn=1[2] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\pbhp_84x28_blu_yahoomail[1].swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\playgame_button[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\politics[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\popup[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\prom00[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\p_email[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\p_up[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\radiosky[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\radiotvt[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\rddl1[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\review_thumbsup[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\s39c284t2_nopic_ban2[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\searchl[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\search_sw[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\shania04[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\shim[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\Signature[2] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\simon[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\smbcenter[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\snopes[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\spacer[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\spacer[2].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\sports[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\style[1].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\survey[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\survey[2].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\sw_getthenewsletter_button[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\top2[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\top[1].vbs Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\tv[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\twodorks[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\t_options[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\Uabrand[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\uh_bk[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\uh_crn2[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\UpdateLoc[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\UpdateOpt[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\v4_bul1[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\v5_mail1[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\video[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\weddings[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\WhiteDotBlueAlias[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\Windows-KB870669-x86-ENU_a73ae1722b03356d9df41c9ac7a8f89[1].exe Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\x[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\yahoo_icon_2_25x25[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\yahoo_icon_register_25x25[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\FU501P0J\yhoo0404_b_2525s[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\020204_checkbook[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\020404_ym_25x25_flame[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\040429_april_price_lrec_getdsl[1].swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\12[2].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\13[2].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\18[2].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\25x25_y2_040104[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\41304728_v9body[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\93[2].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\94[2].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\;ord=999540245[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\abbr1[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\actiongames[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\alanjackson50[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\alttext[1].xml Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\arrow_green_normal_shadow[1].bmp Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\ar[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\ask[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\atb_calendar[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\atb_search[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\bg_sw[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\blkc1[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\bn-search2[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\business[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\bwdetect[1].swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\clearb[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\Common[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\Compose[2] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\Compose[3] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\Compose[4] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\Compose[5] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\content[1].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\CookieIframe[1].html Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\coUAprint[1].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\cpage_c10_12[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\cpage_c10_18[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\cpage_c10_20_on[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\cpage_c10_21[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\cpage_c10_24[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\cpage_c10_24_on[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\cpage_c10_28[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\cpage_c10_28_on[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\cpage_c10_32[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\cpage_c10_36[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\cpage_over_05[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\cpage_ver5b_07[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\cplay[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\crime[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\crumb[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\dandmlogo[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\daughter_sw[1].