Suspected malware

Robbyj717 · 06-09-2008, 03:10 AM

Hey, how's it going. I have a malware problem and apparently the problem is way over my head. I get constant warnings on my toolbar and it directs me to anti-spyware sites. Also, it locks my task manager and changes my desktop background to a warning that says "Warning: Spyware threat has beeen detected on your PC" (and yes, been is spelled wrong, not a typo) that has a link to an anti-spyware site. I use McAfee and I have run several spyware programs with no luck. Anyway, any help you could provide would be very much appreciated. Thanks, here's the log:

Deckard's System Scanner v20071014.68
Run by Owner on 2008-06-09 04:07:16
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-06-09 04:07:47
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\iftuyszv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\SiteAdvisor\6145\SiteAdv.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\gearsec.exe
C:\Program Files\McAfee\MSC\mcmscsvc.exe
C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
C:\Program Files\Common Files\McAfee\McProxy\McProxy.exe
C:\Program Files\McAfee\VirusScan\Mcshield.exe
C:\Program Files\McAfee\MPF\MpfSrv.exe
C:\Program Files\McAfee\MSK\msksrver.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\SiteAdvisor\6145\SAService.exe
C:\WINDOWS\system32\alg.exe
C:\Program Files\McAfee\VirusScan\mcsysmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\Desktop\dss.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsoft.com/access/autosearch.asp?p=%s
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\iftuyszv.exe,
O2 - BHO: (no name) - {00110011-4b0b-44d5-9718-90c88817369b} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {086ae192-23a6-48d6-96ec-715f53797e85} - (no file)
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6145\SiteAdv.dll
O2 - BHO: (no name) - {150fa160-130d-451f-b863-b655061432ba} - (no file)
O2 - BHO: (no name) - {17da0c9e-4a27-4ac5-bb75-5d24b8cdb972} - (no file)
O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb1} - (no file)
O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb2} - (no file)
O2 - BHO: (no name) - {2d38a51a-23c9-48a1-a33c-48675aa2b494} - (no file)
O2 - BHO: (no name) - {2e9caff6-30c7-4208-8807-e79d4ec6f806} - (no file)
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - C:\Program Files\McAfee\MSK\mcapbho.dll
O2 - BHO: (no name) - {467faeb2-5f5b-4c81-bae0-2a4752ca7f4e} - (no file)
O2 - BHO: (no name) - {5321e378-ffad-4999-8c62-03ca8155f0b3} - (no file)
O2 - BHO: (no name) - {587dbf2d-9145-4c9e-92c2-1f953da73773} - (no file)
O2 - BHO: (no name) - {6cc1c91a-ae8b-4373-a5b4-28ba1851e39a} - (no file)
O2 - BHO: (no name) - {79369d5c-2903-4b7a-ade2-d5e0dee14d24} - (no file)
O2 - BHO: (no name) - {799a370d-5993-4887-9df7-0a4756a77d00} - (no file)
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: (no name) - {98dbbf16-ca43-4c33-be80-99e6694468a4} - (no file)
O2 - BHO: (no name) - {a55581dc-2cdb-4089-8878-71a080b22342} - (no file)
O2 - BHO: (no name) - {b847676d-72ac-4393-bfff-43a1eb979352} - (no file)
O2 - BHO: (no name) - {bc97b254-b2b9-4d40-971d-78e0978f5f26} - (no file)
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765721306} - (no file)
O2 - BHO: (no name) - {e2ddf680-9905-4dee-8c64-0a5de7fe133c} - (no file)
O2 - BHO: (no name) - {e3eebbe8-9cab-4c76-b26a-747e25ebb4c6} - (no file)
O2 - BHO: (no name) - {e7afff2a-1b57-49c7-bf6b-e5123394c970} - (no file)
O2 - BHO: (no name) - {F632550A-A855-4203-983A-0C2362C98401} - C:\WINDOWS\system32\qoMeBqRK.dll (file missing)
O2 - BHO: (no name) - {fcaddc14-bd46-408a-9842-cdbe1c6d37eb} - (no file)
O2 - BHO: (no name) - {fd9bc004-8331-4457-b830-4759ff704c22} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O2 - BHO: (no name) - {ff1bf4c7-4e08-4a28-a43f-9d60a9f7a880} - (no file)
O3 - Toolbar: (no name) - - (no file)
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6145\SiteAdv.dll
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6145\SiteAdv.exe
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [BMaf8893fe] Rundll32.exe "C:\WINDOWS\system32\cxvhxoks.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableTaskMgr=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableTaskMgr=1
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...p=ZRxdm678NTUS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} () - http://ak.exe.imgfarm.com/images/noc...tup1.0.1.0.cab
O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h20264.www2.hp.com/ediags/dd/...osticsxp2k.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1207881416890
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://ak.imgag.com/imgag/cp/install/Crusher.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://plugin.driveragent.com/files/driveragent.cab
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6145\SiteAdv.dll
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McProxy\McProxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\Mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MpfSrv.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\msksrver.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6145\SAService.exe

--
End of file - 9199 bytes

-- Files created between 2008-05-09 and 2008-06-09 -----------------------------

2008-06-09 03:33:14 0 d-------- C:\Program Files\SpywareBlaster
2008-06-09 03:27:15 23040 --a------ C:\WINDOWS\window.exe
2008-06-09 03:27:15 26880 --a------ C:\WINDOWS\svchost32.exe
2008-06-09 03:27:15 21504 --a------ C:\WINDOWS\quicken.exe
2008-06-09 03:27:14 11264 --a------ C:\WINDOWS\notepad32.exe
2008-06-09 03:27:14 16128 --a------ C:\WINDOWS\msupdate.exe
2008-06-09 03:27:14 26112 --a------ C:\WINDOWS\mssys.exe
2008-06-09 03:27:14 14080 --a------ C:\WINDOWS\msconfd.dll
2008-06-09 03:27:14 19968 --a------ C:\WINDOWS\internet.exe
2008-06-09 03:27:14 15616 --a------ C:\WINDOWS\iexplorer.exe
2008-06-09 03:27:13 15616 --a------ C:\WINDOWS\iedll.exe
2008-06-09 03:27:13 9984 --a------ C:\WINDOWS\editpad.exe
2008-06-09 02:29:42 1152 --a------ C:\WINDOWS\system32\windrv.sys
2008-06-09 02:29:27 0 d-------- C:\Program Files\Common Files\Download Manager
2008-06-09 01:49:40 0 d-------- C:\Program Files\Enigma Software Group
2008-06-09 01:38:18 9472 --a------ C:\WINDOWS\systemcritical.exe
2008-06-09 01:31:46 0 dr------- C:\Documents and Settings\Administrator\Favorites
2008-06-09 01:31:46 0 d-------- C:\Documents and Settings\Administrator\Desktop
2008-06-09 01:31:46 0 d--hs---- C:\Documents and Settings\Administrator\Cookies
2008-06-09 01:31:46 0 dr-h----- C:\Documents and Settings\Administrator\Application Data
2008-06-09 01:31:46 0 d-------- C:\Documents and Settings\Administrator\Application Data\Symantec
2008-06-09 01:31:46 0 d-------- C:\Documents and Settings\Administrator\Application Data\Sun
2008-06-09 01:31:46 0 d-------- C:\Documents and Settings\Administrator\Application Data\SampleView
2008-06-09 01:31:46 0 d-------- C:\Documents and Settings\Administrator\Application Data\Real
2008-06-09 01:31:46 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2008-06-09 01:31:46 0 d-------- C:\Documents and Settings\Administrator\Application Data\Identities
2008-06-09 01:31:45 0 d-------- C:\Documents and Settings\Administrator\WINDOWS
2008-06-09 01:31:45 0 d--h----- C:\Documents and Settings\Administrator\Templates
2008-06-09 01:31:45 0 dr------- C:\Documents and Settings\Administrator\Start Menu
2008-06-09 01:31:45 0 dr-h----- C:\Documents and Settings\Administrator\SendTo
2008-06-09 01:31:45 0 dr-h----- C:\Documents and Settings\Administrator\Recent
2008-06-09 01:31:45 0 d--h----- C:\Documents and Settings\Administrator\PrintHood
2008-06-09 01:31:45 0 d--h----- C:\Documents and Settings\Administrator\NetHood
2008-06-09 01:31:45 0 dr------- C:\Documents and Settings\Administrator\My Documents
2008-06-09 01:31:45 0 d--h----- C:\Documents and Settings\Administrator\Local Settings
2008-06-09 01:31:44 1048576 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT
2008-06-09 01:26:25 21504 --a------ C:\WINDOWS\y.exe
2008-06-09 01:26:24 18944 --a------ C:\WINDOWS\xplugin.dll
2008-06-09 01:26:24 22016 --a------ C:\WINDOWS\x.exe
2008-06-09 01:26:24 23296 --a------ C:\WINDOWS\winmgnt.exe
2008-06-09 01:26:23 20992 --a------ C:\WINDOWS\winajbm.dll
2008-06-09 01:26:23 12032 --a------ C:\WINDOWS\win64.exe
2008-06-09 01:26:23 19968 --a------ C:\WINDOWS\win32e.exe
2008-06-09 01:26:22 28160 --a------ C:\WINDOWS\waol.exe
2008-06-09 01:26:22 19712 --a------ C:\WINDOWS\users32.exe
2008-06-09 01:26:22 9728 --a------ C:\WINDOWS\time.exe
2008-06-09 01:26:21 18176 --a------ C:\WINDOWS\systeem.exe
2008-06-09 01:26:21 24320 --a------ C:\WINDOWS\olehelp.exe
2008-06-09 01:26:20 18944 --a------ C:\WINDOWS\mtwirl32.dll
2008-06-09 01:26:20 13568 --a------ C:\WINDOWS\loader.exe
2008-06-09 01:26:20 18176 --a------ C:\WINDOWS\cpan.dll
2008-06-09 01:26:20 20480 --a------ C:\WINDOWS\clrssn.exe
2008-06-09 01:26:20 23808 --a------ C:\WINDOWS\avpcc.dll
2008-06-09 01:26:19 26112 --a------ C:\WINDOWS\accesss.exe
2008-06-09 01:22:39 25600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-06-09 01:08:13 22272 --a------ C:\WINDOWS\rundll16.exe
2008-06-09 00:58:42 0 d-------- C:\Program Files\Spyware Doctor
2008-06-08 23:54:48 53248 --a------ C:\WINDOWS\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2008-06-08 21:56:54 880 --a------ C:\WINDOWS\system32\tmp.reg
2008-06-08 21:56:06 82944 --a------ C:\WINDOWS\system32\404Fix.exe <Not Verified; S!Ri.URZ; IEDFix>
2008-06-08 21:56:05 289144 --a------ C:\WINDOWS\system32\VCCLSID.exe <Not Verified; S!Ri; >
2008-06-08 21:56:05 86528 --a------ C:\WINDOWS\system32\VACFix.exe <Not Verified; S!Ri.URZ; VACFix>
2008-06-08 21:56:05 82944 --a------ C:\WINDOWS\system32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix>
2008-06-08 21:56:04 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2008-06-08 21:56:04 51200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-06-08 21:22:09 0 d-------- C:\Documents and Settings\LocalService\Application Data\SiteAdvisor
2008-06-08 21:21:51 0 d-------- C:\Program Files\SiteAdvisor
2008-06-08 21:21:51 0 d-------- C:\Documents and Settings\Owner\Application Data\SiteAdvisor
2008-06-08 21:21:51 0 d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-06-08 21:19:37 143360 --a------ C:\WINDOWS\system32\dunzip32.dll <Not Verified; Inner Media, Inc.; DynaZIP-32 Multi-Threading UnZIP DLL>
2008-06-08 21:15:21 0 d-------- C:\Program Files\McAfee.com
2008-06-08 21:15:05 0 d-------- C:\Program Files\Common Files\McAfee
2008-06-08 21:14:55 0 d-------- C:\Program Files\McAfee
2008-06-08 21:08:58 0 d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2008-06-08 21:08:48 100864 --a------ C:\WINDOWS\system32\cxvhxoks.dll
2008-06-08 21:08:00 0 d-------- C:\WINDOWS\system32\5076
2008-06-08 21:07:55 55808 --a------ C:\WINDOWS\portsv.exe
2008-06-05 09:00:27 0 dr-h----- C:\Documents and Settings\Owner\Recent
2008-06-04 21:21:15 116224 --a------ C:\WINDOWS\system32\tvuuioqx.dll
2008-06-04 21:20:21 0 d-------- C:\Program Files\?icrosoft
2008-06-04 21:15:15 131584 --a------ C:\WINDOWS\system32\lopopuju.dll
2008-06-04 21:13:07 125952 --a------ C:\WINDOWS\system32\nvfweblw.dll
2008-06-04 16:11:21 22528 --a------ C:\WINDOWS\svcinit.exe
2008-06-04 16:11:21 13056 --a------ C:\WINDOWS\sistem.exe
2008-06-04 16:11:20 20480 --a------ C:\WINDOWS\searchword.dll
2008-06-04 16:11:20 12288 --a------ C:\WINDOWS\qttasks.exe
2008-06-04 16:11:19 30208 --a------ C:\WINDOWS\mswsc20.dll
2008-06-04 16:11:19 24064 --a------ C:\WINDOWS\mswsc10.dll
2008-06-04 16:11:18 11008 --a------ C:\WINDOWS\msspi.dll
2008-06-04 16:11:18 15872 --a------ C:\WINDOWS\inetinf.exe
2008-06-04 16:11:18 9472 --a------ C:\WINDOWS\helpcvs.exe
2008-06-04 16:11:17 20992 --a------ C:\WINDOWS\gfmnaaa.dll
2008-06-04 16:11:17 21504 --a------ C:\WINDOWS\funny.exe
2008-06-04 16:11:17 21504 --a------ C:\WINDOWS\funniest.exe
2008-06-04 16:11:17 26368 --a------ C:\WINDOWS\explorer32.exe
2008-06-04 16:11:17 11520 --a------ C:\WINDOWS\explore.exe
2008-06-04 16:11:16 32256 --a------ C:\WINDOWS\dnsrelay.dll
2008-06-04 16:11:16 10752 --a------ C:\WINDOWS\directx32.exe
2008-06-04 16:11:16 9472 --a------ C:\WINDOWS\ctrlpan.dll
2008-06-04 16:11:16 29184 --a------ C:\WINDOWS\ctfmon32.exe
2008-06-04 16:09:54 401972 --a------ C:\WINDOWS\system32\g3.exe
2008-06-04 11:41:41 738847 --ahs---- C:\WINDOWS\system32\KRqBeMoq.ini2
2008-06-04 11:37:25 0 d-------- C:\Documents and Settings\LocalService\Application Data\Macromedia
2008-06-04 11:37:24 0 d-------- C:\Documents and Settings\LocalService\Application Data\Adobe
2008-06-04 11:37:10 860 --a------ C:\WINDOWS\system32\winpfz33.sys
2008-06-04 11:37:05 0 dr------- C:\Documents and Settings\LocalService\Favorites
2008-06-04 11:37:02 4 --a------ C:\WINDOWS\system32\hljwugsf.bin
2008-06-04 11:36:59 88961 --a------ C:\WINDOWS\system32\mysidesearch_sidebar_uninstall.exe
2008-06-04 11:36:54 87513 --a------ C:\WINDOWS\system32\iftuyszv.exe <Not Verified; Microsoft; XML Media>
2008-06-04 11:36:54 87513 --a------ C:\WINDOWS\lfn.exe <Not Verified; Microsoft; XML Media>
2008-06-04 11:36:53 298311 --a------ C:\WINDOWS\system32\gside.exe
2008-06-04 11:36:38 86144 --a------ C:\WINDOWS\system32\drivers\hidirr.sys
2008-06-04 11:36:36 0 d-------- C:\WINDOWS\system32\fIE
2008-06-04 11:36:35 0 d-------- C:\WINDOWS\system32\Vco1
2008-06-04 11:36:35 0 d-------- C:\WINDOWS\system32\sTMP
2008-06-04 11:36:35 0 d-------- C:\WINDOWS\system32\Dev3
2008-06-04 11:36:35 0 d-------- C:\WINDOWS\system32\a053
2008-06-04 11:36:35 0 d-------- C:\WINDOWS\system32\6026c
2008-06-04 11:36:29 0 d-------- C:\WINDOWS\system32\vntiho01

-- Find3M Report ---------------------------------------------------------------

2008-06-09 02:29:27 0 d-------- C:\Program Files\Common Files
2008-06-08 21:13:46 0 d-------- C:\Program Files\Symantec
2008-06-08 21:13:44 0 d-------- C:\Program Files\Norton AntiVirus
2008-06-05 09:11:35 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-06-04 21:20:24 0 d-------- C:\Program Files\?icrosoft
2008-05-13 14:05:25 0 d-------- C:\Program Files\World of Warcraft
2008-04-14 23:02:34 0 d-------- C:\Program Files\Messenger
2008-04-11 16:55:16 0 d-------- C:\Program Files\Quicken
2008-04-11 16:44:39 0 --a------ C:\WINDOWS\ativpsrm.bin
2008-04-11 16:33:03 0 d-------- C:\Documents and Settings\Owner\Application Data\Uniblue
2008-04-11 16:30:19 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-04-10 22:19:15 0 d-------- C:\Program Files\Movie Maker
2008-04-10 22:18:52 0 d-------- C:\Program Files\Windows NT
2008-04-10 21:28:12 0 d--h----- C:\Program Files\WindowsUpdate
2008-04-10 21:27:17 3884 --a------ C:\WINDOWS\viassary-hp.reg
2008-04-10 21:17:24 0 d-------- C:\Documents and Settings\Owner\Application Data\Real
2008-04-09 08:27:50 0 d-------- C:\Program Files\ATI

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00110011-4b0b-44d5-9718-90c88817369b}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{086ae192-23a6-48d6-96ec-715f53797e85}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{150fa160-130d-451f-b863-b655061432ba}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{17da0c9e-4a27-4ac5-bb75-5d24b8cdb972}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb1}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb2}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2d38a51a-23c9-48a1-a33c-48675aa2b494}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2e9caff6-30c7-4208-8807-e79d4ec6f806}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{377C180E-6F0E-4D4C-980F-F45BD3D40CF4}]
11/26/2007 10:46 AM 324936 --a------ c:\PROGRA~1\mcafee\msk\mcapbho.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{467faeb2-5f5b-4c81-bae0-2a4752ca7f4e}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5321e378-ffad-4999-8c62-03ca8155f0b3}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{587dbf2d-9145-4c9e-92c2-1f953da73773}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6cc1c91a-ae8b-4373-a5b4-28ba1851e39a}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{79369d5c-2903-4b7a-ade2-d5e0dee14d24}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{799a370d-5993-4887-9df7-0a4756a77d00}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{98dbbf16-ca43-4c33-be80-99e6694468a4}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a55581dc-2cdb-4089-8878-71a080b22342}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b847676d-72ac-4393-bfff-43a1eb979352}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bc97b254-b2b9-4d40-971d-78e0978f5f26}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cf021f40-3e14-23a5-cba2-717765721306}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e2ddf680-9905-4dee-8c64-0a5de7fe133c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e3eebbe8-9cab-4c76-b26a-747e25ebb4c6}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e7afff2a-1b57-49c7-bf6b-e5123394c970}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F632550A-A855-4203-983A-0C2362C98401}]
C:\WINDOWS\system32\qoMeBqRK.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fd9bc004-8331-4457-b830-4759ff704c22}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ff1bf4c7-4e08-4a28-a43f-9d60a9f7a880}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6145\SiteAdv.exe" [06/21/2007 03:06 PM]
"McENUI"="C:\PROGRA~1\McAfee\MHN\McENUI.exe" [11/30/2007 05:42 AM]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [11/01/2007 07:12 PM]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [04/10/2008 03:14 PM]
"BMaf8893fe"="C:\WINDOWS\system32\cxvhxoks.dll" [06/08/2008 09:08 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:56 AM]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 11:24 AM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\iftuyszv.exe,"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\qoMeBqRK

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

-- End of Deckard's System Scanner: finished at 2008-06-09 04:08:50 ------------

Robbyj717 · 06-12-2008, 03:20 AM

/bump

**TheBruce1** · 06-15-2008, 10:01 AM

Hello

Apologises for the delay getting to your log. The helpers here are all volunteers and we have been very busy lately. If you are still having malware problems, follow instructions below.

========

Please run Deckard's System Scanner once again, this time using these instructions:

Click the Windows 'Start' button > Select 'Run' - then copy/paste this into the run box & click OK

"%userprofile%\desktop\dss.exe" /config

Click on Extra Log and tick all boxes below that.

Click Scan!

When finished, it shall produce two logs for you. Post those logs in your next reply.

========
Logs Required
C:\Deckard\System Scanner\main.txt
C:\Deckard\System Scanner\extra.txt<----Attached

Robbyj717 · 06-16-2008, 08:06 PM

Thanks for the response. Here's the new log.

Deckard's System Scanner v20071014.68
Run by Owner on 2008-06-16 21:01:42
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-06-16 21:02:12
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\iftuyszv.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\SiteAdvisor\6145\SiteAdv.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\gearsec.exe
C:\Program Files\McAfee\MSC\mcmscsvc.exe
C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
C:\Program Files\Common Files\McAfee\McProxy\McProxy.exe
C:\Program Files\McAfee\VirusScan\Mcshield.exe
C:\Program Files\McAfee\MPF\MpfSrv.exe
C:\Program Files\McAfee\MSK\msksrver.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\SiteAdvisor\6145\SAService.exe
C:\WINDOWS\system32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\McAfee\VirusScan\mcsysmon.exe
C:\Program Files\McAfee\MSC\mcuimgr.exe
C:\Documents and Settings\Owner\Desktop\dss.exe
C:\Program Files\McAfee\VirusScan\mcods.exe
C:\Program Files\McAfee\VirusScan\mcvsshld.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsoft.com/access/autosearch.asp?p=%s
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\iftuyszv.exe,
O2 - BHO: (no name) - {00110011-4b0b-44d5-9718-90c88817369b} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {086ae192-23a6-48d6-96ec-715f53797e85} - (no file)
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6145\SiteAdv.dll
O2 - BHO: (no name) - {150fa160-130d-451f-b863-b655061432ba} - (no file)
O2 - BHO: (no name) - {17da0c9e-4a27-4ac5-bb75-5d24b8cdb972} - (no file)
O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb1} - (no file)
O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb2} - (no file)
O2 - BHO: (no name) - {2d38a51a-23c9-48a1-a33c-48675aa2b494} - (no file)
O2 - BHO: (no name) - {2e9caff6-30c7-4208-8807-e79d4ec6f806} - (no file)
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - C:\Program Files\McAfee\MSK\mcapbho.dll
O2 - BHO: (no name) - {467faeb2-5f5b-4c81-bae0-2a4752ca7f4e} - (no file)
O2 - BHO: (no name) - {5321e378-ffad-4999-8c62-03ca8155f0b3} - (no file)
O2 - BHO: (no name) - {587dbf2d-9145-4c9e-92c2-1f953da73773} - (no file)
O2 - BHO: (no name) - {6cc1c91a-ae8b-4373-a5b4-28ba1851e39a} - (no file)
O2 - BHO: (no name) - {79369d5c-2903-4b7a-ade2-d5e0dee14d24} - (no file)
O2 - BHO: (no name) - {799a370d-5993-4887-9df7-0a4756a77d00} - (no file)
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: (no name) - {98dbbf16-ca43-4c33-be80-99e6694468a4} - (no file)
O2 - BHO: (no name) - {a55581dc-2cdb-4089-8878-71a080b22342} - (no file)
O2 - BHO: (no name) - {b847676d-72ac-4393-bfff-43a1eb979352} - (no file)
O2 - BHO: (no name) - {bc97b254-b2b9-4d40-971d-78e0978f5f26} - (no file)
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765721306} - (no file)
O2 - BHO: (no name) - {e2ddf680-9905-4dee-8c64-0a5de7fe133c} - (no file)
O2 - BHO: (no name) - {e3eebbe8-9cab-4c76-b26a-747e25ebb4c6} - (no file)
O2 - BHO: (no name) - {e7afff2a-1b57-49c7-bf6b-e5123394c970} - (no file)
O2 - BHO: (no name) - {F632550A-A855-4203-983A-0C2362C98401} - C:\WINDOWS\system32\qoMeBqRK.dll (file missing)
O2 - BHO: (no name) - {fcaddc14-bd46-408a-9842-cdbe1c6d37eb} - (no file)
O2 - BHO: (no name) - {fd9bc004-8331-4457-b830-4759ff704c22} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O2 - BHO: (no name) - {ff1bf4c7-4e08-4a28-a43f-9d60a9f7a880} - (no file)
O3 - Toolbar: (no name) - - (no file)
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6145\SiteAdv.dll
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6145\SiteAdv.exe
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [BMaf8893fe] Rundll32.exe "C:\WINDOWS\system32\cxvhxoks.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableTaskMgr=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableTaskMgr=1
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...p=ZRxdm678NTUS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} () - http://ak.exe.imgfarm.com/images/noc...tup1.0.1.0.cab
O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h20264.www2.hp.com/ediags/dd/...osticsxp2k.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1207881416890
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://ak.imgag.com/imgag/cp/install/Crusher.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://plugin.driveragent.com/files/driveragent.cab
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6145\SiteAdv.dll
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McProxy\McProxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\Mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MpfSrv.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\msksrver.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6145\SAService.exe

--
End of file - 9317 bytes

-- Files created between 2008-05-16 and 2008-06-16 -----------------------------

2008-06-16 20:59:00 0 d-------- C:\WINDOWS\LastGood
2008-06-09 03:33:14 0 d-------- C:\Program Files\SpywareBlaster
2008-06-09 03:27:15 23040 --a------ C:\WINDOWS\window.exe
2008-06-09 03:27:15 26880 --a------ C:\WINDOWS\svchost32.exe
2008-06-09 03:27:15 21504 --a------ C:\WINDOWS\quicken.exe
2008-06-09 03:27:14 11264 --a------ C:\WINDOWS\notepad32.exe
2008-06-09 03:27:14 16128 --a------ C:\WINDOWS\msupdate.exe
2008-06-09 03:27:14 26112 --a------ C:\WINDOWS\mssys.exe
2008-06-09 03:27:14 14080 --a------ C:\WINDOWS\msconfd.dll
2008-06-09 03:27:14 19968 --a------ C:\WINDOWS\internet.exe
2008-06-09 03:27:14 15616 --a------ C:\WINDOWS\iexplorer.exe
2008-06-09 03:27:13 15616 --a------ C:\WINDOWS\iedll.exe
2008-06-09 03:27:13 9984 --a------ C:\WINDOWS\editpad.exe
2008-06-09 02:29:42 1152 --a------ C:\WINDOWS\system32\windrv.sys
2008-06-09 02:29:27 0 d-------- C:\Program Files\Common Files\Download Manager
2008-06-09 01:49:40 0 d-------- C:\Program Files\Enigma Software Group
2008-06-09 01:38:18 9472 --a------ C:\WINDOWS\systemcritical.exe
2008-06-09 01:31:46 0 dr------- C:\Documents and Settings\Administrator\Favorites
2008-06-09 01:31:46 0 d-------- C:\Documents and Settings\Administrator\Desktop
2008-06-09 01:31:46 0 d--hs---- C:\Documents and Settings\Administrator\Cookies
2008-06-09 01:31:46 0 dr-h----- C:\Documents and Settings\Administrator\Application Data
2008-06-09 01:31:46 0 d-------- C:\Documents and Settings\Administrator\Application Data\Symantec
2008-06-09 01:31:46 0 d-------- C:\Documents and Settings\Administrator\Application Data\Sun
2008-06-09 01:31:46 0 d-------- C:\Documents and Settings\Administrator\Application Data\SampleView
2008-06-09 01:31:46 0 d-------- C:\Documents and Settings\Administrator\Application Data\Real
2008-06-09 01:31:46 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2008-06-09 01:31:46 0 d-------- C:\Documents and Settings\Administrator\Application Data\Identities
2008-06-09 01:31:45 0 d-------- C:\Documents and Settings\Administrator\WINDOWS
2008-06-09 01:31:45 0 d--h----- C:\Documents and Settings\Administrator\Templates
2008-06-09 01:31:45 0 dr------- C:\Documents and Settings\Administrator\Start Menu
2008-06-09 01:31:45 0 dr-h----- C:\Documents and Settings\Administrator\SendTo
2008-06-09 01:31:45 0 dr-h----- C:\Documents and Settings\Administrator\Recent
2008-06-09 01:31:45 0 d--h----- C:\Documents and Settings\Administrator\PrintHood
2008-06-09 01:31:45 0 d--h----- C:\Documents and Settings\Administrator\NetHood
2008-06-09 01:31:45 0 dr------- C:\Documents and Settings\Administrator\My Documents
2008-06-09 01:31:45 0 d--h----- C:\Documents and Settings\Administrator\Local Settings
2008-06-09 01:31:44 1048576 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT
2008-06-09 01:26:25 21504 --a------ C:\WINDOWS\y.exe
2008-06-09 01:26:24 18944 --a------ C:\WINDOWS\xplugin.dll
2008-06-09 01:26:24 22016 --a------ C:\WINDOWS\x.exe
2008-06-09 01:26:24 23296 --a------ C:\WINDOWS\winmgnt.exe
2008-06-09 01:26:23 20992 --a------ C:\WINDOWS\winajbm.dll
2008-06-09 01:26:23 12032 --a------ C:\WINDOWS\win64.exe
2008-06-09 01:26:23 19968 --a------ C:\WINDOWS\win32e.exe
2008-06-09 01:26:22 28160 --a------ C:\WINDOWS\waol.exe
2008-06-09 01:26:22 19712 --a------ C:\WINDOWS\users32.exe
2008-06-09 01:26:22 9728 --a------ C:\WINDOWS\time.exe
2008-06-09 01:26:21 18176 --a------ C:\WINDOWS\systeem.exe
2008-06-09 01:26:21 24320 --a------ C:\WINDOWS\olehelp.exe
2008-06-09 01:26:20 18944 --a------ C:\WINDOWS\mtwirl32.dll
2008-06-09 01:26:20 13568 --a------ C:\WINDOWS\loader.exe
2008-06-09 01:26:20 18176 --a------ C:\WINDOWS\cpan.dll
2008-06-09 01:26:20 20480 --a------ C:\WINDOWS\clrssn.exe
2008-06-09 01:26:20 23808 --a------ C:\WINDOWS\avpcc.dll
2008-06-09 01:26:19 26112 --a------ C:\WINDOWS\accesss.exe
2008-06-09 01:22:39 25600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-06-09 01:08:13 22272 --a------ C:\WINDOWS\rundll16.exe
2008-06-09 00:58:42 0 d-------- C:\Program Files\Spyware Doctor
2008-06-08 23:54:48 53248 --a------ C:\WINDOWS\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2008-06-08 21:56:54 880 --a------ C:\WINDOWS\system32\tmp.reg
2008-06-08 21:56:06 82944 --a------ C:\WINDOWS\system32\404Fix.exe <Not Verified; S!Ri.URZ; IEDFix>
2008-06-08 21:56:05 289144 --a------ C:\WINDOWS\system32\VCCLSID.exe <Not Verified; S!Ri; >
2008-06-08 21:56:05 86528 --a------ C:\WINDOWS\system32\VACFix.exe <Not Verified; S!Ri.URZ; VACFix>
2008-06-08 21:56:05 82944 --a------ C:\WINDOWS\system32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix>
2008-06-08 21:56:04 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2008-06-08 21:56:04 51200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-06-08 21:22:09 0 d-------- C:\Documents and Settings\LocalService\Application Data\SiteAdvisor
2008-06-08 21:21:51 0 d-------- C:\Program Files\SiteAdvisor
2008-06-08 21:21:51 0 d-------- C:\Documents and Settings\Owner\Application Data\SiteAdvisor
2008-06-08 21:21:51 0 d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-06-08 21:19:37 143360 --a------ C:\WINDOWS\system32\dunzip32.dll <Not Verified; Inner Media, Inc.; DynaZIP-32 Multi-Threading UnZIP DLL>
2008-06-08 21:15:21 0 d-------- C:\Program Files\McAfee.com
2008-06-08 21:15:05 0 d-------- C:\Program Files\Common Files\McAfee
2008-06-08 21:14:55 0 d-------- C:\Program Files\McAfee
2008-06-08 21:08:58 0 d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2008-06-08 21:08:48 100864 --a------ C:\WINDOWS\system32\cxvhxoks.dll
2008-06-08 21:08:00 0 d-------- C:\WINDOWS\system32\5076
2008-06-08 21:07:55 55808 --a------ C:\WINDOWS\portsv.exe
2008-06-05 09:00:27 0 dr-h----- C:\Documents and Settings\Owner\Recent
2008-06-04 21:21:15 116224 --a------ C:\WINDOWS\system32\tvuuioqx.dll
2008-06-04 21:20:21 0 d-------- C:\Program Files\?icrosoft
2008-06-04 21:15:15 131584 --a------ C:\WINDOWS\system32\lopopuju.dll
2008-06-04 21:13:07 125952 --a------ C:\WINDOWS\system32\nvfweblw.dll
2008-06-04 16:11:21 22528 --a------ C:\WINDOWS\svcinit.exe
2008-06-04 16:11:21 13056 --a------ C:\WINDOWS\sistem.exe
2008-06-04 16:11:20 20480 --a------ C:\WINDOWS\searchword.dll
2008-06-04 16:11:20 12288 --a------ C:\WINDOWS\qttasks.exe
2008-06-04 16:11:19 30208 --a------ C:\WINDOWS\mswsc20.dll
2008-06-04 16:11:19 24064 --a------ C:\WINDOWS\mswsc10.dll
2008-06-04 16:11:18 11008 --a------ C:\WINDOWS\msspi.dll
2008-06-04 16:11:18 15872 --a------ C:\WINDOWS\inetinf.exe
2008-06-04 16:11:18 9472 --a------ C:\WINDOWS\helpcvs.exe
2008-06-04 16:11:17 20992 --a------ C:\WINDOWS\gfmnaaa.dll
2008-06-04 16:11:17 21504 --a------ C:\WINDOWS\funny.exe
2008-06-04 16:11:17 21504 --a------ C:\WINDOWS\funniest.exe
2008-06-04 16:11:17 26368 --a------ C:\WINDOWS\explorer32.exe
2008-06-04 16:11:17 11520 --a------ C:\WINDOWS\explore.exe
2008-06-04 16:11:16 32256 --a------ C:\WINDOWS\dnsrelay.dll
2008-06-04 16:11:16 10752 --a------ C:\WINDOWS\directx32.exe
2008-06-04 16:11:16 9472 --a------ C:\WINDOWS\ctrlpan.dll
2008-06-04 16:11:16 29184 --a------ C:\WINDOWS\ctfmon32.exe
2008-06-04 16:09:54 401972 --a------ C:\WINDOWS\system32\g3.exe
2008-06-04 11:41:41 738847 --ahs---- C:\WINDOWS\system32\KRqBeMoq.ini2
2008-06-04 11:37:25 0 d-------- C:\Documents and Settings\LocalService\Application Data\Macromedia
2008-06-04 11:37:24 0 d-------- C:\Documents and Settings\LocalService\Application Data\Adobe
2008-06-04 11:37:10 860 --a------ C:\WINDOWS\system32\winpfz33.sys
2008-06-04 11:37:05 0 dr------- C:\Documents and Settings\LocalService\Favorites
2008-06-04 11:37:02 4 --a------ C:\WINDOWS\system32\hljwugsf.bin
2008-06-04 11:36:59 88961 --a------ C:\WINDOWS\system32\mysidesearch_sidebar_uninstall.exe
2008-06-04 11:36:54 87513 --a------ C:\WINDOWS\system32\iftuyszv.exe <Not Verified; Microsoft; XML Media>
2008-06-04 11:36:54 87513 --a------ C:\WINDOWS\lfn.exe <Not Verified; Microsoft; XML Media>
2008-06-04 11:36:53 298311 --a------ C:\WINDOWS\system32\gside.exe
2008-06-04 11:36:38 86144 --a------ C:\WINDOWS\system32\drivers\hidirr.sys
2008-06-04 11:36:36 0 d-------- C:\WINDOWS\system32\fIE
2008-06-04 11:36:35 0 d-------- C:\WINDOWS\system32\Vco1
2008-06-04 11:36:35 0 d-------- C:\WINDOWS\system32\sTMP
2008-06-04 11:36:35 0 d-------- C:\WINDOWS\system32\Dev3
2008-06-04 11:36:35 0 d-------- C:\WINDOWS\system32\a053
2008-06-04 11:36:35 0 d-------- C:\WINDOWS\system32\6026c
2008-06-04 11:36:29 0 d-------- C:\WINDOWS\system32\vntiho01

-- Find3M Report ---------------------------------------------------------------

Robbyj717 · 06-16-2008, 08:08 PM

I missed the end on c&p.

2008-06-09 02:29:27 0 d-------- C:\Program Files\Common Files
2008-06-08 21:13:46 0 d-------- C:\Program Files\Symantec
2008-06-08 21:13:44 0 d-------- C:\Program Files\Norton AntiVirus
2008-06-05 09:11:35 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-06-04 21:20:24 0 d-------- C:\Program Files\?icrosoft
2008-05-13 14:05:25 0 d-------- C:\Program Files\World of Warcraft
2008-04-11 16:44:39 0 --a------ C:\WINDOWS\ativpsrm.bin
2008-04-11 16:30:19 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-04-10 21:27:17 3884 --a------ C:\WINDOWS\viassary-hp.reg

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00110011-4b0b-44d5-9718-90c88817369b}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{086ae192-23a6-48d6-96ec-715f53797e85}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{150fa160-130d-451f-b863-b655061432ba}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{17da0c9e-4a27-4ac5-bb75-5d24b8cdb972}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb1}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb2}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2d38a51a-23c9-48a1-a33c-48675aa2b494}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2e9caff6-30c7-4208-8807-e79d4ec6f806}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{377C180E-6F0E-4D4C-980F-F45BD3D40CF4}]
11/26/2007 10:46 AM 324936 --a------ c:\PROGRA~1\mcafee\msk\mcapbho.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{467faeb2-5f5b-4c81-bae0-2a4752ca7f4e}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5321e378-ffad-4999-8c62-03ca8155f0b3}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{587dbf2d-9145-4c9e-92c2-1f953da73773}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6cc1c91a-ae8b-4373-a5b4-28ba1851e39a}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{79369d5c-2903-4b7a-ade2-d5e0dee14d24}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{799a370d-5993-4887-9df7-0a4756a77d00}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{98dbbf16-ca43-4c33-be80-99e6694468a4}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a55581dc-2cdb-4089-8878-71a080b22342}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b847676d-72ac-4393-bfff-43a1eb979352}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bc97b254-b2b9-4d40-971d-78e0978f5f26}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cf021f40-3e14-23a5-cba2-717765721306}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e2ddf680-9905-4dee-8c64-0a5de7fe133c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e3eebbe8-9cab-4c76-b26a-747e25ebb4c6}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e7afff2a-1b57-49c7-bf6b-e5123394c970}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F632550A-A855-4203-983A-0C2362C98401}]
C:\WINDOWS\system32\qoMeBqRK.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fd9bc004-8331-4457-b830-4759ff704c22}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ff1bf4c7-4e08-4a28-a43f-9d60a9f7a880}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6145\SiteAdv.exe" [06/21/2007 03:06 PM]
"McENUI"="C:\PROGRA~1\McAfee\MHN\McENUI.exe" [11/30/2007 05:42 AM]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [11/01/2007 07:12 PM]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [04/10/2008 03:14 PM]
"BMaf8893fe"="C:\WINDOWS\system32\cxvhxoks.dll" [06/08/2008 09:08 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:56 AM]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 11:24 AM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\iftuyszv.exe,"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\qoMeBqRK

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

-- End of Deckard's System Scanner: finished at 2008-06-16 21:03:56 ------------

**TheBruce1** · 06-17-2008, 05:28 AM

Hello again

Your logs suggest the possibility that your computer was attacked by a backdoor trojan. This type of infection allows hackers to remotely control your computer, steal critical system information and download and execute files without your knowledge.

If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Please read this: How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

=========

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

========

Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear, a lack of symptoms does not mean that it is no longer present.

Please Do Not Attach logs to your posts unless you are advised to do so.

========

Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions.

========

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:SDFix)

Please then reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.

Open the extracted SDFix folder and double click RunThis.bat to start the script.
Type Y to begin the cleanup process.
It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
Finally paste the contents of the Report.txt back on the forum with all the required logs

=========

Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/comb...o-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery mode. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once the Recovery Console is installed using ComboFix, you should see a message that says:

The Recovery Console was successfully installed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

==========

Please download HijackThis to your desktop

Alternate link

Double-click on the file you just downloaded.
Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis

Upon install, HijackThis should open for you.

Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe

1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
2. If you don't get the intro screen, just hit Scan and then click on Save log.
3. Post the hijackthis.log file here. Do not fix anything in HijackThis since they may be harmless.

=========
Logs Required
Report.txt
C:\Combofix.txt
Hijackthis Log

Robbyj717 · 06-17-2008, 12:08 PM

Ok, I got the SDFix and ran it and now I have the report.txt, but internet explorer will not load the combofix link. It doesnt give me an error screen or a message that it is being blocked by anything, I just get a internet explorer loading icon at the top and nothing happens. It was doing the same thing the last week for certain sites. Google and yahoo search wouldn't work but msn live search does and i can't acces my yahoo email but other sites work fine and load quickly. Is there another combofix link that i can try?

**TheBruce1** · 06-17-2008, 12:23 PM

Download Combofix from any of the links below, and save it to your desktop.
Link 1
Link 2
Link 3

**Note: It is important that it is saved directly to your desktop**

--------------------------------------------------------------------

1. Disconnect from the internet.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

--------------------------------------------------------------------

Double click on ComboFix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new HijackThis log so we can continue cleaning the system.