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\desktop.ini Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\desktop_icon_02[1].bmp Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\disney[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\dmwings[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\events[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\footer[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\footer_welcome[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\forward[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\forward[2].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\fs_yad_031223[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\games_redline_rumble_1x1[2].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\gas00[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\global_sw[1].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\google[1] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\have_your_mind_read[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\HitCounter[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\horror[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\hpweb_1-2_topnav_buy[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\hpweb_1-2_topnav_prdsrv[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\hpweb_human_monitor[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\inbc1[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\index[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\install[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\legal[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\logo_sm[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\mailbox[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\mailma1[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\marble[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\marble[2].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\medical[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\MiniNavBar[1].xml Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\MPFSECPHDNSNQJJCSRLOVMDYNSEEITKJSPLPVPERFDIVMLLKCDEUUXKQUMUHOOLDRHILEFJQERND[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\mstoolbar[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\mstoolbar_ms[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\NavBar[1].xml Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\navbar_sw[1].swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\nav_current[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\netsolutions[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\newmail1[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\ninjai[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\ntap4[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\pacman[1].swf Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\page_sw_actiongames_sports[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\photos[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\pim[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\pim_css[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\plusHot[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\powrdbyhp_blu_84x28_yahoo[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\p_quote[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\p_www[1].gif Object is locked skipped (Log continued next post) |
|
|
|
|
10-02-2007, 12:36 PM
|
#10 (permalink) |
|
Registered User
Join Date: Dec 2004
Location: Mid-West
Posts: 180
OS: 2003/XP/Vista
|
Re: Need a binary shotgun for Trojan.Vundo
(log continued from previous post)
C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\racial[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\radiopresets[1].asp Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\rdul1[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\redirect[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\redline_rumble[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\redline_rumble[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\results[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\review_thumbsdown[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\rollover[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\safepop[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\science[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\search[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\search[2].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\sendpage[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\shania03[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\shared[1].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\shared[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\shared[2].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\shockwave[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\shortcutHot[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\ShowFolder[2] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\ShowFolder[3] Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\snake[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\spacer[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\space[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\stw2[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\sw_tellafriend_button[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\tictactoe[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\tile_sub[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\toc_endnode[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\toc_expanded[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\top[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\travel[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\tri2[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\tt_w[1].jpg Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\t_new[1].gif Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\util[1].js Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\windowsupdate.microsoft[1].htm Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\VVXOVLR2\ygma[1].css Object is locked skipped C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\desktop.ini Object is locked skipped C:\Documents and Settings\Admin\My Documents\desktop.ini Object is locked skipped C:\Documents and Settings\Admin\My Documents\My Music\Desktop.ini Object is locked skipped C:\Documents and Settings\Admin\My