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

Robbyj717 · 06-17-2008, 01:32 PM

SDFix: Version 1.194
Run by Administrator on Tue 06/17/2008 at 12:43 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\DOCUME~1\Owner\Desktop\SDFix

Checking Services :

Name :
HIDIRR

Path :
System32\drivers\hidirr.sys

HIDIRR - Deleted

Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Default Desktop Wallpaper

Rebooting

Checking Files :

Trojan Files Found:

C:\WINDOWS\x.exe - Deleted
C:\WINDOWS\y.exe - Deleted
C:\WINDOWS\accesss.exe - Deleted
C:\WINDOWS\astctl32.ocx - Deleted
C:\WINDOWS\avpcc.dll - Deleted
C:\WINDOWS\clrssn.exe - Deleted
C:\WINDOWS\cpan.dll - Deleted
C:\WINDOWS\ctfmon32.exe - Deleted
C:\WINDOWS\ctrlpan.dll - Deleted
C:\WINDOWS\default.htm - Deleted
C:\WINDOWS\directx32.exe - Deleted
C:\WINDOWS\dnsrelay.dll - Deleted
C:\WINDOWS\editpad.exe - Deleted
C:\WINDOWS\explore.exe - Deleted
C:\WINDOWS\explorer32.exe - Deleted
C:\WINDOWS\funniest.exe - Deleted
C:\WINDOWS\funny.exe - Deleted
C:\WINDOWS\gfmnaaa.dll - Deleted
C:\WINDOWS\helpcvs.exe - Deleted
C:\WINDOWS\iedll.exe - Deleted
C:\WINDOWS\iexplorer.exe - Deleted
C:\WINDOWS\inetinf.exe - Deleted
C:\WINDOWS\internet.exe - Deleted
C:\WINDOWS\loader.exe - Deleted
C:\WINDOWS\megavid.cdt - Deleted
C:\WINDOWS\msconfd.dll - Deleted
C:\WINDOWS\msspi.dll - Deleted
C:\WINDOWS\mssys.exe - Deleted
C:\WINDOWS\msupdate.exe - Deleted
C:\WINDOWS\mswsc10.dll - Deleted
C:\WINDOWS\mswsc20.dll - Deleted
C:\WINDOWS\mtwirl32.dll - Deleted
C:\WINDOWS\muotr.so - Deleted
C:\WINDOWS\notepad32.exe - Deleted
C:\WINDOWS\olehelp.exe - Deleted
C:\WINDOWS\qttasks.exe - Deleted
C:\WINDOWS\quicken.exe - Deleted
C:\WINDOWS\rundll16.exe - Deleted
C:\WINDOWS\rundll32.vbe - Deleted
C:\WINDOWS\searchword.dll - Deleted
C:\WINDOWS\sistem.exe - Deleted
C:\WINDOWS\svchost32.exe - Deleted
C:\WINDOWS\svcinit.exe - Deleted
C:\WINDOWS\systeem.exe - Deleted
C:\WINDOWS\systemcritical.exe - Deleted
C:\WINDOWS\system32\drivers\core.cache.dsk - Deleted
C:\WINDOWS\system32\hljwugsf.bin - Deleted
C:\WINDOWS\time.exe - Deleted
C:\WINDOWS\users32.exe - Deleted
C:\WINDOWS\waol.exe - Deleted
C:\WINDOWS\win32e.exe - Deleted
C:\WINDOWS\win64.exe - Deleted
C:\WINDOWS\winajbm.dll - Deleted
C:\WINDOWS\window.exe - Deleted
C:\WINDOWS\winmgnt.exe - Deleted
C:\WINDOWS\xplugin.dll - Deleted
C:\WINDOWS\xxxvideo.hta - Deleted
C:\WINDOWS\system32\drivers\HIDIRR.sys - Deleted

Folder C:\Temp\tn3 - Removed
Folder C:\WINDOWS\system32\vntiho01 - Removed

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-17 12:52:48
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwClose

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:000000b9
"TracesSuccessful"=dword:00000003

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"="C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe:*:Enabled:McAfee Network Agent"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files :

File Backups: - C:\DOCUME~1\Owner\Desktop\SDFix\backups\backups.zip

Files with Hidden Attributes :

Thu 10 Apr 2008 196 A.SHR --- "C:\BOOT.BAK"
Mon 10 Dec 2007 31 A..H. --- "C:\WINDOWS\uccspecc.sys"
Mon 2 Oct 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 30 Aug 2005 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.key.bak"
Mon 9 Jun 2008 20,487 A.SHR --- "C:\Program Files\McAfee\MQC\MRU.bak"
Mon 9 Jun 2008 265 A.SHR --- "C:\Program Files\McAfee\MQC\qcconf.bak"
Wed 7 Mar 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Thu 10 Apr 2008 2,367,240 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5ad35005cb1cf6ab0e5d8906b81ef3e1\BITE.tmp"
Fri 11 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ab59ac72525ea90a47679441587835c9\BIT2.tmp"
Wed 7 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\fd0264849c01086f3c6b505dc02dbd44\BIT3.tmp"
Thu 10 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0615c0a0d589689e7965d4bf87a5872b\download\BIT58.tmp"
Thu 10 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\26850ce336513bfee15ef865c4e6576c\download\BIT442.tmp"
Thu 10 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\2d5cb53f40c94c45549672fbf4eb14b2\download\BIT815.tmp"
Thu 10 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\409eeb5b15ac5b9aeee323d7da0f978c\download\BIT801.tmp"
Thu 10 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\4730fbe8056ad6eb56eb6cc23d82cd01\download\BIT7A.tmp"
Thu 10 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\4cd8fa349c86e90c2d5b6edfe250f0d9\download\BIT817.tmp"
Thu 10 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\6aa2d4bcedcee9617227cafceab09f02\download\BIT811.tmp"
Thu 10 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\92554586f3df257ccc6f5cd3e1efab22\download\BIT80C.tmp"
Thu 10 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\94ee68f37097c1148365727afa16d894\download\BIT59.tmp"
Thu 10 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a1394c19ce964344512c4b8ba52cbec5\download\BIT80F.tmp"
Thu 10 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\c4989c7d9cfedbbe50931f1ce8778e69\download\BIT5B.tmp"
Tue 20 Jun 2006 2,142 A.SH. --- "C:\Documents and Settings\Owner\Application Data\Roxio\Dragon\DiscInfoCache\SAMSUNG__CD-ROM_SC-148A___B401_310_DICV018_DRGV20100BC.TMP"

Finished!

Robbyj717 · 06-17-2008, 01:33 PM

ComboFix 08-06-16.5 - Owner 2008-06-17 14:12:33.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2041 [GMT -5:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Owner\My Documents\MANTEC~1
C:\Program Files\icroso~1
C:\WINDOWS\cookies.ini
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\lfn.exe
C:\WINDOWS\mainms.vpi
C:\WINDOWS\portsv.exe
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\cxvhxoks.dll
C:\WINDOWS\system32\dwwucsvr.ini
C:\WINDOWS\system32\gside.exe
C:\WINDOWS\system32\kgubutaw.ini
C:\WINDOWS\system32\KRqBeMoq.ini
C:\WINDOWS\system32\KRqBeMoq.ini2
C:\WINDOWS\system32\lopopuju.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\mysidesearch_sidebar_uninstall.exe
C:\WINDOWS\system32\nvfweblw.dll
C:\WINDOWS\system32\tvuuioqx.dll
C:\WINDOWS\system32\winpfz33.sys
C:\WINDOWS\system32\xqoiuuvt.ini

.
((((((((((((((((((((((((( Files Created from 2008-05-17 to 2008-06-17 )))))))))))))))))))))))))))))))
.

2008-06-17 12:38 . 2008-06-17 12:38 <DIR> d-------- C:\WINDOWS\ERUNT
2008-06-16 21:50 . 2008-06-16 21:50 118 --a------ C:\WINDOWS\system32\MRT.INI
2008-06-16 20:58 . 2008-04-14 06:01 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-09 03:47 . 2008-06-09 03:47 <DIR> d-------- C:\Deckard
2008-06-09 03:33 . 2008-06-09 03:33 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-06-09 02:29 . 2008-06-09 02:29 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2008-06-09 02:29 . 2008-06-09 02:29 1,152 --a------ C:\WINDOWS\system32\windrv.sys
2008-06-09 01:49 . 2008-06-09 01:49 <DIR> d-------- C:\Program Files\Enigma Software Group
2008-06-09 01:31 . 2004-05-12 06:29 <DIR> d-------- C:\Documents and Settings\Administrator\WINDOWS
2008-06-09 01:31 . 2004-05-13 00:57 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Symantec
2008-06-09 01:31 . 2004-05-12 07:05 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SampleView
2008-06-09 01:31 . 2008-06-09 01:31 <DIR> d-------- C:\Documents and Settings\Administrator
2008-06-09 01:22 . 2008-06-08 21:55 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-06-09 00:58 . 2008-06-17 13:05 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-06-09 00:58 . 2007-12-10 13:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-06-09 00:58 . 2007-12-10 13:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-06-09 00:58 . 2008-02-01 11:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-06-09 00:58 . 2007-12-10 13:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-06-08 23:54 . 2008-06-08 21:55 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-06-08 22:37 . 2008-06-16 21:49 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-06-08 21:56 . 2008-06-08 21:55 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-06-08 21:56 . 2008-06-08 21:55 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-06-08 21:56 . 2008-06-08 21:55 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-06-08 21:56 . 2008-06-08 21:55 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-06-08 21:56 . 2008-06-08 21:55 82,944 --a------ C:\WINDOWS\system32\404Fix.exe
2008-06-08 21:56 . 2008-06-08 21:55 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-06-08 21:56 . 2008-06-09 01:38 880 --a------ C:\WINDOWS\system32\tmp.reg
2008-06-08 21:31 . 2008-06-17 14:18 6,224 --a------ C:\WINDOWS\system32\Config.MPF
2008-06-08 21:22 . 2008-06-08 21:22 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\SiteAdvisor
2008-06-08 21:21 . 2008-06-08 21:33 <DIR> d-------- C:\Program Files\SiteAdvisor
2008-06-08 21:21 . 2008-06-09 02:24 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\SiteAdvisor
2008-06-08 21:21 . 2008-06-08 21:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-06-08 21:19 . 2006-03-03 08:07 143,360 --a------ C:\WINDOWS\system32\dunzip32.dll
2008-06-08 21:17 . 2007-11-22 06:44 201,320 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
2008-06-08 21:17 . 2007-11-22 06:44 79,304 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
2008-06-08 21:17 . 2007-12-02 12:51 40,488 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys
2008-06-08 21:17 . 2007-11-22 06:44 35,240 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
2008-06-08 21:17 . 2007-11-22 06:44 33,832 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys
2008-06-08 21:16 . 2007-07-13 06:20 113,952 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys
2008-06-08 21:15 . 2008-06-08 21:15 <DIR> d-------- C:\Program Files\McAfee.com
2008-06-08 21:15 . 2008-06-09 01:06 <DIR> d-------- C:\Program Files\Common Files\McAfee
2008-06-08 21:14 . 2008-06-09 01:42 <DIR> d-------- C:\Program Files\McAfee
2008-06-08 21:08 . 2008-06-09 00:16 <DIR> d-------- C:\WINDOWS\system32\5076
2008-06-08 21:08 . 2008-06-08 21:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2008-06-04 21:13 . 2008-06-16 20:55 117 --a------ C:\WINDOWS\BMaf8893fe.xml
2008-06-04 16:18 . 2008-06-04 16:18 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-04 16:18 . 2008-06-04 16:18 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-04 16:09 . 2008-06-04 16:09 401,972 --a------ C:\WINDOWS\system32\g3.exe
2008-06-04 11:47 . 2008-06-04 11:47 9,662 --a------ C:\WINDOWS\system32\ZoneAlarmIconUS.ico
2008-06-04 11:36 . 2008-06-08 23:33 <DIR> d-------- C:\WINDOWS\system32\Vco1
2008-06-04 11:36 . 2008-06-09 02:01 <DIR> d-------- C:\WINDOWS\system32\sTMP
2008-06-04 11:36 . 2008-06-09 02:01 <DIR> d-------- C:\WINDOWS\system32\fIE
2008-06-04 11:36 . 2008-06-09 02:00 <DIR> d-------- C:\WINDOWS\system32\Dev3
2008-06-04 11:36 . 2008-06-08 23:15 <DIR> d-------- C:\WINDOWS\system32\a053
2008-06-04 11:36 . 2008-06-08 23:15 <DIR> d-------- C:\WINDOWS\system32\6026c

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-17 19:18 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-09 02:13 --------- d-----w C:\Program Files\Symantec
2008-06-09 02:13 --------- d-----w C:\Program Files\Norton AntiVirus
2008-06-09 02:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-06-05 14:11 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-13 19:05 --------- d-----w C:\Program Files\World of Warcraft
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-04-11 02:27 3,884 ----a-w C:\WINDOWS\viassary-hp.reg
2008-01-13 16:12 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2006-06-12 06:17 0 ----a-w C:\Documents and Settings\Owner\ignorelist.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F632550A-A855-4203-983A-0C2362C98401}]
C:\WINDOWS\system32\qoMeBqRK.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6145\SiteAdv.exe" [2007-06-21 15:06 36640]
"McENUI"="C:\PROGRA~1\McAfee\MHN\McENUI.exe" [2007-11-30 05:42 1164576]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-11-01 19:12 582992]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2008-04-10 15:14 1107848]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

R3 Alpham;Ideazon Merc Composite Keyboard Driver;C:\WINDOWS\system32\DRIVERS\Alpham.sys [2005-12-04 13:55]

.
Contents of the 'Scheduled Tasks' folder
"2008-06-09 02:16:12 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe'
"2008-06-09 02:16:11 C:\WINDOWS\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe
"2008-06-03 01:00:00 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Owner.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeh/TASK:
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-17 14:18:50
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwClose

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\SiteAdvisor\6145\saHook.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\gearsec.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe
C:\Program Files\McAfee\MPF\MpfSrv.exe
C:\Program Files\McAfee\MSK\msksrver.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\SiteAdvisor\6145\SAService.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\PROGRA~1\McAfee\MSC\mcuimgr.exe
.
**************************************************************************
.
Completion time: 2008-06-17 14:22:11 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-17 19:22:04

Pre-Run: 115,792,863,232 bytes free
Post-Run: 115,772,567,552 bytes free

175 --- E O F --- 2008-06-17 02:51:20

Robbyj717 · 06-17-2008, 01:34 PM

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:31:26 PM, on 6/17/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\gearsec.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\SiteAdvisor\6145\SAService.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\SiteAdvisor\6145\SiteAdv.exe
C:\WINDOWS\system32\ctfmon.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Documents and Settings\Owner\Desktop\HiJackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6145\SiteAdv.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: (no name) - {F632550A-A855-4203-983A-0C2362C98401} - C:\WINDOWS\system32\qoMeBqRK.dll (file missing)
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6145\SiteAdv.dll
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6145\SiteAdv.exe
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...p=ZRxdm678NTUS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...tup1.0.1.0.cab
O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h20264.www2.hp.com/ediags/dd/...osticsxp2k.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1207881416890
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://ak.imgag.com/imgag/cp/install/Crusher.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://plugin.driveragent.com/files/driveragent.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6145\SAService.exe

--
End of file - 6331 bytes

**TheBruce1** · 06-17-2008, 04:28 PM

Hello again

Download ATF-Cleaner by Atribune to your desktop. Do not run just yet, we will shortly

=========

Open notepad and copy/paste the text in the quotebox below into it:

Quote:

File::
C:\WINDOWS\system32\g3.exe
C:\WINDOWS\imsins.BAK
C:\WINDOWS\BMaf8893fe.xml
C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Owner.job
Folder::
C:\Program Files\Enigma Software Group
C:\Documents and Settings\Administrator\Application Data\Symantec
C:\Program Files\Symantec
C:\Program Files\Norton AntiVirus
C:\Documents and Settings\All Users\Application Data\Symantec
C:\Program Files\Norton Internet Security
C:\WINDOWS\system32\ZoneAlarmIconUS.ico
C:\WINDOWS\system32\Vco1
C:\WINDOWS\system32\sTMP
C:\WINDOWS\system32\fIE
C:\WINDOWS\system32\Dev3
C:\WINDOWS\system32\a053
C:\WINDOWS\system32\6026c
C:\WINDOWS\system32\5076
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F632550A-A855-4203-983A-0C2362C98401}]

Save this as CFscript

Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

=========

JAVA OUTDATED

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 6 Update 6 and save it to your desktop.
Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 6. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
Click the "Download" button to the right.
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: "Accept License Agreement". Click on Continue.The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u6-windows-i586-p.exe to install the newest version.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH Checked
  - Applications and Applets
    Trace and Log Files
- Click OK on Delete Temporary Files Window
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
- Click OK to leave the Temporary Files Window
- Click OK to leave the Java Control Panel.

===========

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you have Firefox installed:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you have Opera installed:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

==========

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Click Accept, when prompted to download and install the program files and database of malware definitions.

Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.
Click the Save Report As... button.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

Animated Tutorial Here

To optimize scanning time and produce a more sensible report for review:

Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

==========

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

==========
Logs Required
C:\Combofix.txt
Kaspersky Scan Report
Hijackthis Log

How is your system running now.

Robbyj717 · 06-17-2008, 09:44 PM

It's doing way better, thanks. The pop-ups and warnings are all gone and the desktop background is gone. The combofix log is huge, sorry if it makes things difficult. Here are the new logs.

ComboFix 08-06-16.5 - Owner 2008-06-17 18:30:32.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2051 [GMT -5:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFscript.txt
* Created a new restore point
* Resident AV is active