Documents\My Music\Sample Music.lnk Object is locked skipped C:\Documents and Settings\Admin\My Documents\My Pictures\Desktop.ini Object is locked skipped C:\Documents and Settings\Admin\My Documents\My Pictures\Sample Pictures.lnk Object is locked skipped C:\Documents and Settings\Admin\My Documents\Retrospect Catalog Files\Backup Set A.rbc Object is locked skipped C:\Documents and Settings\Admin\My Documents\Retrospect Catalog Files\Backup Set B.rbc Object is locked skipped C:\Documents and Settings\Admin\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Admin\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Admin\ntuser.ini Object is locked skipped C:\Documents and Settings\Admin\Recent\Backup Set A.lnk Object is locked skipped C:\Documents and Settings\Admin\Recent\Backup Set B.lnk Object is locked skipped C:\Documents and Settings\Admin\Recent\Desktop.ini Object is locked skipped C:\Documents and Settings\Admin\Recent\Retrospect Catalog Files.lnk Object is locked skipped C:\Documents and Settings\Admin\SendTo\Compressed (zipped) Folder.ZFSendToTarget Object is locked skipped C:\Documents and Settings\Admin\SendTo\Desktop (create shortcut).DeskLink Object is locked skipped C:\Documents and Settings\Admin\SendTo\desktop.ini Object is locked skipped C:\Documents and Settings\Admin\SendTo\Mail Recipient.MAPIMail Object is locked skipped C:\Documents and Settings\Admin\SendTo\My Documents.mydocs Object is locked skipped C:\Documents and Settings\Admin\Start Menu\desktop.ini Object is locked skipped C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Accessibility\desktop.ini Object is locked skipped C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Accessibility\Magnifier.lnk Object is locked skipped C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk Object is locked skipped C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk Object is locked skipped C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Accessibility\Utility Manager.lnk Object is locked skipped C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Address Book.lnk Object is locked skipped C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Command Prompt.lnk Object is locked skipped C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\desktop.ini Object is locked skipped C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Entertainment\desktop.ini Object is locked skipped C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Entertainment\Windows Media Player.lnk Object is locked skipped C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Notepad.lnk Object is locked skipped C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Program Compatibility Wizard.lnk Object is locked skipped C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Synchronize.lnk Object is locked skipped C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Tour Windows XP.lnk Object is locked skipped C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Windows Explorer.lnk Object is locked skipped C:\Documents and Settings\Admin\Start Menu\Programs\desktop.ini Object is locked skipped C:\Documents and Settings\Admin\Start Menu\Programs\Internet Explorer.lnk Object is locked skipped C:\Documents and Settings\Admin\Start Menu\Programs\Outlook Express.lnk Object is locked skipped C:\Documents and Settings\Admin\Start Menu\Programs\Remote Assistance.lnk Object is locked skipped C:\Documents and Settings\Admin\Start Menu\Programs\Startup\desktop.ini Object is locked skipped C:\Documents and Settings\Admin\Start Menu\Programs\Windows Media Player.lnk Object is locked skipped C:\Documents and Settings\Admin\Templates\amipro.sam Object is locked skipped C:\Documents and Settings\Admin\Templates\excel.xls Object is locked skipped C:\Documents and Settings\Admin\Templates\excel4.xls Object is locked skipped C:\Documents and Settings\Admin\Templates\lotus.wk4 Object is locked skipped C:\Documents and Settings\Admin\Templates\powerpnt.ppt Object is locked skipped C:\Documents and Settings\Admin\Templates\presenta.shw Object is locked skipped C:\Documents and Settings\Admin\Templates\quattro.wb2 Object is locked skipped C:\Documents and Settings\Admin\Templates\sndrec.wav Object is locked skipped C:\Documents and Settings\Admin\Templates\winword.doc Object is locked skipped C:\Documents and Settings\Admin\Templates\winword2.doc Object is locked skipped C:\Documents and Settings\Admin\Templates\wordpfct.wpd Object is locked skipped C:\Documents and Settings\Admin\Templates\wordpfct.wpg Object is locked skipped C:\Documents and Settings\Admin\UserData\T4B5PSWX\oWindowsUpdate[1].xml Object is locked skipped C:\Documents and Settings\Administrator\Application Data\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\brndlog.bak Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\brndlog.txt Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Desktop.htt Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Microsoft\Protect\CREDHIST Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Microsoft\Protect\S-1-5-21-4241656290-2351225905-1238294049-500\ee3f59c9-cf7f-4b0f-8ef0-38755c9f6deb Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Microsoft\Protect\S-1-5-21-4241656290-2351225905-1238294049-500\Preferred Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\deployment.properties Object is locked skipped C:\Documents and Settings\Administrator\Cookies\administrator@office.microsoft[1].txt Object is locked skipped C:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Hewlett-Packard Recommended Sites\AltaVista Live.URL Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Hewlett-Packard Recommended Sites\AltaVista Search.URL Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Hewlett-Packard Recommended Sites\AltaVista.URL Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Hewlett-Packard Recommended Sites\Business Community.URL Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Hewlett-Packard Recommended Sites\eCommerce.URL Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Hewlett-Packard Recommended Sites\Hewlett-Packard.URL Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Links\Customize Links.url Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Links\Free Hotmail.url Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Links\Windows Media.url Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Links\Windows.url Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Microsoft