FILE ::
C:\WINDOWS\BMaf8893fe.xml
C:\WINDOWS\imsins.BAK
C:\WINDOWS\system32\g3.exe
C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Owner.job
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator\Application Data\Symantec
C:\Documents and Settings\Administrator\Application Data\Symantec\Shared\Options.VcPref
C:\Documents and Settings\All Users\Application Data\Symantec
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.log
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Temp\ccdt.ph
C:\Documents and Settings\All Users\Application Data\Symantec\DSA\V_G\DSASL.xml
C:\Documents and Settings\All Users\Application Data\Symantec\LiveSubscribe\Catalog.LiveSubscribe
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\ExItem4641_symnet_4.7.2_english\Message.exe
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\ExItem4641_symnet_4.7.2_english\patch.dis
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\ExItem4641_symnet_4.7.2_english\setup.exe
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\ExItem4641_symnet_4.7.2_english\SNDUpdater.msi
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\ExItem4641_symnet_4.7.2_english\SymStore.dll
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri798\automatic$20liveupdate_3.2.0.53_english_livetri.zip
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri798\liveupdt.grd
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri798\liveupdt.sig
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri802\liveupdt.grd
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri802\liveupdt.sig
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri802\symevent$20installer$20$2d$20consumer_12.5_symalllanguages_livetri.zip
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri806\decomposer_1.0.0_symalllanguages_livetri.zip
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri806\liveupdt.grd
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri806\liveupdt.sig
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri810\liveupdt.grd
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri810\liveupdt.sig
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri810\submission$20engine$20data_1.0_symalllanguages_livetri.zip
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri811\liveupdt.grd
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri811\liveupdt.sig
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri811\norton$20internet$20security_10.3.0_english_livetri.zip
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri812\liveupdt.grd
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri812\liveupdt.sig
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri812\norton$20internet$20security$20other_2.0_english_livetri.zip
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri816\ids$20defs$202007.2$20microdefs25_microdefsb.apr_symalllanguages_livetri.zip
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri816\liveupdt.grd
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri816\liveupdt.sig
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri818\ids$20defs$202007.2$20microdefs25_microdefsb.curdefs_symalllanguages_livetri.zip
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri818\liveupdt.grd
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri818\liveupdt.sig
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri822\liveupdt.grd
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri822\liveupdt.sig
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri822\symantec$20trusted$20application$20list_2.1_english_livetri.zip
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri824\liveupdt.grd
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri824\liveupdt.sig
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri824\opc70x$5fcore_7.5_symalllanguages_livetri.zip
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri849\ccpd$5fretail$5flicensing$5ftechnology_6.0_english_livetri.zip
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri849\liveupdt.grd
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri849\liveupdt.sig
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri849\liveupdt.tri
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Product.Catalog.LiveUpdate
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Settings.LiveUpdate
C:\Documents and Settings\All Users\Application Data\Symantec\nppw.zip
C:\Documents and Settings\All Users\Application Data\Symantec\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PEPCollectors\Pep2_{BC8D3EAF-F864-4D4B-AB4D-B3D0C32E2840}.dat
C:\Documents and Settings\All Users\Application Data\Symantec\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PollManager\PollManager_Current.dat
C:\Documents and Settings\All Users\Application Data\Symantec\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PollManager\PollManager_Job.dat
C:\Documents and Settings\All Users\Application Data\Symantec\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\SVAR\SVAR_{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}.dat
C:\Documents and Settings\All Users\Application Data\Symantec\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\SVAR\SVAR_110078.dat
C:\Documents and Settings\All Users\Application Data\Symantec\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\SVAR\SVAR_110100.dat
C:\Documents and Settings\All Users\Application Data\Symantec\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\SVAR\SVAR_110111.dat
C:\Documents and Settings\All Users\Application Data\Symantec\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\SVAR\SVAR_110119.dat
C:\Documents and Settings\All Users\Application Data\Symantec\rmt.dat
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{00D49536-AE39-45C2-8463-6FED6D7AE8B8}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{00D49536-AE39-45C2-8463-6FED6D7AE8B8}\{B0D79E96-E396-4DED-852B-9D6BBB35D4DE}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{00D49536-AE39-45C2-8463-6FED6D7AE8B8}\{B0D79E96-E396-4DED-852B-9D6BBB35D4DE}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{00E04411-30E5-4190-9F76-A2C81098E6A7}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{00E04411-30E5-4190-9F76-A2C81098E6A7}\{3FEF7D5B-654B-40ED-9C64-6E211F4C5A0E}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{00E04411-30E5-4190-9F76-A2C81098E6A7}\{3FEF7D5B-654B-40ED-9C64-6E211F4C5A0E}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{00E04411-30E5-4190-9F76-A2C81098E6A7}\{F8B10446-B15A-41F8-A2FD-C7E1DC279EF4}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{00E04411-30E5-4190-9F76-A2C81098E6A7}\{F8B10446-B15A-41F8-A2FD-C7E1DC279EF4}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{052A9603-EEE6-4B4E-8D3E-54170157AD58}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{052A9603-EEE6-4B4E-8D3E-54170157AD58}\{ABE8B4A1-F3E1-4C97-8171-CFF9A1E283E9}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{052A9603-EEE6-4B4E-8D3E-54170157AD58}\{ABE8B4A1-F3E1-4C97-8171-CFF9A1E283E9}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{052A9603-EEE6-4B4E-8D3E-54170157AD58}\{ECB95232-A879-40A7-AF29-11E660CEECFE}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{052A9603-EEE6-4B4E-8D3E-54170157AD58}\{ECB95232-A879-40A7-AF29-11E660CEECFE}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{01AEC95D-BD61-4B85-9523-3A328AE45830}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{01AEC95D-BD61-4B85-9523-3A328AE45830}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{0E1EB8D5-AAD5-446C-A63F-8E0F70A5E7EB}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{0E1EB8D5-AAD5-446C-A63F-8E0F70A5E7EB}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{1145C42A-02EB-4286-AE83-6F142443CBD8}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{1145C42A-02EB-4286-AE83-6F142443CBD8}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{2D6E2125-F76E-4639-BFBF-1075E779FBC8}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{2D6E2125-F76E-4639-BFBF-1075E779FBC8}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{5B744EBE-77ED-4F1A-96B8-75A0917B41AB}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{5B744EBE-77ED-4F1A-96B8-75A0917B41AB}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{732067EC-EB5E-42F6-9D3B-178B014DF423}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{732067EC-EB5E-42F6-9D3B-178B014DF423}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{749771C6-2F08-4EB4-9AE6-2781B9DBC9DE}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{749771C6-2F08-4EB4-9AE6-2781B9DBC9DE}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{7BF4CAB9-051D-4A95-A602-BF5137AC3D08}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{7BF4CAB9-051D-4A95-A602-BF5137AC3D08}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{9EB0DF97-92AC-4704-8028-16529A761594}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{9EB0DF97-92AC-4704-8028-16529A761594}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{CD1D33BC-374D-4A44-8D37-E37DDB87D0A6}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{CD1D33BC-374D-4A44-8D37-E37DDB87D0A6}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{CECA8CAA-6C1F-46D7-8985-58495F15F4AF}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{CECA8CAA-6C1F-46D7-8985-58495F15F4AF}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{F9864706-C1B7-4DE8-9E55-700E71C115B2}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{F9864706-C1B7-4DE8-9E55-700E71C115B2}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{FFC1FEE1-60AD-40F2-AF10-C203DA7F5AC8}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{06864FE1-A9F2-474D-BA06-7DB008B067DB}\{FFC1FEE1-60AD-40F2-AF10-C203DA7F5AC8}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{0B08117E-9C25-4A01-957E-1527D2FBD524}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{0B08117E-9C25-4A01-957E-1527D2FBD524}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{10200DC2-B6E7-44D7-80FC-D75E025E7986}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{10200DC2-B6E7-44D7-80FC-D75E025E7986}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{1474ACEF-EFBA-4C3E-A396-6FBB4042F3BC}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{1474ACEF-EFBA-4C3E-A396-6FBB4042F3BC}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{1FC101BD-E20C-420D-8314-E3DFF9605EF8}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{1FC101BD-E20C-420D-8314-E3DFF9605EF8}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{298E996C-3955-4C84-84F2-F0ECF0C016C9}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{298E996C-3955-4C84-84F2-F0ECF0C016C9}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{517BD5ED-AD05-4A69-89ED-B05CCEFB70D1}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{517BD5ED-AD05-4A69-89ED-B05CCEFB70D1}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{54A30C4D-8357-49F4-AE5E-392ED9C68D06}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{54A30C4D-8357-49F4-AE5E-392ED9C68D06}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{5A8AFCA2-8AE2-41C6-80EE-E5FB4F7622A3}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{5A8AFCA2-8AE2-41C6-80EE-E5FB4F7622A3}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{7A334B2E-0B71-491B-BF4B-E0E68729924C}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{7A334B2E-0B71-491B-BF4B-E0E68729924C}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{801479E6-8032-42C4-807E-BAA3449FEF1B}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{801479E6-8032-42C4-807E-BAA3449FEF1B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{8416A060-4AC9-4C22-AE5D-52ABF437D844}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{8416A060-4AC9-4C22-AE5D-52ABF437D844}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{ABCB2379-9079-43A1-8719-216BCA8143F9}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{ABCB2379-9079-43A1-8719-216BCA8143F9}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{BABBDC3D-D33D-4B7F-97C3-EF9452AC04E3}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{BABBDC3D-D33D-4B7F-97C3-EF9452AC04E3}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{E501C4FD-BFC0-4CF7-85B6-77F1E312DBE2}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{E501C4FD-BFC0-4CF7-85B6-77F1E312DBE2}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{ED058152-A81E-4A25-82E0-7A90D0B13491}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{ED058152-A81E-4A25-82E0-7A90D0B13491}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{ED7AD459-D355-4F90-93D3-94D0C71BF112}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{0B0D5657-D281-44F4-A06A-C8674B5177ED}\{ED7AD459-D355-4F90-93D3-94D0C71BF112}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{102E5FD3-6D01-4A2E-84B1-2BE660BE876E}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{102E5FD3-6D01-4A2E-84B1-2BE660BE876E}\{B924C802-76C4-49C7-BA3E-86767C30FC24}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{102E5FD3-6D01-4A2E-84B1-2BE660BE876E}\{B924C802-76C4-49C7-BA3E-86767C30FC24}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{102E5FD3-6D01-4A2E-84B1-2BE660BE876E}\{D97064EC-DBCC-47DB-86CE-4D46EF04401B}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{102E5FD3-6D01-4A2E-84B1-2BE660BE876E}\{D97064EC-DBCC-47DB-86CE-4D46EF04401B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{110DAC0A-EDFE-4B8F-B3B8-66BECC16CD9F}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{110DAC0A-EDFE-4B8F-B3B8-66BECC16CD9F}\{37A4488A-177E-4DB2-BCDC-3514198DDE68}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{110DAC0A-EDFE-4B8F-B3B8-66BECC16CD9F}\{37A4488A-177E-4DB2-BCDC-3514198DDE68}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{0321F563-B9AE-4631-BB79-674FCFBE98D2}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{0321F563-B9AE-4631-BB79-674FCFBE98D2}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{0F1D0FF1-1019-4430-88EF-11CA3DF2E0CC}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{0F1D0FF1-1019-4430-88EF-11CA3DF2E0CC}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{0F362B58-38F8-4228-AAB4-8A6DD826AF79}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{0F362B58-38F8-4228-AAB4-8A6DD826AF79}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{16ADC0D2-9956-4F1B-A8F5-3E477C3E9B90}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{16ADC0D2-9956-4F1B-A8F5-3E477C3E9B90}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{3BEAB4EF-9CED-4D60-B18D-6F9665D71BE3}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{3BEAB4EF-9CED-4D60-B18D-6F9665D71BE3}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{45CFB36D-0246-43C9-BE78-B35CCF069517}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{45CFB36D-0246-43C9-BE78-B35CCF069517}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{4961EC69-BE89-4CD1-8EA5-2D26AFA81D11}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{4961EC69-BE89-4CD1-8EA5-2D26AFA81D11}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{74111762-2F90-477B-9D76-44E02A3D9DBA}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{74111762-2F90-477B-9D76-44E02A3D9DBA}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{74B7F102-9CB0-436D-A269-CF8D6C466291}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{74B7F102-9CB0-436D-A269-CF8D6C466291}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{7DDC6F9C-E042-43AA-8309-0B3EE1A8404F}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{7DDC6F9C-E042-43AA-8309-0B3EE1A8404F}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{988A13D6-CB27-4B8C-8F30-713B939E71FC}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{988A13D6-CB27-4B8C-8F30-713B939E71FC}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{99C05B94-B2B9-4BB0-9AA2-0EFEF65B90B3}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{99C05B94-B2B9-4BB0-9AA2-0EFEF65B90B3}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{A4CD1041-0B82-41BC-8100-62574B5D0485}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{A4CD1041-0B82-41BC-8100-62574B5D0485}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{AB4BC070-DE90-4219-9A87-FC55681B7656}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{AB4BC070-DE90-4219-9A87-FC55681B7656}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{BF33CBD3-D94D-4556-8691-55AF85B82EE6}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{BF33CBD3-D94D-4556-8691-55AF85B82EE6}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{CC0605EF-F9AC-4DBC-95DC-8F6B56E35930}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{CC0605EF-F9AC-4DBC-95DC-8F6B56E35930}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{D3C09047-37C5-4B4F-994D-7FCD939DC7C3}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{D3C09047-37C5-4B4F-994D-7FCD939DC7C3}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{ECF9B614-2EC4-48B2-BCE3-5889BFE0D6AA}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{121ECD10-6FC5-4348-9841-CDB4146F8190}\{ECF9B614-2EC4-48B2-BCE3-5889BFE0D6AA}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{13DB4592-2D2C-4287-BED6-5ED44CFE61AB}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{13DB4592-2D2C-4287-BED6-5ED44CFE61AB}\{057B6F25-0049-48C6-A934-2EBEE46FE603}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{13DB4592-2D2C-4287-BED6-5ED44CFE61AB}\{057B6F25-0049-48C6-A934-2EBEE46FE603}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{13DB4592-2D2C-4287-BED6-5ED44CFE61AB}\{3BFD10A7-390B-4B07-B374-384EAF695C19}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{13DB4592-2D2C-4287-BED6-5ED44CFE61AB}\{3BFD10A7-390B-4B07-B374-384EAF695C19}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{182E3D43-EC39-4070-87D8-B395ADDF4FF4}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{182E3D43-EC39-4070-87D8-B395ADDF4FF4}\{57AEF998-5D16-4069-BD51-ED558D634F80}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{182E3D43-EC39-4070-87D8-B395ADDF4FF4}\{57AEF998-5D16-4069-BD51-ED558D634F80}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{182E3D43-EC39-4070-87D8-B395ADDF4FF4}\{D882DD54-B1E0-442B-BC60-BF966D7D03E2}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{182E3D43-EC39-4070-87D8-B395ADDF4FF4}\{D882DD54-B1E0-442B-BC60-BF966D7D03E2}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C1CEF71-1C8D-4BC1-9996-1B5DB227409D}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C1CEF71-1C8D-4BC1-9996-1B5DB227409D}\{27F697C2-694C-4B59-B636-2737E6AB98D1}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C1CEF71-1C8D-4BC1-9996-1B5DB227409D}\{27F697C2-694C-4B59-B636-2737E6AB98D1}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C1CEF71-1C8D-4BC1-9996-1B5DB227409D}\{64338BA5-344B-4141-8B60-2249FD2194A0}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C1CEF71-1C8D-4BC1-9996-1B5DB227409D}\{64338BA5-344B-4141-8B60-2249FD2194A0}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C1CEF71-1C8D-4BC1-9996-1B5DB227409D}\{E011EE8F-B851-4D6A-9707-74E058043503}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C1CEF71-1C8D-4BC1-9996-1B5DB227409D}\{E011EE8F-B851-4D6A-9707-74E058043503}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C1CEF71-1C8D-4BC1-9996-1B5DB227409D}\{E5BD53FC-C387-4507-AB11-3102DCE97A63}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C1CEF71-1C8D-4BC1-9996-1B5DB227409D}\{E5BD53FC-C387-4507-AB11-3102DCE97A63}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1CC40954-BCFC-4A1A-B851-0708C5770C7E}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1CC40954-BCFC-4A1A-B851-0708C5770C7E}\{F17BAFDE-32A5-4E66-BF42-7087BFE1D9ED}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1CC40954-BCFC-4A1A-B851-0708C5770C7E}\{F17BAFDE-32A5-4E66-BF42-7087BFE1D9ED}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{206D74E6-7F26-40F6-BB8F-3029A26298BB}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{206D74E6-7F26-40F6-BB8F-3029A26298BB}\{8A28A734-85F0-4E50-9500-4E1FC6575C95}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{206D74E6-7F26-40F6-BB8F-3029A26298BB}\{8A28A734-85F0-4E50-9500-4E1FC6575C95}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2226260E-FE1A-422C-AE64-FA9E2E77A428}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2226260E-FE1A-422C-AE64-FA9E2E77A428}\{4069B5A1-AF8D-410D-89A2-5A6B330DC129}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2226260E-FE1A-422C-AE64-FA9E2E77A428}\{4069B5A1-AF8D-410D-89A2-5A6B330DC129}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2226260E-FE1A-422C-AE64-FA9E2E77A428}\{D937FC3E-C46C-4B8C-95C9-3B137D01A58B}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2226260E-FE1A-422C-AE64-FA9E2E77A428}\{D937FC3E-C46C-4B8C-95C9-3B137D01A58B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{242C05B3-3045-4662-A936-26C873B266A6}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{242C05B3-3045-4662-A936-26C873B266A6}\{189C5E44-F877-4DD1-937E-EC7DDE07519A}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{242C05B3-3045-4662-A936-26C873B266A6}\{189C5E44-F877-4DD1-937E-EC7DDE07519A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{242C05B3-3045-4662-A936-26C873B266A6}\{CA597588-4188-4B4F-AE4F-AE8A1CB204D9}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{242C05B3-3045-4662-A936-26C873B266A6}\{CA597588-4188-4B4F-AE4F-AE8A1CB204D9}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{25947D1A-C00F-4C91-B439-626F6E43DCA2}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{25947D1A-C00F-4C91-B439-626F6E43DCA2}\{7871A8DA-8AED-4897-AEAC-18C2E8EF3DE6}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{25947D1A-C00F-4C91-B439-626F6E43DCA2}\{7871A8DA-8AED-4897-AEAC-18C2E8EF3DE6}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{25947D1A-C00F-4C91-B439-626F6E43DCA2}\{7AE81E88-CEFD-43AC-A206-BA76EAE2DD4D}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{25947D1A-C00F-4C91-B439-626F6E43DCA2}\{7AE81E88-CEFD-43AC-A206-BA76EAE2DD4D}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2695581F-9624-4927-A12A-0A5538F323CC}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2695581F-9624-4927-A12A-0A5538F323CC}\{E3ABDF3F-669D-4C7D-9F2D-E3C5FE4A5298}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2695581F-9624-4927-A12A-0A5538F323CC}\{E3ABDF3F-669D-4C7D-9F2D-E3C5FE4A5298}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2695581F-9624-4927-A12A-0A5538F323CC}\{E80B73A2-442C-4FFF-9291-FBA446690972}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2695581F-9624-4927-A12A-0A5538F323CC}\{E80B73A2-442C-4FFF-9291-FBA446690972}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2DC77E7D-E10B-44BC-BD38-256F294B7910}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2DC77E7D-E10B-44BC-BD38-256F294B7910}\{097468DB-F0FD-4C8D-9ED5-4654D61D0A40}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2DC77E7D-E10B-44BC-BD38-256F294B7910}\{097468DB-F0FD-4C8D-9ED5-4654D61D0A40}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2DC77E7D-E10B-44BC-BD38-256F294B7910}\{149748CE-F1EC-4AA5-86C4-565E7E128DC6}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2DC77E7D-E10B-44BC-BD38-256F294B7910}\{149748CE-F1EC-4AA5-86C4-565E7E128DC6}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2DC77E7D-E10B-44BC-BD38-256F294B7910}\{31F93D99-3091-46C4-901B-84686636B5B6}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2DC77E7D-E10B-44BC-BD38-256F294B7910}\{31F93D99-3091-46C4-901B-84686636B5B6}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2DC77E7D-E10B-44BC-BD38-256F294B7910}\{45C2551C-6347-49F9-A1EA-73ECE8928D8A}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2DC77E7D-E10B-44BC-BD38-256F294B7910}\{45C2551C-6347-49F9-A1EA-73ECE8928D8A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2DC77E7D-E10B-44BC-BD38-256F294B7910}\{4C8AC9FF-4E16-4E5C-AD8F-2BB7D3E279B4}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2DC77E7D-E10B-44BC-BD38-256F294B7910}\{4C8AC9FF-4E16-4E5C-AD8F-2BB7D3E279B4}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2DC77E7D-E10B-44BC-BD38-256F294B7910}\{51F78E83-E09C-4791-9D0B-B6A694AC4D92}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2DC77E7D-E10B-44BC-BD38-256F294B7910}\{51F78E83-E09C-4791-9D0B-B6A694AC4D92}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2DC77E7D-E10B-44BC-BD38-256F294B7910}\{942FA0CE-2FB5-4F14-988B-ADBF6FDB3BF4}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2DC77E7D-E10B-44BC-BD38-256F294B7910}\{942FA0CE-2FB5-4F14-988B-ADBF6FDB3BF4}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2DC77E7D-E10B-44BC-BD38-256F294B7910}\{9B646875-28FB-4884-A1E5-240C616DECE6}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2DC77E7D-E10B-44BC-BD38-256F294B7910}\{9B646875-28FB-4884-A1E5-240C616DECE6}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2DC77E7D-E10B-44BC-BD38-256F294B7910}\{DC0D72CB-800B-4816-9306-71028D00051B}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2DC77E7D-E10B-44BC-BD38-256F294B7910}\{DC0D72CB-800B-4816-9306-71028D00051B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2DC77E7D-E10B-44BC-BD38-256F294B7910}\{DC928B64-D660-4027-B953-BE3CE0E5A49C}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2DC77E7D-E10B-44BC-BD38-256F294B7910}\{DC928B64-D660-4027-B953-BE3CE0E5A49C}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2DC77E7D-E10B-44BC-BD38-256F294B7910}\{E8CBB7FF-53F6-444D-8250-F2B726D1790E}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2DC77E7D-E10B-44BC-BD38-256F294B7910}\{E8CBB7FF-53F6-444D-8250-F2B726D1790E}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2F6B1BB1-B477-42C9-915D-69F8CDE987BB}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2F6B1BB1-B477-42C9-915D-69F8CDE987BB}\{09CF8754-DDA2-4742-AAD4-9EF4CBE20C46}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2F6B1BB1-B477-42C9-915D-69F8CDE987BB}\{09CF8754-DDA2-4742-AAD4-9EF4CBE20C46}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2F6B1BB1-B477-42C9-915D-69F8CDE987BB}\{107A1A73-43FE-41AD-86E6-1802DCCA00E6}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2F6B1BB1-B477-42C9-915D-69F8CDE987BB}\{107A1A73-43FE-41AD-86E6-1802DCCA00E6}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2F6B1BB1-B477-42C9-915D-69F8CDE987BB}\{B2E6A68E-E4B6-4F11-92CA-76CF2E81A78C}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2F6B1BB1-B477-42C9-915D-69F8CDE987BB}\{B2E6A68E-E4B6-4F11-92CA-76CF2E81A78C}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2F6B1BB1-B477-42C9-915D-69F8CDE987BB}\{C0174286-B648-4889-AA0F-D60B927471BB}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{2F6B1BB1-B477-42C9-915D-69F8CDE987BB}\{C0174286-B648-4889-AA0F-D60B927471BB}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{388DE810-C109-42F0-A553-34CA8796DF66}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{388DE810-C109-42F0-A553-34CA8796DF66}\{97708C01-D165-4889-8CC2-ABD1AF2EBF49}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{388DE810-C109-42F0-A553-34CA8796DF66}\{97708C01-D165-4889-8CC2-ABD1AF2EBF49}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{388DE810-C109-42F0-A553-34CA8796DF66}\{99FA49A8-1BAE-4715-B709-C4BE5C8D2518}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{388DE810-C109-42F0-A553-34CA8796DF66}\{99FA49A8-1BAE-4715-B709-C4BE5C8D2518}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{39C7F2D2-4452-41F4-B8DE-6F79A62DFCD4}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{39C7F2D2-4452-41F4-B8DE-6F79A62DFCD4}\{93AD2AD8-AAF7-4CD1-9E12-C730DEB1BD1B}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{39C7F2D2-4452-41F4-B8DE-6F79A62DFCD4}\{93AD2AD8-AAF7-4CD1-9E12-C730DEB1BD1B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{3EAF7080-FAA4-474F-88C3-C2ED8B7C2E90}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{3EAF7080-FAA4-474F-88C3-C2ED8B7C2E90}\{B784675F-D3BF-45C2-AB2C-0D7AB6974368}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{3EAF7080-FAA4-474F-88C3-C2ED8B7C2E90}\{B784675F-D3BF-45C2-AB2C-0D7AB6974368}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{3EAF7080-FAA4-474F-88C3-C2ED8B7C2E90}\{F1284F15-947D-4417-80EF-81FF181BA4F9}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{3EAF7080-FAA4-474F-88C3-C2ED8B7C2E90}\{F1284F15-947D-4417-80EF-81FF181BA4F9}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{035E3275-46A6-41F3-A44E-2AB8176AAE7A}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{035E3275-46A6-41F3-A44E-2AB8176AAE7A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{0D354FF3-AE08-4F60-8393-F33DACDA5B34}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{0D354FF3-AE08-4F60-8393-F33DACDA5B34}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{17D78BC8-4D43-4F6C-808E-1236FE4157D5}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{17D78BC8-4D43-4F6C-808E-1236FE4157D5}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{19661FC8-0C9E-43AF-AFC1-3DBFB66F3A6D}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{19661FC8-0C9E-43AF-AFC1-3DBFB66F3A6D}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{25D1CBE6-DBC7-4662-B3E8-F3996BD4F799}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{25D1CBE6-DBC7-4662-B3E8-F3996BD4F799}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{2DE479BD-5DB7-4C91-B99A-566550CF9A9C}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{2DE479BD-5DB7-4C91-B99A-566550CF9A9C}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{2E10B303-5AEF-4628-983C-E5464C11BD53}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{2E10B303-5AEF-4628-983C-E5464C11BD53}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{33346E65-A852-4165-8ED1-FA3A4D80B553}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{33346E65-A852-4165-8ED1-FA3A4D80B553}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{3395F3F8-A870-42AF-91F2-2B4C0E4E889E}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{3395F3F8-A870-42AF-91F2-2B4C0E4E889E}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{47AD5FE7-39A8-4722-BC0E-56BE00782951}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{47AD5FE7-39A8-4722-BC0E-56BE00782951}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{47E1B50B-42BB-4115-85D7-06332B6F3C59}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{47E1B50B-42BB-4115-85D7-06332B6F3C59}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{4FCFAAFA-7FAA-48BB-AB26-575E5F6E0186}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{4FCFAAFA-7FAA-48BB-AB26-575E5F6E0186}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{56602DF9-DFED-46F1-9F93-C1CE307F0E75}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{56602DF9-DFED-46F1-9F93-C1CE307F0E75}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{76AAC81A-7AD1-48B2-A669-CC03C455A7E0}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{76AAC81A-7AD1-48B2-A669-CC03C455A7E0}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{7F80CBF8-E7E4-47D0-A746-B57C97DD6476}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{7F80CBF8-E7E4-47D0-A746-B57C97DD6476}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{96DFE009-C1CC-4DAD-94CA-F993E1F00DFF}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{96DFE009-C1CC-4DAD-94CA-F993E1F00DFF}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{A2D02881-C92F-4AAB-8EBD-98B684944B6B}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{A2D02881-C92F-4AAB-8EBD-98B684944B6B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{AFA20719-BEEC-45BF-B762-AC694E6CAB2E}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{AFA20719-BEEC-45BF-B762-AC694E6CAB2E}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{B77BC408-B258-46B9-BBF0-40DDE710EF8E}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{B77BC408-B258-46B9-BBF0-40DDE710EF8E}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{BEA1F731-96B0-42F7-81EF-0E8017D3ED76}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{BEA1F731-96B0-42F7-81EF-0E8017D3ED76}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{C904B0AA-B17E-4124-B1D9-10600243C29D}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{C904B0AA-B17E-4124-B1D9-10600243C29D}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{D34E44A6-1CD7-4FA4-B0FF-F8E0658AE8C8}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{D34E44A6-1CD7-4FA4-B0FF-F8E0658AE8C8}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{D9844AAD-F6FA-4393-BF52-B7A5BAF12C64}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{D9844AAD-F6FA-4393-BF52-B7A5BAF12C64}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