Websites\IE Add-on site.url Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Microsoft Websites\IE site on Microsoft.com.url Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Microsoft Websites\Marketplace.url Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Microsoft Websites\Microsoft At Home.url Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Microsoft Websites\Microsoft At Work.url Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Microsoft Websites\Welcome to IE7.url Object is locked skipped C:\Documents and Settings\Administrator\Favorites\MSN.com.url Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Radio Station Guide.url Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache\DA1T3HL8\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache\DA1T3HL8\fwlink[1] Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache\OBLF2VEE\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache\T5SYPSU2\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache\T5SYPSU2\fwlink[1] Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache\UULVQLXY\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\brndlog.txt Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\10012007.Log Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\10022007.Log Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142010}\1033.MST Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142010}\Java 2 Runtime Environment, SE v1.4.2_01.msi Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\History\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012007100120071002\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012007100220071003\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\D1SKNATS\background_gradient[1] Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\D1SKNATS\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\D1SKNATS\down[1] Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\D1SKNATS\offcancl[1] Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\DML3Q3JB\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\DML3Q3JB\ErrorPageTemplate[1] Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\DML3Q3JB\favcenter[1] Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\DML3Q3JB\info_48[1] Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\XHN4MV62\bullet[1] Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\XHN4MV62\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\XHN4MV62\errorPageStrings[1] Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\XMO5T0O4\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\XMO5T0O4\httpErrorPagesScripts[1] Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\XMO5T0O4\tools[1] Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\My Documents\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\My Documents\My Music\Desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\My Documents\My Music\Sample Music.lnk Object is locked skipped C:\Documents and Settings\Administrator\My Documents\My Pictures\Desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\My Documents\My Pictures\Sample Pictures.lnk Object is locked skipped C:\Documents and Settings\Administrator\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Administrator\ntuser.ini Object is locked skipped C:\Documents and Settings\Administrator\Recent\Combofix log.lnk Object is locked skipped C:\Documents and Settings\Administrator\Recent\ComboFix2.lnk Object is locked skipped C:\Documents and Settings\Administrator\Recent\Desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Recent\FixVundo.lnk Object is locked skipped C:\Documents and Settings\Administrator\Recent\hijackthis.lnk Object is locked skipped C:\Documents and Settings\Administrator\Recent\KINGSTON (E).lnk Object is locked skipped C:\Documents and Settings\Administrator\SendTo\Compressed (zipped) Folder.ZFSendToTarget Object is locked skipped C:\Documents and Settings\Administrator\SendTo\Desktop (create shortcut).DeskLink Object is locked skipped C:\Documents and Settings\Administrator\SendTo\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\SendTo\Mail Recipient.MAPIMail Object is locked skipped C:\Documents and Settings\Administrator\SendTo\My Documents.mydocs Object is locked skipped C:\Documents and Settings\Administrator\SendTo\Palm Powered(TM) Handheld.lnk Object is locked skipped C:\Documents and Settings\Administrator\Start Menu\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\Magnifier.lnk Object is locked skipped C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk Object is locked skipped C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk Object is locked skipped C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\Utility Manager.lnk Object is locked skipped C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Address Book.lnk Object is locked skipped C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Command Prompt.lnk Object is locked skipped C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Entertainment\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Entertainment\Windows Media Player.lnk Object is locked skipped C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Notepad.lnk Object is locked skipped C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Program Compatibility Wizard.lnk Object is locked skipped C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Synchronize.lnk Object is locked skipped C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk Object is locked skipped C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Tour Windows XP.lnk Object is locked skipped C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Windows Explorer.lnk Object is locked skipped C:\Documents and Settings\Administrator\Start Menu\Programs\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Start Menu\Programs\Internet Explorer.lnk Object is locked skipped C:\Documents and Settings\Administrator\Start Menu\Programs\Outlook Express.lnk Object is locked skipped C:\Documents and Settings\Administrator\Start Menu\Programs\Remote Assistance.lnk Object is locked skipped C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Start Menu\Programs\Windows Media Player.lnk Object is locked skipped C:\Documents and Settings\Administrator\Templates\amipro.sam Object is locked skipped C:\Documents and Settings\Administrator\Templates\excel.xls Object is locked skipped C:\Documents and Settings\Administrator\Templates\excel4.xls Object is locked skipped C:\Documents and Settings\Administrator\Templates\lotus.wk4 Object is locked skipped C:\Documents and Settings\Administrator\Templates\powerpnt.ppt Object is locked skipped C:\Documents and Settings\Administrator\Templates\presenta.shw Object is locked skipped C:\Documents and Settings\Administrator\Templates\quattro.wb2 Object is locked skipped C:\Documents and Settings\Administrator\Templates\sndrec.wav Object is locked skipped C:\Documents and Settings\Administrator\Templates\winword.doc Object is locked skipped C:\Documents and Settings\Administrator\Templates\winword2.doc Object is locked skipped C:\Documents and Settings\Administrator\Templates\wordpfct.wpd Object is locked skipped C:\Documents and Settings\Administrator\Templates\wordpfct.wpg Object is locked skipped C:\Documents and Settings\Administrator\UserData\index.dat Object is locked skipped C:\Documents and Settings\Administrator\UserData\Q0JB3V5X\oWindowsUpdate[1].xml Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06440000.VBN Infected: not-a-virus:AdWare.Win32.Virtumonde.wb skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\070C0001\47FFE588.VBN Infected: Trojan-Downloader.Win32.Agent.dpn skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08A00000\4FA16E18.VBN Infected: Trojan-Downloader.Win32.Agent.dpq skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0D640001\4FFD37A2.VBN Infected: Trojan.Win32.Agent.bnd skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0D640002\4FFD3B5B.VBN Infected: Trojan-Downloader.Win32.Agent.cbx skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0D640004\4FFD5016.VBN Infected: Trojan-Downloader.Win32.VB.bkw skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/23 Apr 2004 21:37 from help@bangbrosonline.com:hello/shower.zip/shower.htm.scr Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/23 Apr 2004 21:37 from help@bangbrosonline.com:hello/shower.zip Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/25 Apr 2004 01:49 from josivan@revealed.net:hi/transfer.exe Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/25 Apr 2004 17:57 from dkknight6@earthlink.com:here, the introdu/myaunt.zip/myaunt.com Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/25 Apr 2004 17:57 from dkknight6@earthlink.com:here, the introdu/myaunt.zip Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/27 Apr 2004 02:21 from dschrin@qconline.com:fake?/aboutyou....outyou.rtf.scr Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/27 Apr 2004 02:21 from dschrin@qconline.com:fake?/aboutyou.zip Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/28 Apr 2004 08:00 from 022520042246.11585.4fc1@mchsi.com:<S...anking.rtf.exe Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/28 Apr 2004 08:00 from 022520042246.11585.4fc1@mchsi.com:<S...th_ranking.zip Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/28 Apr 2004 13:03 from davidmbrown@dailyobjectivist.com:pretty p/music.zip/music.rtf.scr Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/28 Apr 2004 13:03 from davidmbrown@dailyobjectivist.com:pretty p/music.zip Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/28 Apr 2004 15:00 from lylelovett@losthighway.myreg.net:oh/...mation.htm.pif Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/28 Apr 2004 15:00 from lylelovett@losthighway.myreg.net:oh/information.zip Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/28 Apr 2004 23:58 from bl_00@yahoo.com:question/image.txt.pif Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/29 Apr 2004 15:25 from Lilnave:Re: Yahoo!/Smoke.scr Infected: Email-Worm.Win32.Bagle.z skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/30 Apr 2004 13:15 from Lilnave:Forum notify/Readme.vbs Infected: Email-Worm.Win32.Bagle.z skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/03 May 2004 14:19 from Lilnave:Protected message/the_message.cpl Infected: Email-Worm.Win32.Bagle.z skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/06 May 2004 16:21 from Lilnave:Protected message/text_document.vbs Infected: Email-Worm.Win32.Bagle.z skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/10 May 2004 13:31 from Lilnave:RE: Text message/You_will_answer_to_me.hta Infected: Email-Worm.Win32.Bagle.z skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/11 May 2004 14:48 from Lilnave:Re: Thanks :)/Document.scr Infected: Email-Worm.Win32.Bagle.z skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/12 May 2004 12:21 from Lilnave:Hidden message/Loves_money.scr Infected: Email-Worm.Win32.Bagle.z skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/29 May 2004 16:49 from joshmcgrawmentor@yahoo.com:Protected Mail/message_kurts.zip/details.txt .pif Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/29 May 2004 16:49 from joshmcgrawmentor@yahoo.com:Protected Mail/message_kurts.zip Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/04 Jun 2004 19:58 from dana@saduluth.org:my data/data.txt Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/04 Jun 2004 21:59 from stehpanie.heilig@duluth.k12.mn.us:Mail De.html Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/04 Jun 2004 21:59 from stehpanie.heilig@duluth.k12.mn.us:Mail De/message.scr Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/07 Jun 2004 21:10 from annedoug@charter.net:Re: Question/archive.zip/data.rtf .scr Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/07 Jun 2004 21:10 from annedoug@charter.net:Re: Question/archive.zip Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/07 Jun 2004 21:10 from kevin.b.jocelyn@aexp.com:Mail Delivery (f.html Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/07 Jun 2004 21:10 from kevin.b.jocelyn@aexp.com:Mail Delivery (f/message.scr Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/10 Jun 2004 00:37 from support@symantec.com:Re: Submit a Virus S/datfiles.txt Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/14 Jun 2004 20:41 from dougwilliams01@hotmail.com:Re: my product/product_kurts.zip/details.txt .pif Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/14 Jun 2004 20:41 from dougwilliams01@hotmail.com:Re: my product/product_kurts.zip Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/19 Jun 2004 13:42 from .jlucas@duluthymca.org:Re: Error/message_kurts.exe Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/19 Jun 2004 13:42 from mom-e-mail1-owner@lists.mops.org:Mail Del.html Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Deleted Items/19 Jun 2004 13:42 from mom-e-mail1-owner@lists.mops.org:Mail