{EB4BB690-2622-4A0F-8AF1-D1D4160212CC}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{EB4BB690-2622-4A0F-8AF1-D1D4160212CC}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{F1F4CF05-D177-44CF-B77A-FD5DADA6DE37}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{F1F4CF05-D177-44CF-B77A-FD5DADA6DE37}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{F95FFC4E-4936-4B2B-AC83-057B5728FC85}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{F95FFC4E-4936-4B2B-AC83-057B5728FC85}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{FB65E246-2F05-4D6B-A068-781F28BB64D2}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{47D55E7E-400E-4AFF-88BB-FD27043E3C26}\{FB65E246-2F05-4D6B-A068-781F28BB64D2}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4973DCC7-FD15-4053-B8F5-C64F22D53EC4}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4973DCC7-FD15-4053-B8F5-C64F22D53EC4}\{52939C57-5AF0-4AC6-AD09-B8EBE87B5F8F}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4973DCC7-FD15-4053-B8F5-C64F22D53EC4}\{52939C57-5AF0-4AC6-AD09-B8EBE87B5F8F}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4973DCC7-FD15-4053-B8F5-C64F22D53EC4}\{E9290244-767F-42C1-9A0A-FE8EE9BFB489}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4973DCC7-FD15-4053-B8F5-C64F22D53EC4}\{E9290244-767F-42C1-9A0A-FE8EE9BFB489}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4DBDE0C6-E1D7-431F-95EE-ADAB9ABDBCD6}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4DBDE0C6-E1D7-431F-95EE-ADAB9ABDBCD6}\{048D36B0-2E5F-4639-B357-F7D387249223}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4DBDE0C6-E1D7-431F-95EE-ADAB9ABDBCD6}\{048D36B0-2E5F-4639-B357-F7D387249223}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4DBDE0C6-E1D7-431F-95EE-ADAB9ABDBCD6}\{9EE26760-B4AA-42D8-AE11-BC0307DC60B6}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4DBDE0C6-E1D7-431F-95EE-ADAB9ABDBCD6}\{9EE26760-B4AA-42D8-AE11-BC0307DC60B6}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4EC4AF38-B730-4C65-81B0-AB34DEB5D0A9}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4EC4AF38-B730-4C65-81B0-AB34DEB5D0A9}\{E89B100A-566F-40FD-A5D2-25BDFB01D1F3}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4EC4AF38-B730-4C65-81B0-AB34DEB5D0A9}\{E89B100A-566F-40FD-A5D2-25BDFB01D1F3}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{50F703DF-E316-4C71-8222-D89710B4C1F5}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{50F703DF-E316-4C71-8222-D89710B4C1F5}\{276AB808-80F7-46A3-B1E2-72B033EE25B1}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{50F703DF-E316-4C71-8222-D89710B4C1F5}\{276AB808-80F7-46A3-B1E2-72B033EE25B1}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{50F703DF-E316-4C71-8222-D89710B4C1F5}\{9D9DD6D7-2244-4A20-B0CB-B90649EF8A5C}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{50F703DF-E316-4C71-8222-D89710B4C1F5}\{9D9DD6D7-2244-4A20-B0CB-B90649EF8A5C}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{523F30D0-B4AB-4A05-8ABB-F54ABEBE423C}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{523F30D0-B4AB-4A05-8ABB-F54ABEBE423C}\{BE68CFD5-A423-4E54-935F-AA2BBB629D9D}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{523F30D0-B4AB-4A05-8ABB-F54ABEBE423C}\{BE68CFD5-A423-4E54-935F-AA2BBB629D9D}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{5379B601-5F10-4626-9479-7F24BA350DFD}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{5379B601-5F10-4626-9479-7F24BA350DFD}\{81A76B8F-A10B-407A-9E6B-83FCDBACE30E}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{5379B601-5F10-4626-9479-7F24BA350DFD}\{81A76B8F-A10B-407A-9E6B-83FCDBACE30E}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{5833C686-C1D3-45B6-ABAE-355B868245FA}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{5833C686-C1D3-45B6-ABAE-355B868245FA}\{7F915739-5C30-475D-B5C3-F977CDC9FE5C}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{5833C686-C1D3-45B6-ABAE-355B868245FA}\{7F915739-5C30-475D-B5C3-F977CDC9FE5C}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{5C1F7B33-621A-4D20-B273-D6F875B8A53D}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{5C1F7B33-621A-4D20-B273-D6F875B8A53D}\{14C4DB2E-AF86-48C5-954A-16FD81E6D998}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{5C1F7B33-621A-4D20-B273-D6F875B8A53D}\{14C4DB2E-AF86-48C5-954A-16FD81E6D998}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{62F833C8-8C24-4CB5-9888-647488221F8B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{62F833C8-8C24-4CB5-9888-647488221F8B}\{2966EC1C-DEAB-444B-BCA7-A8815F64D84F}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{62F833C8-8C24-4CB5-9888-647488221F8B}\{2966EC1C-DEAB-444B-BCA7-A8815F64D84F}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{6711B759-D28F-487C-B40B-22866E100213}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{6711B759-D28F-487C-B40B-22866E100213}\{25A08107-6F1C-4FF4-8B6C-EFAC21237431}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{6711B759-D28F-487C-B40B-22866E100213}\{25A08107-6F1C-4FF4-8B6C-EFAC21237431}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{6B571942-F0A5-4C3F-AE4C-48265A480143}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{6B571942-F0A5-4C3F-AE4C-48265A480143}\{070DF60A-6010-4A80-BEBE-55F226FB0CF0}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{6B571942-F0A5-4C3F-AE4C-48265A480143}\{070DF60A-6010-4A80-BEBE-55F226FB0CF0}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{6B571942-F0A5-4C3F-AE4C-48265A480143}\{94B12596-19EC-4C38-B55D-32FBFE50E337}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{6B571942-F0A5-4C3F-AE4C-48265A480143}\{94B12596-19EC-4C38-B55D-32FBFE50E337}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{6B571942-F0A5-4C3F-AE4C-48265A480143}\{951C5CF4-DDD9-415E-A99C-2363E86062EF}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{6B571942-F0A5-4C3F-AE4C-48265A480143}\{951C5CF4-DDD9-415E-A99C-2363E86062EF}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{6B571942-F0A5-4C3F-AE4C-48265A480143}\{BBB58E05-6123-4D50-9EC0-B64D7FAD1CD5}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{6B571942-F0A5-4C3F-AE4C-48265A480143}\{BBB58E05-6123-4D50-9EC0-B64D7FAD1CD5}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{6B7BD11F-9FB4-46FE-96FD-1F33A8ED7A2A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{6B7BD11F-9FB4-46FE-96FD-1F33A8ED7A2A}\{59A1BB91-4949-4CD7-A5F4-CBF01B110A7A}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{6B7BD11F-9FB4-46FE-96FD-1F33A8ED7A2A}\{59A1BB91-4949-4CD7-A5F4-CBF01B110A7A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{6B7BD11F-9FB4-46FE-96FD-1F33A8ED7A2A}\{7F173F7C-4A4D-4343-AD77-D1A8FF4E37E3}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{6B7BD11F-9FB4-46FE-96FD-1F33A8ED7A2A}\{7F173F7C-4A4D-4343-AD77-D1A8FF4E37E3}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{746ACF3D-B3CF-4CB4-B9A5-7DD0FF27981A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{746ACF3D-B3CF-4CB4-B9A5-7DD0FF27981A}\{80155A5E-9217-4573-B55C-E255483AEB09}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{746ACF3D-B3CF-4CB4-B9A5-7DD0FF27981A}\{80155A5E-9217-4573-B55C-E255483AEB09}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{763F2AB2-633A-4787-BE83-615E53030E97}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{763F2AB2-633A-4787-BE83-615E53030E97}\{9F00A077-40AA-4BC2-B7EA-9B9BA693B643}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{763F2AB2-633A-4787-BE83-615E53030E97}\{9F00A077-40AA-4BC2-B7EA-9B9BA693B643}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{799B37FE-1A35-46FC-BAE9-B0EA40F68375}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{799B37FE-1A35-46FC-BAE9-B0EA40F68375}\{BF433D05-5476-4A1A-BBF9-F0E218AE62F2}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{799B37FE-1A35-46FC-BAE9-B0EA40F68375}\{BF433D05-5476-4A1A-BBF9-F0E218AE62F2}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{799B37FE-1A35-46FC-BAE9-B0EA40F68375}\{E0547BA1-CA90-4021-B5C3-1FFCC9BBAD1F}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{799B37FE-1A35-46FC-BAE9-B0EA40F68375}\{E0547BA1-CA90-4021-B5C3-1FFCC9BBAD1F}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{7D4D61A2-D575-4F20-8755-65060183D37F}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{7D4D61A2-D575-4F20-8755-65060183D37F}\{B227E339-5D8B-4393-B922-D0B8E599CE63}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{7D4D61A2-D575-4F20-8755-65060183D37F}\{B227E339-5D8B-4393-B922-D0B8E599CE63}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{7DC17F22-E82D-490C-ADE7-7B1956CB22E1}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{7DC17F22-E82D-490C-ADE7-7B1956CB22E1}\{4C07BD27-E0A2-4391-B3BC-5D9EEC300114}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{7DC17F22-E82D-490C-ADE7-7B1956CB22E1}\{4C07BD27-E0A2-4391-B3BC-5D9EEC300114}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{7DC17F22-E82D-490C-ADE7-7B1956CB22E1}\{63D12ADA-629B-4EC6-AD7C-E192A3527401}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{7DC17F22-E82D-490C-ADE7-7B1956CB22E1}\{63D12ADA-629B-4EC6-AD7C-E192A3527401}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{872BEAB3-BF6C-4888-ACC1-97BBD1FE7D6D}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{872BEAB3-BF6C-4888-ACC1-97BBD1FE7D6D}\{58954FB3-50D5-4FC6-8661-59DC3F9FDF85}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{872BEAB3-BF6C-4888-ACC1-97BBD1FE7D6D}\{58954FB3-50D5-4FC6-8661-59DC3F9FDF85}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{872BEAB3-BF6C-4888-ACC1-97BBD1FE7D6D}\{CFC2A95A-1A20-4655-AE1F-3F64C914A171}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{872BEAB3-BF6C-4888-ACC1-97BBD1FE7D6D}\{CFC2A95A-1A20-4655-AE1F-3F64C914A171}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{8BF2FBAA-0BAD-4834-932D-5656094EC377}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{8BF2FBAA-0BAD-4834-932D-5656094EC377}\{46B75EBD-10AC-4B8D-B351-16DEBCD6B68C}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{8BF2FBAA-0BAD-4834-932D-5656094EC377}\{46B75EBD-10AC-4B8D-B351-16DEBCD6B68C}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{92EA98AC-F3D3-43CA-A5D5-F0DD3AF4E328}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{92EA98AC-F3D3-43CA-A5D5-F0DD3AF4E328}\{F4224FFB-CBB7-4685-A9B3-F1E79031F890}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{92EA98AC-F3D3-43CA-A5D5-F0DD3AF4E328}\{F4224FFB-CBB7-4685-A9B3-F1E79031F890}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{9873659F-2FFF-459D-8924-1DE60675E0FA}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{9873659F-2FFF-459D-8924-1DE60675E0FA}\{520A96A7-8973-47AB-89E2-3294072A4BAC}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{9873659F-2FFF-459D-8924-1DE60675E0FA}\{520A96A7-8973-47AB-89E2-3294072A4BAC}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{9B4A4928-FB55-45A8-A4B8-038172E5D323}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{9B4A4928-FB55-45A8-A4B8-038172E5D323}\{09400055-5E4B-4C21-A7D4-C22A18C85890}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{9B4A4928-FB55-45A8-A4B8-038172E5D323}\{09400055-5E4B-4C21-A7D4-C22A18C85890}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{9B4A4928-FB55-45A8-A4B8-038172E5D323}\{5FFC5D2E-71A4-43DA-BB9E-7C7716BAA191}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{9B4A4928-FB55-45A8-A4B8-038172E5D323}\{5FFC5D2E-71A4-43DA-BB9E-7C7716BAA191}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{9B4A4928-FB55-45A8-A4B8-038172E5D323}\{A077C38D-AFD9-4815-A1AD-C2847EF218E2}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{9B4A4928-FB55-45A8-A4B8-038172E5D323}\{A077C38D-AFD9-4815-A1AD-C2847EF218E2}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{9B4A4928-FB55-45A8-A4B8-038172E5D323}\{F7762336-F4A5-4027-940F-13768D341BE8}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{9B4A4928-FB55-45A8-A4B8-038172E5D323}\{F7762336-F4A5-4027-940F-13768D341BE8}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{9F677629-1495-4592-B22D-F7044960152D}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{9F677629-1495-4592-B22D-F7044960152D}\{F0A4B467-2721-4C9F-BD14-3DDAE2F60207}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{9F677629-1495-4592-B22D-F7044960152D}\{F0A4B467-2721-4C9F-BD14-3DDAE2F60207}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{ABAF5853-9158-49EE-8D73-DAD9A09AF394}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{ABAF5853-9158-49EE-8D73-DAD9A09AF394}\{2A9FA3F9-FFAA-40D8-9593-AFC5F81B003A}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{ABAF5853-9158-49EE-8D73-DAD9A09AF394}\{2A9FA3F9-FFAA-40D8-9593-AFC5F81B003A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{ABAF5853-9158-49EE-8D73-DAD9A09AF394}\{4600AEA1-3A0C-4D38-B340-BDC0655A2910}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{ABAF5853-9158-49EE-8D73-DAD9A09AF394}\{4600AEA1-3A0C-4D38-B340-BDC0655A2910}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{ABAF5853-9158-49EE-8D73-DAD9A09AF394}\{502282F0-AB9B-4C7A-99CE-CE5F67375D2A}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{ABAF5853-9158-49EE-8D73-DAD9A09AF394}\{502282F0-AB9B-4C7A-99CE-CE5F67375D2A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{ABAF5853-9158-49EE-8D73-DAD9A09AF394}\{63616A1D-78A2-4DCD-8368-251CBE1C8F4E}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{ABAF5853-9158-49EE-8D73-DAD9A09AF394}\{63616A1D-78A2-4DCD-8368-251CBE1C8F4E}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{ABAF5853-9158-49EE-8D73-DAD9A09AF394}\{8A362438-D3F9-42C8-A596-8952D8899278}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{ABAF5853-9158-49EE-8D73-DAD9A09AF394}\{8A362438-D3F9-42C8-A596-8952D8899278}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{AC77A6F2-C774-4497-8AD6-0E1352085AA2}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{AC77A6F2-C774-4497-8AD6-0E1352085AA2}\{7B897F4C-7387-4EAB-BF28-F096F8D26B6A}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{AC77A6F2-C774-4497-8AD6-0E1352085AA2}\{7B897F4C-7387-4EAB-BF28-F096F8D26B6A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{AF26FC86-157D-4A89-B0FE-628FB101B844}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{AF26FC86-157D-4A89-B0FE-628FB101B844}\{788E189B-A4A1-4B0A-9203-8070221FC49C}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{AF26FC86-157D-4A89-B0FE-628FB101B844}\{788E189B-A4A1-4B0A-9203-8070221FC49C}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{AF26FC86-157D-4A89-B0FE-628FB101B844}\{7D621AD5-203D-49CA-91F2-DD85E32D261D}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{AF26FC86-157D-4A89-B0FE-628FB101B844}\{7D621AD5-203D-49CA-91F2-DD85E32D261D}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{004FFF7C-D5EA-4351-A2DE-2F29C89526E8}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{004FFF7C-D5EA-4351-A2DE-2F29C89526E8}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{010A9474-F242-4A7F-BB03-2347D257E1BA}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{010A9474-F242-4A7F-BB03-2347D257E1BA}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{02817889-38C8-4C5A-A726-AD9E0830B470}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{02817889-38C8-4C5A-A726-AD9E0830B470}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{051F63E3-3755-48A3-BD5D-C551889B9FA7}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{051F63E3-3755-48A3-BD5D-C551889B9FA7}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{06D4E31A-F28F-4162-BDBC-5B015B7A9DFF}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{06D4E31A-F28F-4162-BDBC-5B015B7A9DFF}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{08251647-15E2-401D-9182-3781C06D5097}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{08251647-15E2-401D-9182-3781C06D5097}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{0AE92489-AD5B-46CF-9FCB-2F1BD6634A50}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{0AE92489-AD5B-46CF-9FCB-2F1BD6634A50}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{0DBB3DD3-AE07-42DF-9135-ED513A2B4768}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{0DBB3DD3-AE07-42DF-9135-ED513A2B4768}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{0E2A4148-D466-476B-B02E-1EF25357D96C}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{0E2A4148-D466-476B-B02E-1EF25357D96C}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{10692EC0-C5C7-40CB-8F6F-1B5AAD29E06D}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{10692EC0-C5C7-40CB-8F6F-1B5AAD29E06D}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{112C0FF4-A33D-43AB-A5F9-5011E5F3E1CC}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{112C0FF4-A33D-43AB-A5F9-5011E5F3E1CC}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{140C121A-B00E-4E21-9923-84306221099C}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{140C121A-B00E-4E21-9923-84306221099C}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{1429598B-3535-40AF-B4E6-6DA4DA277DB0}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{1429598B-3535-40AF-B4E6-6DA4DA277DB0}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{148DA04E-BD3B-4E0E-8D4F-26C9365A6711}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{148DA04E-BD3B-4E0E-8D4F-26C9365A6711}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{15C9DFC0-D83D-44EA-B0F3-95D8F983BBB0}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{15C9DFC0-D83D-44EA-B0F3-95D8F983BBB0}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{177632C9-3321-4E11-A519-D05A57E899C6}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{177632C9-3321-4E11-A519-D05A57E899C6}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{17E0710C-C1D9-4AF3-99A4-8DEDFAA112A3}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{17E0710C-C1D9-4AF3-99A4-8DEDFAA112A3}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{1B78E63D-27BD-4B02-9F03-273E909370C9}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{1B78E63D-27BD-4B02-9F03-273E909370C9}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{1BD0C692-7836-4D79-B551-836F89373C9C}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{1BD0C692-7836-4D79-B551-836F89373C9C}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{1D92D6A8-B0AC-470C-B702-08A2C416B7DD}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{1D92D6A8-B0AC-470C-B702-08A2C416B7DD}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{216ADE77-C675-4F84-8F4C-6E4B6D79AF5D}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{216ADE77-C675-4F84-8F4C-6E4B6D79AF5D}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{229E439B-E0CD-4C31-944C-1FC138E8C108}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{229E439B-E0CD-4C31-944C-1FC138E8C108}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{22E66B77-0892-498F-91D1-A467D4B5250B}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{22E66B77-0892-498F-91D1-A467D4B5250B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{2478383D-48F1-4B4B-93AD-1E0BD7D4CE17}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{2478383D-48F1-4B4B-93AD-1E0BD7D4CE17}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{257EF2DE-AF46-4B6D-A579-56D2A8F1B1E9}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{257EF2DE-AF46-4B6D-A579-56D2A8F1B1E9}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{269AF691-51E3-4C5B-A5C9-C9AD326E0DA5}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{269AF691-51E3-4C5B-A5C9-C9AD326E0DA5}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{27586DA3-1EF0-43CF-95D8-B946B1933B25}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{27586DA3-1EF0-43CF-95D8-B946B1933B25}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{283EB653-592E-43B8-A83D-6D17FBF1B4DE}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{283EB653-592E-43B8-A83D-6D17FBF1B4DE}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{2A3213A4-478F-4ED3-BD5A-CFC9E1090CB3}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{2A3213A4-478F-4ED3-BD5A-CFC9E1090CB3}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{2A9051EB-800D-47F5-93F9-01A9B29ED01D}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{2A9051EB-800D-47F5-93F9-01A9B29ED01D}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{2C1071FA-9FC6-42C2-A5F3-D9751AB2BE91}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{2C1071FA-9FC6-42C2-A5F3-D9751AB2BE91}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{2C278E0E-1729-48CD-98BD-A722EFB66179}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{2C278E0E-1729-48CD-98BD-A722EFB66179}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{2D2EA505-8A9F-4DD5-AD2C-AC6DC6D83654}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{2D2EA505-8A9F-4DD5-AD2C-AC6DC6D83654}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{2D6E6C79-F43E-4AFE-805B-BB64B05EB8E5}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{2D6E6C79-F43E-4AFE-805B-BB64B05EB8E5}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{3B82504F-D073-46E5-99F0-4AB4F42ABA0F}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{3B82504F-D073-46E5-99F0-4AB4F42ABA0F}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{3BD15497-1ADB-4874-AF04-CEA8A9234488}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{3BD15497-1ADB-4874-AF04-CEA8A9234488}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{3C6FFE89-90DD-499C-9159-F52367002B18}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{3C6FFE89-90DD-499C-9159-F52367002B18}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{3CBA172F-C908-436A-A95F-B5BD5179ADA1}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{3CBA172F-C908-436A-A95F-B5BD5179ADA1}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{41056D11-7508-42C8-9FB6-6BDD9E74E1F1}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{41056D11-7508-42C8-9FB6-6BDD9E74E1F1}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{43A0DA88-B509-4D40-A8A1-EE4621120282}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{43A0DA88-B509-4D40-A8A1-EE4621120282}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{46934E4F-1410-4DEB-BC58-DFB2A235C14B}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{46934E4F-1410-4DEB-BC58-DFB2A235C14B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{46EF7253-C8EF-4213-89AD-D39A3FE06CA0}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{46EF7253-C8EF-4213-89AD-D39A3FE06CA0}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{48250240-5A80-4507-9B65-F096CFF8361D}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{48250240-5A80-4507-9B65-F096CFF8361D}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{4C3E3FB2-02D9-4D64-9E62-943543B727D4}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{4C3E3FB2-02D9-4D64-9E62-943543B727D4}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{4C6DC295-FA77-4CD4-9629-2B1AB5218A23}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{4C6DC295-FA77-4CD4-9629-2B1AB5218A23}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{4E2E8BEC-6084-4017-AADB-0E51A1F9D610}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{4E2E8BEC-6084-4017-AADB-0E51A1F9D610}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{4F816845-2BC4-497A-BEFF-96C109D9463F}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{4F816845-2BC4-497A-BEFF-96C109D9463F}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{4FA192A8-AE9B-4B3B-80BB-467048B16B9A}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{4FA192A8-AE9B-4B3B-80BB-467048B16B9A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{5013E32C-D4FD-4AF6-833F-73D3E7319F22}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{5013E32C-D4FD-4AF6-833F-73D3E7319F22}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{51710AB1-5968-48C5-A6FD-2357DD51F0E7}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{51710AB1-5968-48C5-A6FD-2357DD51F0E7}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{52615DC6-B1C8-4A91-BEB7-11CE597890D0}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{52615DC6-B1C8-4A91-BEB7-11CE597890D0}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{53F4F6D5-653F-44B5-8088-5F7C3EE3C6D6}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{53F4F6D5-653F-44B5-8088-5F7C3EE3C6D6}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{57FFADD8-0CDD-4C75-A930-9D29467A71C9}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{57FFADD8-0CDD-4C75-A930-9D29467A71C9}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{5C2E3DB2-CA41-4D45-93CB-B19CE5885AB5}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{5C2E3DB2-CA41-4D45-93CB-B19CE5885AB5}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{5C67A3A7-993F-4DC4-9E11-12E847532002}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{5C67A3A7-993F-4DC4-9E11-12E847532002}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{5D8F0FE7-D7ED-4B6E-8DE2-29A8A0F36EA7}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{5D8F0FE7-D7ED-4B6E-8DE2-29A8A0F36EA7}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{5E49A1E1-6306-4E26-93D9-42B24F22838B}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{5E49A1E1-6306-4E26-93D9-42B24F22838B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{5EA0BEA0-B58C-4671-8033-D4C2287DDF4A}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{5EA0BEA0-B58C-4671-8033-D4C2287DDF4A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{5ECA826D-0142-4653-A78D-E45F76AC6D62}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{5ECA826D-0142-4653-A78D-E45F76AC6D62}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{66279B05-B689-445B-992A-1F7189A78298}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{66279B05-B689-445B-992A-1F7189A78298}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{665BE26D-C3B7-4A72-ACA5-3DD1DA1180CC}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{665BE26D-C3B7-4A72-ACA5-3DD1DA1180CC}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{66922559-1C61-4C53-892B-870E9532EF8C}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{66922559-1C61-4C53-892B-870E9532EF8C}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{688CC929-1329-4FFD-8C76-77E3D7F80BDF}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{688CC929-1329-4FFD-8C76-77E3D7F80BDF}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{6A3DE46C-59A0-4F12-B2A5-263AC4B0CDF8}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{6A3DE46C-59A0-4F12-B2A5-263AC4B0CDF8}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{6BA315C2-D042-4EE2-9DFF-810702B49073}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{6BA315C2-D042-4EE2-9DFF-810702B49073}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{6C54664E-DF7B-49E5-910D-49183BD81A6E}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{6C54664E-DF7B-49E5-910D-49183BD81A6E}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{6C830514-04FD-48C7-B0C4-19DF76C1E93D}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{6C830514-04FD-48C7-B0C4-19DF76C1E93D}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{6D1BD1A2-46A4-44EF-B58D-C024458CC5B8}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{6D1BD1A2-46A4-44EF-B58D-C024458CC5B8}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{6D299302-BD63-4F48-85BB-49E40D36B566}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{6D299302-BD63-4F48-85BB-49E40D36B566}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{6DC175C1-D93B-475E-818A-9235F70540CF}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{6DC175C1-D93B-475E-818A-9235F70540CF}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{7033B7A2-071E-4332-B8D3-BA54AE00F0FA}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{7033B7A2-071E-4332-B8D3-BA54AE00F0FA}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{70EBFEFE-71AA-43DC-BE0C-0A524B5BE4E4}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{70EBFEFE-71AA-43DC-BE0C-0A524B5BE4E4}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{7105EE3D-CBE1-45CB-9C16-0C347DD0F9CA}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{7105EE3D-CBE1-45CB-9C16-0C347DD0F9CA}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{72D62593-6D2C-42A5-B0EA-2177B5931D83}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{72D62593-6D2C-42A5-B0EA-2177B5931D83}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{74CFD438-E0EB-41C6-BEC1-64E7A4CC4D78}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{74CFD438-E0EB-41C6-BEC1-64E7A4CC4D78}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{750E606B-A121-4DE4-BD73-8EA4F28FB155}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{750E606B-A121-4DE4-BD73-8EA4F28FB155}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{7670A8D1-711E-49D2-893E-9AE05218178C}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{7670A8D1-711E-49D2-893E-9AE05218178C}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{7887B3BD-C691-47C7-9AEB-47333D5EBEAE}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{7887B3BD-C691-47C7-9AEB-47333D5EBEAE}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{79019988-704C-46D0-91A9-56F96480C9F0}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{79019988-704C-46D0-91A9-56F96480C9F0}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{7B3494DE-4546-43D0-883F-3F93C189A02A}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{7B3494DE-4546-43D0-883F-3F93C189A02A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{7F68823F-A123-4080-BDC0-DD987B73E5DC}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{7F68823F-A123-4080-BDC0-DD987B73E5DC}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{7FA7DB4C-9F1E-49D1-B577-92E9E8A88A58}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{7FA7DB4C-9F1E-49D1-B577-92E9E8A88A58}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{81C1A1F0-D260-4AF2-AF58-F94EF54B9F3D}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{81C1A1F0-D260-4AF2-AF58-F94EF54B9F3D}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{83B2904F-3D74-4E9E-A9DA-A9A4D82F2F7F}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{83B2904F-3D74-4E9E-A9DA-A9A4D82F2F7F}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{8508A5E3-ECFD-41E8-B9A3-DCE3B99896ED}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{8508A5E3-ECFD-41E8-B9A3-DCE3B99896ED}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{859194D6-7CA8-404B-95E3-EFC71F321453}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{859194D6-7CA8-404B-95E3-EFC71F321453}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{86EEBED4-2AFA-431E-9898-AF134E6EFC17}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{86EEBED4-2AFA-431E-9898-AF134E6EFC17}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{8BDD56BF-8CB1-443F-821F-EF7742DCB334}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{8BDD56BF-8CB1-443F-821F-EF7742DCB334}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{8C2A420A-2EED-40B9-87A2-B1AAF6F373AD}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{8C2A420A-2EED-40B9-87A2-B1AAF6F373AD}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{8DF11DD7-23D3-4427-A061-AD4860808F07}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{8DF11DD7-23D3-4427-A061-AD4860808F07}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{91DC3988-0A40-4AD2-A8ED-A1443CE0922C}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{91DC3988-0A40-4AD2-A8ED-A1443CE0922C}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{9241147F-4B2E-42D0-BF79-BACC577D4E72}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{9241147F-4B2E-42D0-BF79-BACC577D4E72}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{9651932C-75F9-4C7B-BCC2-8F5413780DBB}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{9651932C-75F9-4C7B-BCC2-8F5413780DBB}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{99065158-5740-4814-B678-CE47FB8311FB}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{99065158-5740-4814-B678-CE47FB8311FB}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{99BC4E6E-FB4C-40F0-B5D8-661D74EEF4C6}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{99BC4E6E-FB4C-40F0-B5D8-661D74EEF4C6}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{9BE4BBE9-90C2-4007-8392-9603E7223A94}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{9BE4BBE9-90C2-4007-8392-9603E7223A94}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{9CA01407-206D-4A45-A5B2-63AA83406D32}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{9CA01407-206D-4A45-A5B2-63AA83406D32}.qbi

Robbyj717 · 06-17-2008, 09:45 PM

C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{9CD358A9-AAC2-4DB9-8DCD-B6FDE04351B4}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{9CD358A9-AAC2-4DB9-8DCD-B6FDE04351B4}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{9DCF767A-04D6-41D9-B3E1-028A8860588B}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{9DCF767A-04D6-41D9-B3E1-028A8860588B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{9FC0BB4C-6C0F-4C8D-9954-4C805995BAEF}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{9FC0BB4C-6C0F-4C8D-9954-4C805995BAEF}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{9FCC28E1-AA32-4CF9-BDA4-EFA55A9EFA98}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{9FCC28E1-AA32-4CF9-BDA4-EFA55A9EFA98}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{A04E13A1-7235-4334-AA5A-75709E2AFC8B}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{A04E13A1-7235-4334-AA5A-75709E2AFC8B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{A0984E01-8C96-4A16-AD0E-5EA80AC67A10}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{A0984E01-8C96-4A16-AD0E-5EA80AC67A10}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{A22A00A7-A386-471B-9EE2-699278FFEA5D}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{A22A00A7-A386-471B-9EE2-699278FFEA5D}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{A2D79A0C-40B9-4D74-A974-139E0ACB6C96}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{A2D79A0C-40B9-4D74-A974-139E0ACB6C96}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{A4279011-7D07-40E1-A36C-9E4DC50741B8}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{A4279011-7D07-40E1-A36C-9E4DC50741B8}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{A4F39170-CE53-4D70-903F-C35DAF86DFC1}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{A4F39170-CE53-4D70-903F-C35DAF86DFC1}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{A7071806-88BC-42E6-821E-45917D96EECF}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{A7071806-88BC-42E6-821E-45917D96EECF}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{A77A6E1B-D6C8-4382-BB2E-77A9ABCADDFF}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{A77A6E1B-D6C8-4382-BB2E-77A9ABCADDFF}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{A8B641FE-0EC0-4F51-A19C-7D40398BFE61}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{A8B641FE-0EC0-4F51-A19C-7D40398BFE61}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{ADC9DD2C-D2A9-44DC-BEAD-C2A65DE9F785}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{ADC9DD2C-D2A9-44DC-BEAD-C2A65DE9F785}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{ADEFEF69-3E30-461E-8E08-9E5D6A25B26F}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{ADEFEF69-3E30-461E-8E08-9E5D6A25B26F}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B0429560-5E81-4DF6-AEC4-B7169A29AF8E}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B0429560-5E81-4DF6-AEC4-B7169A29AF8E}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B1654681-C050-4869-84D7-1586B11E35A4}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B1654681-C050-4869-84D7-1586B11E35A4}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B2224887-BBB7-4382-81B2-865C22A2808F}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B2224887-BBB7-4382-81B2-865C22A2808F}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B331CE1C-E9F4-4A52-BD0B-63E77312D83E}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B331CE1C-E9F4-4A52-BD0B-63E77312D83E}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B3F3557C-050E-47A8-B01D-E3897F7952FA}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B3F3557C-050E-47A8-B01D-E3897F7952FA}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B4381D1B-6183-4F09-B536-89FA197947D3}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B4381D1B-6183-4F09-B536-89FA197947D3}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B5FCC6A5-190D-47C4-8D8A-FF480167FB8E}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B5FCC6A5-190D-47C4-8D8A-FF480167FB8E}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B64AE05E-E42C-4B8A-9BFC-EDD1A780130D}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B64AE05E-E42C-4B8A-9BFC-EDD1A780130D}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B7D3B1D6-D66D-47CE-8D95-964BD02447E3}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B7D3B1D6-D66D-47CE-8D95-964BD02447E3}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B833B29B-F663-4D84-8D8F-88EA9621935C}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B833B29B-F663-4D84-8D8F-88EA9621935C}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B83CE046-778E-45A4-8EE9-5F9345208255}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B83CE046-778E-45A4-8EE9-5F9345208255}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B94F739D-45CA-4888-98D5-C4EDB4DB039F}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B94F739D-45CA-4888-98D5-C4EDB4DB039F}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B9AEE6D0-040C-4DA6-984D-0DF47D0D5459}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B9AEE6D0-040C-4DA6-984D-0DF47D0D5459}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B9E1CEE1-8B7C-4CE6-A4DC-32CA03145959}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{B9E1CEE1-8B7C-4CE6-A4DC-32CA03145959}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{BAB606BF-3879-449B-85F7-174A255356C5}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{BAB606BF-3879-449B-85F7-174A255356C5}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{BADA5078-57DA-417A-9B8D-3BA8C333BC39}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{BADA5078-57DA-417A-9B8D-3BA8C333BC39}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{BAFDEEF5-DB09-42BC-847B-E64C1184CD0E}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{BAFDEEF5-DB09-42BC-847B-E64C1184CD0E}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{BB34EC00-1157-4C1C-B82F-CF1D9BBF79BE}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{BB34EC00-1157-4C1C-B82F-CF1D9BBF79BE}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{BD5F94C1-C888-4CE4-A842-1CF20268123B}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{BD5F94C1-C888-4CE4-A842-1CF20268123B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{BDE35415-08C2-4471-997B-61343936D9DD}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{BDE35415-08C2-4471-997B-61343936D9DD}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{BE75E5EF-2431-4560-A61D-61F62DC6AFC7}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{BE75E5EF-2431-4560-A61D-61F62DC6AFC7}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{C0009314-D793-446A-AFAD-A3C77304A670}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{C0009314-D793-446A-AFAD-A3C77304A670}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{C1671ACA-A356-4F6A-A750-2A12A03072B0}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{C1671ACA-A356-4F6A-A750-2A12A03072B0}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{C3199D0B-789E-4FD4-9348-E37019D5AE39}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{C3199D0B-789E-4FD4-9348-E37019D5AE39}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{C633482F-FBDD-45F7-960A-79ECCEA850A6}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{C633482F-FBDD-45F7-960A-79ECCEA850A6}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{C8B9ADFC-1398-453E-A468-14FDD3DB960D}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{C8B9ADFC-1398-453E-A468-14FDD3DB960D}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{CB4C6968-87AE-4612-ABC9-94E83A915A66}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{CB4C6968-87AE-4612-ABC9-94E83A915A66}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{CBA3DAD8-4597-4A16-AA7F-EF32AEBD90B7}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{CBA3DAD8-4597-4A16-AA7F-EF32AEBD90B7}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{CCB132CA-361C-4D98-B202-6B02AA3DEAF0}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{CCB132CA-361C-4D98-B202-6B02AA3DEAF0}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{CD722ED5-81B0-4C21-956E-4C5D1E0A9E44}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{CD722ED5-81B0-4C21-956E-4C5D1E0A9E44}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{CF09F487-CFD1-4C9B-BBE4-0ECD3377335D}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{CF09F487-CFD1-4C9B-BBE4-0ECD3377335D}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{CF564D05-51D8-48A8-95B1-21EB824AB408}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{CF564D05-51D8-48A8-95B1-21EB824AB408}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{D229BAF4-475F-4682-88BE-0E13D0DEC8E5}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{D229BAF4-475F-4682-88BE-0E13D0DEC8E5}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{D351F8E8-6BB5-4D8C-9BE5-4ADA1C02AEAB}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{D351F8E8-6BB5-4D8C-9BE5-4ADA1C02AEAB}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{D3C69557-79D6-48F3-879A-C35BEDD86405}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{D3C69557-79D6-48F3-879A-C35BEDD86405}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{D5221D16-3F4C-4035-BF3F-97A43CBD7115}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{D5221D16-3F4C-4035-BF3F-97A43CBD7115}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{D675D9AF-4A98-424F-9043-769D4932D206}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{D675D9AF-4A98-424F-9043-769D4932D206}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{D8902A79-40E5-439F-A0EC-8F267D3D031A}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{D8902A79-40E5-439F-A0EC-8F267D3D031A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{DC6F2507-15A0-4E83-B2CF-90F7761BD782}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{DC6F2507-15A0-4E83-B2CF-90F7761BD782}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{DD731EE4-1CF4-40B6-9874-FEA43DAF6D77}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{DD731EE4-1CF4-40B6-9874-FEA43DAF6D77}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{DED42637-1743-4F2D-A514-9A402EBFB919}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{DED42637-1743-4F2D-A514-9A402EBFB919}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{DEEBCC0C-597E-45B4-897A-D0E24E632628}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{DEEBCC0C-597E-45B4-897A-D0E24E632628}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{DF013757-E3CA-4939-852B-1F6A5DD78DF4}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{DF013757-E3CA-4939-852B-1F6A5DD78DF4}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{DF7E95B0-618B-412F-897D-ABF92B86DD93}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{DF7E95B0-618B-412F-897D-ABF92B86DD93}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{E634C214-D905-4FD3-BBFF-A019FB9E42F8}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{E634C214-D905-4FD3-BBFF-A019FB9E42F8}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{E8F39182-24D7-440F-AEF5-CC7722B0A443}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{E8F39182-24D7-440F-AEF5-CC7722B0A443}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{ED6BD44E-474E-432D-9819-4604DAD30367}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{ED6BD44E-474E-432D-9819-4604DAD30367}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{EF59A1C3-5E92-4F5A-948A-3C6666CAEA43}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{EF59A1C3-5E92-4F5A-948A-3C6666CAEA43}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{F01294C4-DC84-4CD6-963D-8B06C67A1792}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{F01294C4-DC84-4CD6-963D-8B06C67A1792}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{F1DE8C8F-75AD-45B7-B831-E31EDFA73D32}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{F1DE8C8F-75AD-45B7-B831-E31EDFA73D32}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{F4956137-AE55-46AF-92E7-8C3CAF9059F0}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{F4956137-AE55-46AF-92E7-8C3CAF9059F0}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{F5141F86-757A-4F81-9B32-CB950A4374E2}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{F5141F86-757A-4F81-9B32-CB950A4374E2}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{F581546D-7D2B-44C8-A23A-138E961AB949}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{F581546D-7D2B-44C8-A23A-138E961AB949}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{F72872AC-1CA8-423D-99D5-B079303D06B8}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{F72872AC-1CA8-423D-99D5-B079303D06B8}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{F74567BE-AF7B-41B9-89BC-479068312DAD}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{F74567BE-AF7B-41B9-89BC-479068312DAD}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{F9FC4016-F667-41D3-A361-1524EB830422}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{F9FC4016-F667-41D3-A361-1524EB830422}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{FBD54013-1F99-4752-A0F1-E74596CEF544}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{FBD54013-1F99-4752-A0F1-E74596CEF544}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{FE01FEB1-8637-4AC8-B24C-F4E40A6AEB82}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{FE01FEB1-8637-4AC8-B24C-F4E40A6AEB82}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{FE38AEF7-147E-4726-9232-F85C1B77C1B5}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{FE38AEF7-147E-4726-9232-F85C1B77C1B5}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{FEDC0D0D-B946-4C27-A1CE-20F9651D664B}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{FEDC0D0D-B946-4C27-A1CE-20F9651D664B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{FF24FBFE-A562-480E-969C-FBAA31C30E09}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{FF24FBFE-A562-480E-969C-FBAA31C30E09}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{FF97C34B-F58B-464E-9849-7416B1D43B4A}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{FF97C34B-F58B-464E-9849-7416B1D43B4A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{FFC90C70-A698-47D4-AD1C-472EA87DE323}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{FFC90C70-A698-47D4-AD1C-472EA87DE323}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{FFD8BA81-5470-4D7C-AE83-2D827E93525A}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B6853AC3-D5B3-40DA-A3AF-9C9C8C24E749}\{FFD8BA81-5470-4D7C-AE83-2D827E93525A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B77E0011-66C2-4845-B250-9C2BB7E165DE}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B77E0011-66C2-4845-B250-9C2BB7E165DE}\{08D17234-73A3-4091-B1D3-05517583E349}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B77E0011-66C2-4845-B250-9C2BB7E165DE}\{08D17234-73A3-4091-B1D3-05517583E349}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B77E0011-66C2-4845-B250-9C2BB7E165DE}\{4028F1FD-89A3-480A-9A87-9DB1F5812934}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{B77E0011-66C2-4845-B250-9C2BB7E165DE}\{4028F1FD-89A3-480A-9A87-9DB1F5812934}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{BF3C527D-4860-40F3-88BE-CAD6A708D8E1}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{BF3C527D-4860-40F3-88BE-CAD6A708D8E1}\{95AF2941-4B5E-4014-91F6-502D30888583}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{BF3C527D-4860-40F3-88BE-CAD6A708D8E1}\{95AF2941-4B5E-4014-91F6-502D30888583}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{BF3C527D-4860-40F3-88BE-CAD6A708D8E1}\{C75366EB-2975-45A5-A2AC-9734AAF048A4}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{BF3C527D-4860-40F3-88BE-CAD6A708D8E1}\{C75366EB-2975-45A5-A2AC-9734AAF048A4}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{BF3C527D-4860-40F3-88BE-CAD6A708D8E1}\{F2C35F7B-0CC1-4AAF-AD96-49193B3524C2}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{BF3C527D-4860-40F3-88BE-CAD6A708D8E1}\{F2C35F7B-0CC1-4AAF-AD96-49193B3524C2}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{BF3C527D-4860-40F3-88BE-CAD6A708D8E1}\{FDFE538A-5A99-485E-A628-8E7F3F2CE5DF}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{BF3C527D-4860-40F3-88BE-CAD6A708D8E1}\{FDFE538A-5A99-485E-A628-8E7F3F2CE5DF}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C95EFE3C-DEF9-425D-B59C-F9328171FF1E}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C95EFE3C-DEF9-425D-B59C-F9328171FF1E}\{462F569E-2CA7-4CE3-8747-EB39FA6F5DF5}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C95EFE3C-DEF9-425D-B59C-F9328171FF1E}\{462F569E-2CA7-4CE3-8747-EB39FA6F5DF5}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C95EFE3C-DEF9-425D-B59C-F9328171FF1E}\{7A7AD333-9620-47EE-B5E7-C03A4BB676D5}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C95EFE3C-DEF9-425D-B59C-F9328171FF1E}\{7A7AD333-9620-47EE-B5E7-C03A4BB676D5}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{D760D9D7-B2E3-4F3B-A5EA-FF45FEEEC964}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{D760D9D7-B2E3-4F3B-A5EA-FF45FEEEC964}\{726F0AA7-FE44-4563-9C96-918E068D1A0F}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{D760D9D7-B2E3-4F3B-A5EA-FF45FEEEC964}\{726F0AA7-FE44-4563-9C96-918E068D1A0F}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{D760D9D7-B2E3-4F3B-A5EA-FF45FEEEC964}\{9170001F-EBE1-4D22-85F2-D86CE2ACAD1E}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{D760D9D7-B2E3-4F3B-A5EA-FF45FEEEC964}\{9170001F-EBE1-4D22-85F2-D86CE2ACAD1E}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{D87BF5EF-EB95-4A19-AF08-5613DBDFF34D}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{D87BF5EF-EB95-4A19-AF08-5613DBDFF34D}\{0A08CAE9-C463-4D5C-A109-EB28E5A3FBAA}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{D87BF5EF-EB95-4A19-AF08-5613DBDFF34D}\{0A08CAE9-C463-4D5C-A109-EB28E5A3FBAA}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DC11352D-7B6A-45B5-B081-2EA3E4D85190}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DC11352D-7B6A-45B5-B081-2EA3E4D85190}\{72120598-4B2C-45DD-863A-1F9202A8CBB8}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DC11352D-7B6A-45B5-B081-2EA3E4D85190}\{72120598-4B2C-45DD-863A-1F9202A8CBB8}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DC11352D-7B6A-45B5-B081-2EA3E4D85190}\{7AC1F578-DF2B-4511-B59C-E2B0762C9E95}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DC11352D-7B6A-45B5-B081-2EA3E4D85190}\{7AC1F578-DF2B-4511-B59C-E2B0762C9E95}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DC11352D-7B6A-45B5-B081-2EA3E4D85190}\{7B6A7E6B-7C72-4AA3-8250-4C3BFA93E9FA}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DC11352D-7B6A-45B5-B081-2EA3E4D85190}\{7B6A7E6B-7C72-4AA3-8250-4C3BFA93E9FA}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DC11352D-7B6A-45B5-B081-2EA3E4D85190}\{7BF4464B-89B2-45A2-8981-4ABECD9EDBB4}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DC11352D-7B6A-45B5-B081-2EA3E4D85190}\{7BF4464B-89B2-45A2-8981-4ABECD9EDBB4}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DC11352D-7B6A-45B5-B081-2EA3E4D85190}\{9956F4CA-4A24-49AF-BD32-0CA928733FB5}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DC11352D-7B6A-45B5-B081-2EA3E4D85190}\{9956F4CA-4A24-49AF-BD32-0CA928733FB5}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DC11352D-7B6A-45B5-B081-2EA3E4D85190}\{B3EF7156-7091-4294-9531-1378979FE096}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DC11352D-7B6A-45B5-B081-2EA3E4D85190}\{B3EF7156-7091-4294-9531-1378979FE096}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DC11352D-7B6A-45B5-B081-2EA3E4D85190}\{CF7E58D3-7FE4-4552-806F-EDB4D46C8BB4}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DC11352D-7B6A-45B5-B081-2EA3E4D85190}\{CF7E58D3-7FE4-4552-806F-EDB4D46C8BB4}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DC11352D-7B6A-45B5-B081-2EA3E4D85190}\{ED37A8F6-2860-421A-A615-FE311F350539}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DC11352D-7B6A-45B5-B081-2EA3E4D85190}\{ED37A8F6-2860-421A-A615-FE311F350539}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DC11352D-7B6A-45B5-B081-2EA3E4D85190}\{F2547C48-E4ED-4A4E-BC20-837023B25D63}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DC11352D-7B6A-45B5-B081-2EA3E4D85190}\{F2547C48-E4ED-4A4E-BC20-837023B25D63}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DC11352D-7B6A-45B5-B081-2EA3E4D85190}\{FE7D0F35-474E-4678-AEC3-9796A6075776}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DC11352D-7B6A-45B5-B081-2EA3E4D85190}\{FE7D0F35-474E-4678-AEC3-9796A6075776}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{0735A6F0-D3B1-4ED1-9B5E-21FB313611DC}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{0735A6F0-D3B1-4ED1-9B5E-21FB313611DC}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{1198E1F4-E1E4-47E4-A6ED-7DC5353A6340}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{1198E1F4-E1E4-47E4-A6ED-7DC5353A6340}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{12D56F2E-CFD2-4910-9857-ECF362236365}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{12D56F2E-CFD2-4910-9857-ECF362236365}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{1A613DFA-027C-408B-9B17-C20D4A51CE4D}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{1A613DFA-027C-408B-9B17-C20D4A51CE4D}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{1D8400F1-F66F-4E56-83D1-FC58301E1473}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{1D8400F1-F66F-4E56-83D1-FC58301E1473}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{3016A72D-74C7-434A-A7FD-3A37CE284621}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{3016A72D-74C7-434A-A7FD-3A37CE284621}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{31C1AC3F-144E-4A56-9C6C-BF81DB9A75F0}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{31C1AC3F-144E-4A56-9C6C-BF81DB9A75F0}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{3AED5E51-6E3E-4098-8801-AF32AADE6D26}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{3AED5E51-6E3E-4098-8801-AF32AADE6D26}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{4F50B821-5192-42B5-B324-38DB74F700D2}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{4F50B821-5192-42B5-B324-38DB74F700D2}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{5EF88413-4C7D-49AE-AC79-65D34B7C7AD8}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{5EF88413-4C7D-49AE-AC79-65D34B7C7AD8}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{68B42787-FC6D-41AD-9310-6741F6AC2C43}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{68B42787-FC6D-41AD-9310-6741F6AC2C43}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{6D4A77F7-6D17-4ECA-853B-1732436F4A4F}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{6D4A77F7-6D17-4ECA-853B-1732436F4A4F}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{72DF7812-98E0-4FD5-B552-E4460186D104}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{72DF7812-98E0-4FD5-B552-E4460186D104}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{8E02E96B-7775-4F65-B9F3-898D5DE62851}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{8E02E96B-7775-4F65-B9F3-898D5DE62851}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{8E509D73-142F-4497-BA7D-960973062530}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{8E509D73-142F-4497-BA7D-960973062530}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{9D00965B-F515-4DAC-ADE6-F5DD65D09295}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{9D00965B-F515-4DAC-ADE6-F5DD65D09295}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{B99BBCF5-9646-43C1-AF4C-10C3727D116D}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{B99BBCF5-9646-43C1-AF4C-10C3727D116D}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{BBB53708-D89A-4D66-A387-03566B445427}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{BBB53708-D89A-4D66-A387-03566B445427}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{BC15C0BB-84A0-46D1-8611-80D7EA65F114}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{BC15C0BB-84A0-46D1-8611-80D7EA65F114}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{C8B108EB-0340-44D0-BBAF-332C1966D011}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{C8B108EB-0340-44D0-BBAF-332C1966D011}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{CA649CEC-FFC7-4CB6-85AD-4BC688997ED6}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{CA649CEC-FFC7-4CB6-85AD-4BC688997ED6}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{E7B950FC-BCC8-4F76-8898-FFEF7DE807F9}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{E7B950FC-BCC8-4F76-8898-FFEF7DE807F9}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{EAC3EB36-ABDE-4962-BF89-6E5D2EEBDD75}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{EAC3EB36-ABDE-4962-BF89-6E5D2EEBDD75}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{EB801D7F-4EAB-422B-9219-2096F0470A18}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{EB801D7F-4EAB-422B-9219-2096F0470A18}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{F4110E9D-C838-47DE-9815-3F1664E53B0E}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DD626C7F-A9F8-4714-83AA-14501EEA7564}\{F4110E9D-C838-47DE-9815-3F1664E53B0E}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DE47E43A-0DF6-45E0-83AA-A81152BDF2D3}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DE47E43A-0DF6-45E0-83AA-A81152BDF2D3}\{3C97D4F4-9DC0-4782-A6E8-B5223503A805}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DE47E43A-0DF6-45E0-83AA-A81152BDF2D3}\{3C97D4F4-9DC0-4782-A6E8-B5223503A805}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DE47E43A-0DF6-45E0-83AA-A81152BDF2D3}\{FFEDB799-70F9-4541-BAEB-51F873ACC2E2}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DE47E43A-0DF6-45E0-83AA-A81152BDF2D3}\{FFEDB799-70F9-4541-BAEB-51F873ACC2E2}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DEF72C1A-A2C3-49B2-A03C-F58CB8F35CB0}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DEF72C1A-A2C3-49B2-A03C-F58CB8F35CB0}\{EF507046-FFEF-4B8A-9C65-B5B4C2F419CF}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DEF72C1A-A2C3-49B2-A03C-F58CB8F35CB0}\{EF507046-FFEF-4B8A-9C65-B5B4C2F419CF}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DEFECA7D-B11F-4E66-8BFF-1812