Del/message.scr Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Inbox/30 May 2004 08:38 from amyers@smdc.org:Mail Delivery (failure ku.html Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\Documents and Settings\All Users\Documents\kurt.pst/Personal Folders/Inbox/30 May 2004 08:38 from amyers@smdc.org:Mail Delivery (failure ku/message.scr Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\All Users\Documents\kurt.pst Mail MS Mail: infected - 34, suspicious - 4 skipped C:\Documents and Settings\engineeradmin\Cookies\index.dat Object is locked skipped C:\Documents and Settings\engineeradmin\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\engineeradmin\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\engineeradmin\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\engineeradmin\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\engineeradmin\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\engineeradmin\NTUSER.DAT Object is locked skipped C:\Documents and Settings\engineeradmin\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/07 Jun 2004 21:10 from kevin.b.jocelyn@aexp.com:Mail Delivery (f.html Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/07 Jun 2004 21:10 from kevin.b.jocelyn@aexp.com:Mail Delivery (f/message.scr Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/04 Jun 2004 21:59 from stehpanie.heilig@duluth.k12.mn.us:Mail De.html Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/04 Jun 2004 21:59 from stehpanie.heilig@duluth.k12.mn.us:Mail De/message.scr Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/25 Apr 2004 17:57 from dkknight6@earthlink.com:here, the introdu/myaunt.zip/myaunt.com Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/25 Apr 2004 17:57 from dkknight6@earthlink.com:here, the introdu/myaunt.zip Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/11 May 2004 14:48 from Lilnave:Re: Thanks :)/Document.scr Infected: Email-Worm.Win32.Bagle.z skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/06 May 2004 16:21 from Lilnave:Protected message/text_document.vbs Infected: Email-Worm.Win32.Bagle.z skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/23 Apr 2004 21:37 from help@bangbrosonline.com:hello/shower.zip/shower.htm.scr Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/23 Apr 2004 21:37 from help@bangbrosonline.com:hello/shower.zip Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/28 Apr 2004 15:00 from lylelovett@losthighway.myreg.net:oh/...mation.htm.pif Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/28 Apr 2004 15:00 from lylelovett@losthighway.myreg.net:oh/information.zip Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/04 Jun 2004 19:58 from dana@saduluth.org:my data/data.txt Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/28 Apr 2004 23:58 from bl_00@yahoo.com:question/image.txt.pif Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/29 May 2004 16:49 from joshmcgrawmentor@yahoo.com:Protected Mail/message_kurts.zip/details.txt .pif Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/29 May 2004 16:49 from joshmcgrawmentor@yahoo.com:Protected Mail/message_kurts.zip Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/29 Apr 2004 15:25 from Lilnave:Re: Yahoo!/Smoke.scr Infected: Email-Worm.Win32.Bagle.z skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/03 May 2004 14:19 from Lilnave:Protected message/the_message.cpl Infected: Email-Worm.Win32.Bagle.z skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/28 Apr 2004 08:00 from 022520042246.11585.4fc1@mchsi.com:<S...anking.rtf.exe Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/28 Apr 2004 08:00 from 022520042246.11585.4fc1@mchsi.com:<S...th_ranking.zip Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/19 Jun 2004 13:42 from mom-e-mail1-owner@lists.mops.org:Mail Del.html Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/19 Jun 2004 13:42 from mom-e-mail1-owner@lists.mops.org:Mail Del/message.scr Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/12 May 2004 12:21 from Lilnave:Hidden message/Loves_money.scr Infected: Email-Worm.Win32.Bagle.z skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/10 May 2004 13:31 from Lilnave:RE: Text message/You_will_answer_to_me.hta Infected: Email-Worm.Win32.Bagle.z skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/30 Apr 2004 13:15 from Lilnave:Forum notify/Readme.vbs Infected: Email-Worm.Win32.Bagle.z skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/25 Apr 2004 01:49 from josivan@revealed.net:hi/transfer.exe Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/10 Jun 2004 00:37 from support@symantec.com:Re: Submit a Virus S/datfiles.txt Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/07 Jun 2004 21:10 from annedoug@charter.net:Re: Question/archive.zip/data.rtf .scr Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/07 Jun 2004 21:10 from annedoug@charter.net:Re: Question/archive.zip Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/14 Jun 2004 20:41 from dougwilliams01@hotmail.com:Re: my product/product_kurts.zip/details.txt .pif Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/14 Jun 2004 20:41 from dougwilliams01@hotmail.com:Re: my product/product_kurts.zip Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/28 Apr 2004 13:03 from davidmbrown@dailyobjectivist.com:pretty p/music.zip/music.rtf.scr Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/28 Apr 2004 13:03 from davidmbrown@dailyobjectivist.com:pretty p/music.zip Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/27 Apr 2004 02:21 from dschrin@qconline.com:fake?/aboutyou....outyou.rtf.scr Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/27 Apr 2004 02:21 from dschrin@qconline.com:fake?/aboutyou.zip Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/19 Jun 2004 13:42 from .jlucas@duluthymca.org:Re: Error/message_kurts.exe Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Inbox/30 May 2004 08:38 from amyers@smdc.org:Mail Delivery (failure ku.html Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Inbox/30 May 2004 08:38 from amyers@smdc.org:Mail Delivery (failure ku/message.scr Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\kurts\Local Settings\Application Data\Microsoft\Outlook\outlook.pst Mail MS Mail: infected - 34, suspicious - 4 skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\smsmith\NTUSER.DAT Object is locked skipped C:\Documents and Settings\smsmith\ntuser.dat.LOG Object is locked skipped C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg2.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMNot.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMReg.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMRSt.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\mastlog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\model.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\modellog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\tempdb.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\templog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\LOG\ERRORLOG Object is locked skipped C:\Program Files\Symantec AntiVirus\SAVRT\0443NAV~.TMP Object is locked skipped C:\Program Files\Symantec AntiVirus\SAVRT\0783NAV~.TMP Object is locked skipped C:\qoobox\Quarantine\C\WINDOWS\system32\awtqq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.wb skipped C:\qoobox\Quarantine\C\WINDOWS\system32\ddcya.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.wb skipped C:\qoobox\Quarantine\C\WINDOWS\system32\geedd.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.wb skipped C:\qoobox\Quarantine\C\WINDOWS\system32\ssttu.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.wb skipped C:\RECYCLER\S-1-5-21-4241656290-2351225905-1238294049-1005\Dc10.xls Object is locked skipped C:\RECYCLER\S-1-5-21-4241656290-2351225905-1238294049-1005\Dc11.wav Object is locked skipped C:\RECYCLER\S-1-5-21-4241656290-2351225905-1238294049-1005\Dc12.bmp Object is locked skipped C:\RECYCLER\S-1-5-21-4241656290-2351225905-1238294049-1005\Dc13.pdf Object is locked skipped C:\RECYCLER\S-1-5-21-4241656290-2351225905-1238294049-1005\Dc14.txt Object is locked skipped C:\RECYCLER\S-1-5-21-4241656290-2351225905-1238294049-1005\Dc4.lnk Object is locked skipped C:\RECYCLER\S-1-5-21-4241656290-2351225905-1238294049-1005\Dc5.xls Object is locked skipped C:\RECYCLER\S-1-5-21-4241656290-2351225905-1238294049-1005\Dc6.xls Object is locked skipped C:\RECYCLER\S-1-5-21-4241656290-2351225905-1238294049-1005\Dc7.xls Object is locked skipped C:\RECYCLER\S-1-5-21-4241656290-2351225905-1238294049-1005\Dc8.xls Object is locked skipped C:\RECYCLER\S-1-5-21-4241656290-2351225905-1238294049-1005\Dc9.xls Object is locked skipped C:\RECYCLER\S-1-5-21-4241656290-2351225905-1238294049-500\Dc2.lnk Object is locked skipped C:\RECYCLER\S-1-5-21-4241656290-2351225905-1238294049-500\Dc3.lnk Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\tracking.log Object is locked skipped C:\WINDOWS\$NtUninstallKB824141$\user32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB824141$\win32k.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\accwiz.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\crypt32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\cryptsvc.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\html32.cnv Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\locator.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\magnify.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\migwiz.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\mrxsmb.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\msconv97.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\narrator.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\newdev.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\ntdll.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\ntkrnlpa.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\ntoskrnl.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\osk.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\pchshell.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\raspptp.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\shell32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\srrstr.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\srv.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\sysmain.sdb Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\user32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\win32k.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\winsrv.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\zipfldr.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828028$\msasn1.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\catsrv.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\catsrvut.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\clbcatex.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\clbcatq.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\colbact.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\comadmin.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\comrepl.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\comsvcs.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\comuid.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\es.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\msdtcprx.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\msdtctm.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\msdtcuiu.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\mtxclu.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\mtxoci.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\ole32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\rpcrt4.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\rpcss.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\txflog.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\callcont.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\cmdevtgprov.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\gdi32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\h323.tsp Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\h323msp.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\helpctr.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\ipnathlp.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\lsasrv.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\mf3216.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\msasn1.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\msgina.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\mst120.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\netapi32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\nmcom.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\rtcdll.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\schannel.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\dao360.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\expsrv.