C5A0864E}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DEFECA7D-B11F-4E66-8BFF-1812C5A0864E}\{369F5C10-5BBC-43AD-99EB-D34E32F45AC4}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DEFECA7D-B11F-4E66-8BFF-1812C5A0864E}\{369F5C10-5BBC-43AD-99EB-D34E32F45AC4}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DF7F3DAC-CB76-4AFA-9FA1-FECCEC7E0FBB}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DF7F3DAC-CB76-4AFA-9FA1-FECCEC7E0FBB}\{470D323F-58CE-4630-862A-E35359088EF6}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DF7F3DAC-CB76-4AFA-9FA1-FECCEC7E0FBB}\{470D323F-58CE-4630-862A-E35359088EF6}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DF7F3DAC-CB76-4AFA-9FA1-FECCEC7E0FBB}\{FA4225AE-756D-4586-8B94-90C8322B3004}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{DF7F3DAC-CB76-4AFA-9FA1-FECCEC7E0FBB}\{FA4225AE-756D-4586-8B94-90C8322B3004}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{01C74BF5-8621-4BCC-8272-3E7191033449}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{01C74BF5-8621-4BCC-8272-3E7191033449}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{099DCA8A-666D-40D2-BAAC-C2DB2184E45F}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{099DCA8A-666D-40D2-BAAC-C2DB2184E45F}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{2CC50A95-0521-41F4-9CD5-34B39079C9F3}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{2CC50A95-0521-41F4-9CD5-34B39079C9F3}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{32ED782D-DCA9-424B-9EF4-D5BC735AED43}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{32ED782D-DCA9-424B-9EF4-D5BC735AED43}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{52C7BEB3-2667-46CF-8969-EC0EF27EED7A}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{52C7BEB3-2667-46CF-8969-EC0EF27EED7A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{57A11F15-9053-4F8A-9477-DFB5A383165C}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{57A11F15-9053-4F8A-9477-DFB5A383165C}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{59A89B86-61FE-426F-B8FE-A140E8104975}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{59A89B86-61FE-426F-B8FE-A140E8104975}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{8CE814A6-FE2E-42D1-B029-C2459A946B17}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{8CE814A6-FE2E-42D1-B029-C2459A946B17}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{93DEE7CF-2EB6-49ED-B4AC-1119BA5D074A}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{93DEE7CF-2EB6-49ED-B4AC-1119BA5D074A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{A004ADBB-EA9E-4F81-9054-2840E9AFB655}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{A004ADBB-EA9E-4F81-9054-2840E9AFB655}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{A0C73CD1-189E-4675-89BC-87AF2A87F9AF}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{A0C73CD1-189E-4675-89BC-87AF2A87F9AF}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{ACE3DB97-7958-460A-A691-64CBE0037B90}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{ACE3DB97-7958-460A-A691-64CBE0037B90}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{ADD8B52C-7E5C-448E-AF2F-EAAE5D9ABF0B}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{ADD8B52C-7E5C-448E-AF2F-EAAE5D9ABF0B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{CED3D6E0-2412-460B-9A68-3FB446E41993}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{CED3D6E0-2412-460B-9A68-3FB446E41993}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{D65FD61E-DC10-40A7-8FC4-41CB8D568F80}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{D65FD61E-DC10-40A7-8FC4-41CB8D568F80}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{D9878923-1DDE-474E-93A6-46CFB5CB4CA8}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{D9878923-1DDE-474E-93A6-46CFB5CB4CA8}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{E8900B09-9ECC-4783-B8B0-545024A395CC}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{E8900B09-9ECC-4783-B8B0-545024A395CC}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{EDCD74DA-91BE-443F-B92E-35F8A6414820}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E1FAD90F-A7A9-49A5-B426-480AC8E693F6}\{EDCD74DA-91BE-443F-B92E-35F8A6414820}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E23BA043-EEA6-41F6-ABA2-F2B113181D38}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E23BA043-EEA6-41F6-ABA2-F2B113181D38}\{1E3EC686-CD3A-4DA7-8A41-025D1673D97B}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E23BA043-EEA6-41F6-ABA2-F2B113181D38}\{1E3EC686-CD3A-4DA7-8A41-025D1673D97B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E23BA043-EEA6-41F6-ABA2-F2B113181D38}\{BDDD2B65-5EB9-446D-8D09-DB28C1D960D8}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E23BA043-EEA6-41F6-ABA2-F2B113181D38}\{BDDD2B65-5EB9-446D-8D09-DB28C1D960D8}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E8C67FE4-9033-4F2E-BD32-C47AE4ABA4CA}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E8C67FE4-9033-4F2E-BD32-C47AE4ABA4CA}\{9919D7D3-5862-4F57-8051-8AC306CCA2FC}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E8C67FE4-9033-4F2E-BD32-C47AE4ABA4CA}\{9919D7D3-5862-4F57-8051-8AC306CCA2FC}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{ECE5C35A-E081-45AC-9125-6F74DD5C72A5}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{ECE5C35A-E081-45AC-9125-6F74DD5C72A5}\{07EAEC1F-23D3-43B4-9B0D-953010ABE8C7}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{ECE5C35A-E081-45AC-9125-6F74DD5C72A5}\{07EAEC1F-23D3-43B4-9B0D-953010ABE8C7}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{ECE5C35A-E081-45AC-9125-6F74DD5C72A5}\{7DEEFB0F-BF1B-470E-B8B5-EA1B12BBF557}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{ECE5C35A-E081-45AC-9125-6F74DD5C72A5}\{7DEEFB0F-BF1B-470E-B8B5-EA1B12BBF557}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EEDED0F8-B7AA-4DBA-B438-213D617EB505}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EEDED0F8-B7AA-4DBA-B438-213D617EB505}\{E8CC5A00-D8FF-4018-9455-26CEC726D120}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EEDED0F8-B7AA-4DBA-B438-213D617EB505}\{E8CC5A00-D8FF-4018-9455-26CEC726D120}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EF8E7B7D-83BA-4511-A3C7-64A3F4C32681}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EF8E7B7D-83BA-4511-A3C7-64A3F4C32681}\{C330C8FA-2F13-4147-95A9-527EDE4D9FC6}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EF8E7B7D-83BA-4511-A3C7-64A3F4C32681}\{C330C8FA-2F13-4147-95A9-527EDE4D9FC6}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{0CB9A240-FBA2-4588-863E-BFB93AB9675F}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{0CB9A240-FBA2-4588-863E-BFB93AB9675F}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{2421EABA-E9F0-40EC-A04F-122F678FA3C1}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{2421EABA-E9F0-40EC-A04F-122F678FA3C1}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{2596F7F9-7184-4A17-A3A2-26E7A44FF749}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{2596F7F9-7184-4A17-A3A2-26E7A44FF749}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{33C52186-08B3-4157-A2F6-8660DD2D6868}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{33C52186-08B3-4157-A2F6-8660DD2D6868}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{5FBC5FF9-44CC-4BB7-AC6B-519886039DA7}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{5FBC5FF9-44CC-4BB7-AC6B-519886039DA7}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{600B2B91-0057-4328-9C8D-BB27AA1A2D95}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{600B2B91-0057-4328-9C8D-BB27AA1A2D95}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{757CD661-574A-46D0-A465-D6BFB8F43F35}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{757CD661-574A-46D0-A465-D6BFB8F43F35}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{7A3CAEBB-8502-43B7-92A7-0251302DDBEA}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{7A3CAEBB-8502-43B7-92A7-0251302DDBEA}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{827F06DB-4A0E-47FB-9C01-32618A7B01F0}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{827F06DB-4A0E-47FB-9C01-32618A7B01F0}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{9E415868-530A-4534-8A54-8D52AB4F4DB7}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{9E415868-530A-4534-8A54-8D52AB4F4DB7}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{CB932A5B-C6E5-4AA9-900A-1CB63C9A06BE}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{CB932A5B-C6E5-4AA9-900A-1CB63C9A06BE}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{DF02E359-F674-4B59-ABE7-5FA2DE8FE288}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{DF02E359-F674-4B59-ABE7-5FA2DE8FE288}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{E6743621-6542-44B6-B7FD-D7D14417F1EB}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{E6743621-6542-44B6-B7FD-D7D14417F1EB}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{ED64B910-9F73-4F28-B30E-51EF86FDBAF8}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{EFD3926A-0E74-4649-8EBA-3C6E6870BEE1}\{ED64B910-9F73-4F28-B30E-51EF86FDBAF8}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{F05C5E50-1084-4B28-A88E-35534A3C6733}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{F05C5E50-1084-4B28-A88E-35534A3C6733}\{03CD05EF-D905-4BAD-B155-13CEBC193ED0}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{F05C5E50-1084-4B28-A88E-35534A3C6733}\{03CD05EF-D905-4BAD-B155-13CEBC193ED0}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{F8542E36-4E90-4C03-8308-56B5D9D4B53F}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{F8542E36-4E90-4C03-8308-56B5D9D4B53F}\{A8BE1E4E-45B0-43A5-B1C1-25164E07A512}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{F8542E36-4E90-4C03-8308-56B5D9D4B53F}\{A8BE1E4E-45B0-43A5-B1C1-25164E07A512}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FA327AB6-C07F-4F1E-B6A3-17DBA619B4EF}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FA327AB6-C07F-4F1E-B6A3-17DBA619B4EF}\{77C7B04E-8793-4668-95F4-0A55F19FC3E9}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FA327AB6-C07F-4F1E-B6A3-17DBA619B4EF}\{77C7B04E-8793-4668-95F4-0A55F19FC3E9}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FA327AB6-C07F-4F1E-B6A3-17DBA619B4EF}\{97BCE7AA-4670-414C-B6AD-A2BBB56E530A}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FA327AB6-C07F-4F1E-B6A3-17DBA619B4EF}\{97BCE7AA-4670-414C-B6AD-A2BBB56E530A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FA405295-6B55-41F2-89E4-598C40217ADE}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FA405295-6B55-41F2-89E4-598C40217ADE}\{D4B55B8E-B0F6-49BB-958F-105CB1595E4C}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FA405295-6B55-41F2-89E4-598C40217ADE}\{D4B55B8E-B0F6-49BB-958F-105CB1595E4C}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FB64D545-6C5A-44D1-8DE1-9AF02801CC3B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FB64D545-6C5A-44D1-8DE1-9AF02801CC3B}\{341FF615-644C-427E-9387-6AC6E51684D3}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FB64D545-6C5A-44D1-8DE1-9AF02801CC3B}\{341FF615-644C-427E-9387-6AC6E51684D3}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FB64D545-6C5A-44D1-8DE1-9AF02801CC3B}\{A33C127A-A259-4A20-ABDB-A4957FEE9219}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FB64D545-6C5A-44D1-8DE1-9AF02801CC3B}\{A33C127A-A259-4A20-ABDB-A4957FEE9219}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FCF6B885-4248-4736-AC4B-71E813F9DD44}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FCF6B885-4248-4736-AC4B-71E813F9DD44}\{9B85A468-CDB2-4187-891C-891F1AB2DA47}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FCF6B885-4248-4736-AC4B-71E813F9DD44}\{9B85A468-CDB2-4187-891C-891F1AB2DA47}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE562A63-ECB2-46BB-AF48-367527835FBA}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE562A63-ECB2-46BB-AF48-367527835FBA}\{DB193A0A-4406-4A53-968B-A0E487D527D3}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE562A63-ECB2-46BB-AF48-367527835FBA}\{DB193A0A-4406-4A53-968B-A0E487D527D3}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\index.qbs
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBConfig.log
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDebug.log
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDetect.log
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBNotify.log
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBRefr.log
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg.log
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg2.log
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetDev.log
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetLoc.log
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetUsr.log
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBStHash.log
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBValid.log
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPPolicy.log
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStart.log
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStop.log
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtErEvt.log
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtMoEvt.log
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtNvEvt.log
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtScEvt.log
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SRTSPSE.DAT
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SRTSPSO.DAT
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SRTSPSP.DAT
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtTxFEvt.log
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtViEvt.log
C:\Documents and Settings\All Users\Application Data\Symantec\SubEng\{60EF1A59-5AA1-4451-A156-F90CA941E4BB}
C:\Documents and Settings\All Users\Application Data\Symantec\SubEng\{9FCFAC61-6019-4063-8D5C-80AF4508032E}
C:\Documents and Settings\All Users\Application Data\Symantec\SubEng\{C2CC2FEC-44BD-4E98-B174-61CB71C64B41}
C:\Documents and Settings\All Users\Application Data\Symantec\SubEng\SCD.xml
C:\Documents and Settings\All Users\Application Data\Symantec\SubEng\submissions.idx
C:\Documents and Settings\All Users\Application Data\Symantec\SyKnAppS\cohcol.grd
C:\Documents and Settings\All Users\Application Data\Symantec\SyKnAppS\cohcol.sig
C:\Documents and Settings\All Users\Application Data\Symantec\SyKnAppS\cohcol.wlt
C:\Documents and Settings\All Users\Application Data\Symantec\SyKnAppS\patch25.dll
C:\Documents and Settings\All Users\Application Data\Symantec\SyKnAppS\SyKnAppS.dll
C:\Documents and Settings\All Users\Application Data\Symantec\SyKnAppS\SyKnAppS.grd
C:\Documents and Settings\All Users\Application Data\Symantec\SyKnAppS\SyKnAppS.sig
C:\Documents and Settings\All Users\Application Data\Symantec\SyKnAppS\SyKnAppS.spm
C:\Documents and Settings\All Users\Application Data\Symantec\wcid0.log
C:\Documents and Settings\All Users\Application Data\Symantec\wds.dat
C:\Program Files\Enigma Software Group
C:\Program Files\Enigma Software Group\SpyHunter\AXList.txt
C:\Program Files\Enigma Software Group\SpyHunter\key.dat
C:\Program Files\Enigma Software Group\SpyHunter\scan.log
C:\Program Files\Enigma Software Group\SpyHunter\spyhunter.log
C:\Program Files\Enigma Software Group\SpyHunter\support.log
C:\Program Files\Norton AntiVirus
C:\Program Files\Norton AntiVirus\IWP\DefRules.dat
C:\Program Files\Norton Internet Security
C:\Program Files\Norton Internet Security\AlertRes.dll
C:\Program Files\Norton Internet Security\Ales.bin
C:\Program Files\Norton Internet Security\Branding.ini
C:\Program Files\Norton Internet Security\cfgwiz.dat
C:\Program Files\Norton Internet Security\CfgWzRes.dll
C:\Program Files\Norton Internet Security\CLTVault.dll
C:\Program Files\Norton Internet Security\comms.txt
C:\Program Files\Norton Internet Security\DefRules.xml
C:\Program Files\Norton Internet Security\EULA.txt
C:\Program Files\Norton Internet Security\fwAlert.dll
C:\Program Files\Norton Internet Security\fwAlRes.dll
C:\Program Files\Norton Internet Security\fwEvent.dll
C:\Program Files\Norton Internet Security\fwMCPlug.dll
C:\Program Files\Norton Internet Security\fwPlugin.dll
C:\Program Files\Norton Internet Security\IDSDefs\CATALOG.DAT
C:\Program Files\Norton Internet Security\IDSDefs\IDS9xx86.dll
C:\Program Files\Norton Internet Security\IDSDefs\IDSVia64.cat
C:\Program Files\Norton Internet Security\IDSDefs\IDSVia64.INF
C:\Program Files\Norton Internet Security\IDSDefs\IDSviA64.sys
C:\Program Files\Norton Internet Security\IDSDefs\IDSVix86.cat
C:\Program Files\Norton Internet Security\IDSDefs\IDSVix86.INF
C:\Program Files\Norton Internet Security\IDSDefs\IDSvix86.sys
C:\Program Files\Norton Internet Security\IDSDefs\IDSxpx86.dll
C:\Program Files\Norton Internet Security\IDSDefs\Metadata.dat
C:\Program Files\Norton Internet Security\IDSDefs\sigs.dat
C:\Program Files\Norton Internet Security\IDSDefs\SymIDSCo.sys
C:\Program Files\Norton Internet Security\IDSDefs\SymIDSCo.vxd
C:\Program Files\Norton Internet Security\IDSDefs\SymIDSI.dll
C:\Program Files\Norton Internet Security\IDSDefs\v.grd
C:\Program Files\Norton Internet Security\IDSDefs\v.sig
C:\Program Files\Norton Internet Security\IDSDefs\VIRSCAN1.DAT
C:\Program Files\Norton Internet Security\IDSDefs\zdone.dat
C:\Program Files\Norton Internet Security\IDSUI.dll
C:\Program Files\Norton Internet Security\IMCfg.dll
C:\Program Files\Norton Internet Security\isAbout.dll
C:\Program Files\Norton Internet Security\isBTPlg.dll
C:\Program Files\Norton Internet Security\ISBTPlgS.dll
C:\Program Files\Norton Internet Security\ISDataCl.dll
C:\Program Files\Norton Internet Security\ISDataSv.dll
C:\Program Files\Norton Internet Security\isError.dll
C:\Program Files\Norton Internet Security\isError.loc
C:\Program Files\Norton Internet Security\ISLAlert.dll
C:\Program Files\Norton Internet Security\ISPrdCtl.dll
C:\Program Files\Norton Internet Security\isPwd.dll
C:\Program Files\Norton Internet Security\isPwdSvc.exe
C:\Program Files\Norton Internet Security\isRes.dll
C:\Program Files\Norton Internet Security\isStatus.dll
C:\Program Files\Norton Internet Security\isStatus.loc
C:\Program Files\Norton Internet Security\ISSvc.dll
C:\Program Files\Norton Internet Security\isUAC.exe
C:\Program Files\Norton Internet Security\MCPlgRes.dll
C:\Program Files\Norton Internet Security\NisCfgWz.dll
C:\Program Files\Norton Internet Security\NISLUCBK.DLL
C:\Program Files\Norton Internet Security\NisLVPlg.dll
C:\Program Files\Norton Internet Security\NISOpRes.dll
C:\Program Files\Norton Internet Security\nisoptui.dll
C:\Program Files\Norton Internet Security\nisoptui.exe
C:\Program Files\Norton Internet Security\NISProd.dll
C:\Program Files\Norton Internet Security\nisres.dll
C:\Program Files\Norton Internet Security\NisTray.dll
C:\Program Files\Norton Internet Security\NISTrRes.dll
C:\Program Files\Norton Internet Security\NISVER.dat
C:\Program Files\Norton Internet Security\Norton AntiVirus\AVApp.log
C:\Program Files\Norton Internet Security\Norton AntiVirus\AVError.log
C:\Program Files\Norton Internet Security\Norton AntiVirus\AVPAPP32.dll
C:\Program Files\Norton Internet Security\Norton AntiVirus\AVPAPP32.loc
C:\Program Files\Norton Internet Security\Norton AntiVirus\AVPSVC32.dll
C:\Program Files\Norton Internet Security\Norton AntiVirus\AVPSVC32.loc
C:\Program Files\Norton Internet Security\Norton AntiVirus\avScanUI.dll
C:\Program Files\Norton Internet Security\Norton AntiVirus\avScanUI.loc
C:\Program Files\Norton Internet Security\Norton AntiVirus\avScnTsk.dll
C:\Program Files\Norton Internet Security\Norton AntiVirus\avScnTsk.loc
C:\Program Files\Norton Internet Security\Norton AntiVirus\AVSubmit.dll
C:\Program Files\Norton Internet Security\Norton AntiVirus\AVSubmit.loc
C:\Program Files\Norton Internet Security\Norton AntiVirus\AVVirus.log
C:\Program Files\Norton Internet Security\Norton AntiVirus\CfgWiz.dat
C:\Program Files\Norton Internet Security\Norton AntiVirus\CfgWzRes.dll
C:\Program Files\Norton Internet Security\Norton AntiVirus\DefAlert.dll
C:\Program Files\Norton Internet Security\Norton AntiVirus\DefAlert.loc
C:\Program Files\Norton Internet Security\Norton AntiVirus\EULA.txt
C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVCfgWz.dll
C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVError.dll
C:\Program Files\Norton Internet Security\Norton AntiVirus\NavError.loc
C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVEvent.dll
C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVLogV.dll
C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVLogV.loc
C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVLUCBK.dll
C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVLUCbk.loc
C:\Program Files\Norton Internet Security\Norton AntiVirus\navopts.dat
C:\Program Files\Norton Internet Security\Norton AntiVirus\navopts.def
C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVOpts.dll
C:\Program Files\Norton Internet Security\Norton AntiVirus\NavOpts.loc
C:\Program Files\Norton Internet Security\Norton AntiVirus\navprod.dll
C:\Program Files\Norton Internet Security\Norton AntiVirus\NavProd.loc
C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShcom.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShcPS.dll
C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVShExt.loc
C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVStub.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\NavStub.loc
C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVTskWz.dll
C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVTskWz.loc
C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVUIHTM.dll
C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.loc
C:\Program Files\Norton Internet Security\Norton AntiVirus\Navwnt.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\OEHeur.dll
C:\Program Files\Norton Internet Security\Norton AntiVirus\OfficeAV.dll
C:\Program Files\Norton Internet Security\Norton AntiVirus\patch25d.dll
C:\Program Files\Norton Internet Security\Norton AntiVirus\PtchInst.dll
C:\Program Files\Norton Internet Security\Norton AntiVirus\rcOffcAV.dll
C:\Program Files\Norton Internet Security\Norton AntiVirus\README.TXT
C:\Program Files\Norton Internet Security\Norton AntiVirus\scancfg.dat
C:\Program Files\Norton Internet Security\Norton AntiVirus\VERSION.DAT
C:\Program Files\Norton Internet Security\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\ActComp.Loc
C:\Program Files\Norton Internet Security\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\CfgWiz.loc
C:\Program Files\Norton Internet Security\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\CLTSComp.loc
C:\Program Files\Norton Internet Security\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\CUWShr.Loc
C:\Program Files\Norton Internet Security\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\CUWUtils.Loc
C:\Program Files\Norton Internet Security\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\EULAComp.Loc
C:\Program Files\Norton Internet Security\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\ewoc.loc
C:\Program Files\Norton Internet Security\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\LicPlug.loc
C:\Program Files\Norton Internet Security\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\ProdKey.htm
C:\Program Files\Norton Internet Security\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\SubComp.Loc
C:\Program Files\Norton Internet Security\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\SubStats.loc
C:\Program Files\Norton Internet Security\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\SymCUW.loc
C:\Program Files\Norton Internet Security\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\SymSubWz.loc
C:\Program Files\Norton Internet Security\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\SymUIRes.loc
C:\Program Files\Norton Internet Security\osCheck.exe
C:\Program Files\Norton Internet Security\osCheck.loc
C:\Program Files\Norton Internet Security\PgmCtl.dll
C:\Program Files\Norton Internet Security\PtchInst.dll
C:\Program Files\Norton Internet Security\readme.txt
C:\Program Files\Norton Internet Security\RuleUI.dll
C:\Program Files\Norton Internet Security\SetEvtHp.dll
C:\Program Files\Norton Internet Security\SNLog.dll
C:\Program Files\Norton Internet Security\SNRes.dll
C:\Program Files\Norton Internet Security\VAUI.dll
C:\Program Files\Norton Internet Security\VAUIOpt.dll
C:\Program Files\Norton Internet Security\VAUIRes.dll
C:\Program Files\Symantec
C:\Program Files\Symantec\LiveUpdate\ALUNOTIFYRES.DLL
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvcRes.dll
C:\Program Files\Symantec\LiveUpdate\AUPDATERES.DLL
C:\Program Files\Symantec\LiveUpdate\coh.cache
C:\Program Files\Symantec\LiveUpdate\LUALLRES.DLL
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LUCheck.exe
C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE
C:\Program Files\Symantec\LiveUpdate\LuConfig.EXE
C:\Program Files\Symantec\LiveUpdate\LuInsRes.dll
C:\Program Files\Symantec\LiveUpdate\MFC71.DLL
C:\Program Files\Symantec\LiveUpdate\MSVCP71.DLL
C:\Program Files\Symantec\LiveUpdate\MSVCR71.DLL
C:\Program Files\Symantec\LiveUpdate\NetDetectController_3_2.DLL
C:\Program Files\Symantec\LiveUpdate\NotifyHA.exe
C:\Program Files\Symantec\LiveUpdate\ProductRegCom_3_2.DLL
C:\Program Files\Symantec\LiveUpdate\PSLuComServer_3_2.DLL
C:\Program Files\Symantec\LiveUpdate\ResLuComServer_3_2.DLL
C:\Program Files\Symantec\LiveUpdate\S32LUCP1RES.DLL
C:\Program Files\Symantec\LiveUpdate\S32LUCP2.CPL
C:\Program Files\Symantec\LiveUpdate\SETUPRES.DLL
C:\Program Files\Symantec\LiveUpdate\SymantecRootInstallerRes.dll
C:\Program Files\Symantec\LiveUpdate\UNRAR.DLL
C:\WINDOWS\BMaf8893fe.xml
C:\WINDOWS\imsins.BAK
C:\WINDOWS\system32\5076
C:\WINDOWS\system32\5076\~!16147p.spt
C:\WINDOWS\system32\6026c
C:\WINDOWS\system32\a053
C:\WINDOWS\system32\Dev3
C:\WINDOWS\system32\fIE
C:\WINDOWS\system32\g3.exe
C:\WINDOWS\system32\sTMP
C:\WINDOWS\system32\Vco1
C:\WINDOWS\system32\ZoneAlarmIconUS.ico\
C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Owner.job