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msexch40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msexcl40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msjet40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msjetoledb40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msjint40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msjter40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msjtes40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msltus40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\mspbde40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msrd2x40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msrd3x40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msrepl40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\mstext40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\mswdat10.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\mswstr10.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msxbde40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\vbajet32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB839645$\fldrclnr.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB839645$\shell32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB839645$\shlwapi.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB839645$\sxs.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB839645$\xpsp2res.dll Object is locked skipped C:\WINDOWS\$NtUninstallQ828026$\msdxm.ocx Object is locked skipped C:\WINDOWS\$NtUninstallQ828026$\wmpcore.dll Object is locked skipped C:\WINDOWS\Debug\Netlogon.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\Perflib_Perfdata_1d4.dat Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. (continued) |
|
|
|
|
10-02-2007, 12:36 PM
|
#11 (permalink) |
|
Registered User
Join Date: Dec 2004
Location: Mid-West
Posts: 180
OS: 2003/XP/Vista
|
Re: Need a binary shotgun for Trojan.Vundo
Here is a Hijack This log file just run:
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 1:27:52 PM, on 10/2/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\Cpqdiag\Cpqdfwag.exe C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe C:\Program Files\Dantz\Retrospect\retrorun.exe C:\Program Files\Symantec AntiVirus\SavRoam.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\igfxtray.exe C:\WINDOWS\System32\hkcmd.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\Analog Devices\SoundMAX\SMTray.exe C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\SYMANT~2\VPTray.exe C:\Program Files\palmOne\Hotsync.exe C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe C:\Compaq\EAKDRV\EAUSBKBD.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe C:\WINDOWS\system32\NOTEPAD.EXE E:\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0409/bl8.asp R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.compaq.com/1Q00CDT/0409/bl7.asp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0409/bl8.asp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon O4 - HKLM\..\RunServices: [CPQDFWAG] C:\WINDOWS\Cpqdiag\CpqDfwAg.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-21-3562460209-2567462824-1891167130-1199\..\Run: [BurntCookies] C:\Program Files\Andersson Digital Design\Burnt Cookies\Burnt Cookies.exe /h (User 'smsmith') O4 - HKUS\S-1-5-21-4241656290-2351225905-1238294049-500\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User 'Administrator') O4 - S-1-5-21-3562460209-2567462824-1891167130-1199 Startup: PowerReg Scheduler.exe (User 'smsmith') O4 - S-1-5-21-3562460209-2567462824-1891167130-1199 Startup: Shortcut to ISCAlert.exe.lnk = Program Files\ISC Alert\ISCAlert.exe (User 'smsmith') O4 - S-1-5-21-3562460209-2567462824-1891167130-1199 User Startup: PowerReg Scheduler.exe (User 'smsmith') O4 - S-1-5-21-3562460209-2567462824-1891167130-1199 User Startup: Shortcut to ISCAlert.exe.lnk = Program Files\ISC Alert\ISCAlert.exe (User 'smsmith') O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: kwqc.adconnections.com O15 - Trusted Zone: secure-kwqc.adconnections.com O15 - Trusted Zone: *.kwqc-camio O15 - Trusted Zone: www.nfcimages.com O15 - Trusted Zone: *.web01nyc O15 - Trusted Zone: http://*.web01nyc O15 - Trusted Zone: install.worldnow.com O15 - Trusted Zone: managekwqc.worldnow.com O15 - Trusted IP range: 192.168.15.84 O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {4346AA08-289A-499A-AAA5-F3BF3FD2E48A} (AdConnections.c02) - http://logon.adconnections.com/compo...ectionsC02.CAB O16 - DPF: {BB45984B-5D74-44D3-9171-77D785D3A30A} (AdConnections.c01) - http://logon.adconnections.com/compo...ectionsC01.CAB O16 - DPF: {D30CA0FD-1CA0-11D4-AC78-006008A9A8BC} (WebBasedClientInstall Class) - http://dbierman/nav98clientinstall/webinst.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = kwqc.com O17 - HKLM\Software\..\Telephony: DomainName = kwqc.com O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = kwqc.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = kwqc.com O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Remote Diagnostics Enabling Agent (DfwWebAgent) - Hewlett-Packard - C:\WINDOWS\Cpqdiag\Cpqdfwag.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\retrorun.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe -- End of file - 8200 bytes No problems were encountered while running the above steps. I'm in the process of the new version Java. Thanks again for your help. |
|
|
|
|
10-02-2007, 12:49 PM
|
#12 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,350
OS: N/A
|
Re: Need a binary shotgun for Trojan.Vundo
Please logon as the user @Kurt.
Then launch Outlook/Outlook Express to delete these emails ... * 30 May 2004 08:38 from amyers@smdc.org:Mail Delivery Empty the deleted items folder when you're done. -------------- C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\ is your antivirus program's quarantine cache. You should delete the contents. Please use Symantec's guide to remove the files from quarantine. http://service1.symantec.com/SUPPORT...on=1#_Section1 ------------ Now that the system is clean, kindly follow these simple steps in order to keep your computer clean and secure:
Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://computercops.biz/postlite7736-.html After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day.  Kindly respond to this thread once more so we can mark this thread as resolved.
__________________
Question - what have you done for the community today? |
|
|
|
| Thread Tools | |
|
|