.
((((((((((((((((((((((((( Files Created from 2008-05-18 to 2008-06-18 )))))))))))))))))))))))))))))))
.

2008-06-17 12:38 . 2008-06-17 12:38 <DIR> d-------- C:\WINDOWS\ERUNT
2008-06-16 21:50 . 2008-06-16 21:50 118 --a------ C:\WINDOWS\system32\MRT.INI
2008-06-16 20:58 . 2008-04-14 06:01 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-09 03:47 . 2008-06-09 03:47 <DIR> d-------- C:\Deckard
2008-06-09 03:33 . 2008-06-09 03:33 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-06-09 02:29 . 2008-06-09 02:29 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2008-06-09 02:29 . 2008-06-09 02:29 1,152 --a------ C:\WINDOWS\system32\windrv.sys
2008-06-09 01:31 . 2004-05-12 06:29 <DIR> d-------- C:\Documents and Settings\Administrator\WINDOWS
2008-06-09 01:31 . 2004-05-12 07:05 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SampleView
2008-06-09 01:31 . 2008-06-09 01:31 <DIR> d-------- C:\Documents and Settings\Administrator
2008-06-09 01:22 . 2008-06-08 21:55 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-06-09 00:58 . 2008-06-17 18:34 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-06-09 00:58 . 2007-12-10 13:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-06-09 00:58 . 2007-12-10 13:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-06-09 00:58 . 2008-02-01 11:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-06-09 00:58 . 2007-12-10 13:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-06-08 23:54 . 2008-06-08 21:55 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-06-08 21:56 . 2008-06-08 21:55 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-06-08 21:56 . 2008-06-08 21:55 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-06-08 21:56 . 2008-06-08 21:55 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-06-08 21:56 . 2008-06-08 21:55 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-06-08 21:56 . 2008-06-08 21:55 82,944 --a------ C:\WINDOWS\system32\404Fix.exe
2008-06-08 21:56 . 2008-06-08 21:55 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-06-08 21:56 . 2008-06-09 01:38 880 --a------ C:\WINDOWS\system32\tmp.reg
2008-06-08 21:31 . 2008-06-17 19:35 6,562 --a------ C:\WINDOWS\system32\Config.MPF
2008-06-08 21:22 . 2008-06-08 21:22 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\SiteAdvisor
2008-06-08 21:21 . 2008-06-08 21:33 <DIR> d-------- C:\Program Files\SiteAdvisor
2008-06-08 21:21 . 2008-06-17 15:27 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\SiteAdvisor
2008-06-08 21:21 . 2008-06-08 21:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-06-08 21:19 . 2006-03-03 08:07 143,360 --a------ C:\WINDOWS\system32\dunzip32.dll
2008-06-08 21:17 . 2007-11-22 06:44 201,320 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
2008-06-08 21:17 . 2007-11-22 06:44 79,304 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
2008-06-08 21:17 . 2007-12-02 12:51 40,488 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys
2008-06-08 21:17 . 2007-11-22 06:44 35,240 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
2008-06-08 21:17 . 2007-11-22 06:44 33,832 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys
2008-06-08 21:16 . 2007-07-13 06:20 113,952 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys
2008-06-08 21:15 . 2008-06-08 21:15 <DIR> d-------- C:\Program Files\McAfee.com
2008-06-08 21:15 . 2008-06-09 01:06 <DIR> d-------- C:\Program Files\Common Files\McAfee
2008-06-08 21:14 . 2008-06-09 01:42 <DIR> d-------- C:\Program Files\McAfee
2008-06-08 21:08 . 2008-06-08 21:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2008-06-04 11:47 . 2008-06-04 11:47 9,662 --a------ C:\WINDOWS\system32\ZoneAlarmIconUS.ico

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-18 00:34 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-17 21:04 --------- d-----w C:\Program Files\World of Warcraft
2008-06-05 14:11 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-04-11 02:27 3,884 ----a-w C:\WINDOWS\viassary-hp.reg
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-01-13 16:12 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2006-06-12 06:17 0 ----a-w C:\Documents and Settings\Owner\ignorelist.dat
.

((((((((((((((((((((((((((((( snapshot@2008-06-17_14.21.31.71 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-17 19:17:55 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-18 00:33:56 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2008-06-17 17:15:24 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-06-17 22:57:15 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-06-17 17:15:24 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-06-17 22:57:15 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-06-17 17:15:24 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-17 22:57:15 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6145\SiteAdv.exe" [2007-06-21 15:06 36640]
"McENUI"="C:\PROGRA~1\McAfee\MHN\McENUI.exe" [2007-11-30 05:42 1164576]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-11-01 19:12 582992]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2008-04-10 15:14 1107848]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2004-05-12 06:26 98304]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

R3 Alpham;Ideazon Merc Composite Keyboard Driver;C:\WINDOWS\system32\DRIVERS\Alpham.sys [2005-12-04 13:55]

.
Contents of the 'Scheduled Tasks' folder
"2008-06-09 02:16:12 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe'
"2008-06-09 02:16:11 C:\WINDOWS\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-17 19:34:56
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwClose

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\SiteAdvisor\6145\saHook.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\gearsec.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe
C:\Program Files\McAfee\MPF\MpfSrv.exe
C:\Program Files\McAfee\MSK\msksrver.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\SiteAdvisor\6145\SAService.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\PROGRA~1\McAfee\MSC\mcuimgr.exe
.
**************************************************************************
.
Completion time: 2008-06-17 19:38:59 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-18 00:38:50
ComboFix2.txt 2008-06-17 19:22:12

Pre-Run: 115,717,582,848 bytes free
Post-Run: 115,712,954,368 bytes free

1397 --- E O F --- 2008-06-17 02:51:20

Robbyj717 · 06-17-2008, 09:46 PM

Kaspersky:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Tuesday, June 17, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Wednesday, June 18, 2008 01:46:41
Records in database: 877463
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\

Scan statistics:
Files scanned: 79820
Threat name: 8
Infected objects: 13
Suspicious objects: 0
Duration of the scan: 02:08:22

File name / Threat name / Threats count
C:\Deckard\System Scanner\20080609040703\backup\WINDOWS\temp\Temporary Internet Files\Content.IE5\09GG2KZS\install_en[1].exe Infected: not-a-virus:Downloader.Win32.WinFixer.au 1
C:\Documents and Settings\Owner\.housecall6.6\Quarantine\omfg.class-14fdec45-4f709e9b.class.bac_a02800 Infected: Trojan-Downloader.Java.OpenStream.y 1
C:\Documents and Settings\Owner\.housecall6.6\Quarantine\omfg.class-c973141-40aacea9.class.bac_a02800 Infected: Trojan-Downloader.Java.OpenStream.y 1
C:\Documents and Settings\Owner\Desktop\SmitfraudFix\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
C:\Documents and Settings\Owner\Desktop\SmitfraudFix.zip Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
C:\Program Files\Common Files\Real\Toolbar\RealBar.dll Infected: not-a-virus:AdWare.Win32.MegaSearch.s 1
C:\QooBox\Quarantine\C\WINDOWS\lfn.exe.vir Infected: not-virus:Hoax.Win32.Renos.ctv 1
C:\QooBox\Quarantine\C\WINDOWS\system32\cxvhxoks.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\g3.exe.vir Infected: not-a-virus:AdWare.Win32.Agent.byy 1
C:\QooBox\Quarantine\C\WINDOWS\system32\lopopuju.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\nvfweblw.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\tvuuioqx.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\catchme2008-06-17_141840.21.zip Infected: Rootkit.Win32.Agent.aol 1

The selected area was scanned.

Robbyj717 · 06-17-2008, 09:47 PM

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:37:28 PM, on 6/17/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\SiteAdvisor\6145\SiteAdv.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\gearsec.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\SiteAdvisor\6145\SAService.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Documents and Settings\Owner\Desktop\HiJackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6145\SiteAdv.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6145\SiteAdv.dll
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6145\SiteAdv.exe
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...p=ZRxdm678NTUS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...tup1.0.1.0.cab
O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h20264.www2.hp.com/ediags/dd/...osticsxp2k.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1207881416890
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://ak.imgag.com/imgag/cp/install/Crusher.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://plugin.driveragent.com/files/driveragent.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6145\SAService.exe

--
End of file - 6643 bytes

**TheBruce1** · 06-18-2008, 06:42 AM

Hi Robby

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)

O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...p=ZRxdm678NTUS
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...tup1.0.1.0.cab

Please remember to close all other windows, including browsers then click Fix checked.

========

Delete the following Files indicated in RED and Folders indicated in BLUE

C:\Documents and Settings\Owner\.housecall6.6
C:\WINDOWS\system32\ZoneAlarmIconUS.ico

========

Delete SmitFraudFix and SDFix from your desktop, also delete these folders C:\Smitfraudfix and C:\SDFix.

You can keep ATF-Cleaner if you wish.

=========

Well done,your logs are clean.

Click start>run>type(or copy/paste command into run box):

ComboFix /u

Click ok.

=======

Clear IE7 cookies

*On the Internet Explorer 7 Tools menu, click Internet Options. The Internet Options box should open to the General tab.
*On the General tab, in the Browsing History, click the Delete button. This will delete all the files that are currently stored in your cache [that includes cookies too].
*Click OK, and then click OK again.

Clear Firefox cookies/cache

• Select "Tools"
• Select "Options".
• Select "Privacy".
• In "Settings" window put the check mark for Cookies,Cache,Browsing history and any others you want.
• Click OK.
• In Private area click "Clear Now".

-------------------------------------------------------------------------------------------

MICROSOFT UPDATES

1.Click Start,Run, type sysdm.cpl, and then press OK.
2.Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended).

Microsoft updates are released every second Tuesday of each month,what is called "Patch Tuesday".

------------------------------------------------------------------------------------------

Useful Information and Programs to keep you safe.

TrendProtect is a FREE browser plug-in that helps you avoid Web pages with unwanted content and hidden threats. TrendProtect rates the current page and pages listed in Google, MSN, and Yahoo search results. You can use the rating to decide if you want to visit or avoid a given Web page. To rate Web pages, TrendProtect refers to an extensive database that covers the following information for billions of Web pages:

* Content category
* Phishing scam detection
* Site reputation
* Page reputation

WOT Free helps you avoid disingenuous Internet content by allowing you to learn from others' experiences. WOT shows you website reputations on your browser, telling you how much other users trust a website. This helps you make better decisions while browsing and avoid phishing, malware, and other types of fraud. Reputations can also be added to web search results, Gmail, Wikipedia, and other selected sites.

WOT reputations are computed mainly from user testimonies. Sharing your knowledge with others is just a click away, without ever having to leave the site. We also collect data from hundreds of other sources (including PhishTank) to quickly warn you of emerging threats. Currently, WOT knows over 12 million websites.
Note:Only compatible with Firefox 1.5 and higher.

--------------------------------------------------------------------------------------

Alternate Browsers
Try the following free alternate browsers rather than Internet Explorer
Avant
Firefox
Opera
K-Meleon

------------------------------------------------------------------------------------------

Free Antispyware Products
SuperAntiSpyware
Ad-Aware
Spybot S&D
Download SpywareBlaster 3.5.1 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items.
Download Spyware Guard to catch and block spyware before it can execute.

------------------------------------------------------------------

IE-Spyad™ is a freeware utility that places more than 4000 dubious websites and domains in the Internet Explorer Restricted List.

Download and installation instructions for IE-Spyad™ Here

-----------------------------------------

The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file.

If your having trouble downloading & extracting,see link below for guidance:
http://www.mvps.org/winhelp2002/hosts2.htm

Once you have extracted the host file,double click on it and a new window will open.

Double-click on mvps.batand follow the prompts

---------------------------------------------------------------

Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here:
Using Winpatrol to protect your computer.

----------------------------------------

SnoopFree is a programme that informs you when another programme is wanting to log your keystrokes or read your screen.Only for XP users.

Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released.

==============================================

Also, please take a look at these well written articles:

PC Safety and Security--What Do I Need?

HOW DID I GET INFECTED IN THE FIRST PLACE? by Tony Klein
THE ANTI-SPYWARE TUTORIAL
MAKING INTERNET EXPLORER SAFER
Understanding and Using Firewalls

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Please reply to this thread once more, as we may mark this as resolved, thanks.

Robbyj717 · 06-18-2008, 07:49 AM

You guys are awesome. Thanks for all the help, I really appreciate it. Keep up the good work.

06-09-2008, 03:10 AM	#1 (permalink)
Robbyj717 Registered User Join Date: Jan 2008 Posts: 20 OS: windows xp	Suspected malware Hey, how's it going. I have a malware problem and apparently the problem is way over my head. I get constant warnings on my toolbar and it directs me to anti-spyware sites. Also, it locks my task manager and changes my desktop background to a warning that says "Warning: Spyware threat has beeen detected on your PC" (and yes, been is spelled wrong, not a typo) that has a link to an anti-spyware site. I use McAfee and I have run several spyware programs with no luck. Anyway, any help you could provide would be very much appreciated. Thanks, here's the log: Deckard's System Scanner v20071014.68 Run by Owner on 2008-06-09 04:07:16 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-06-09 04:07:47 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\iftuyszv.exe C:\WINDOWS\explorer.exe C:\Program Files\SiteAdvisor\6145\SiteAdv.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\gearsec.exe C:\Program Files\McAfee\MSC\mcmscsvc.exe C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe C:\Program Files\Common Files\McAfee\McProxy\McProxy.exe C:\Program Files\McAfee\VirusScan\Mcshield.exe C:\Program Files\McAfee\MPF\MpfSrv.exe C:\Program Files\McAfee\MSK\msksrver.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\Program Files\SiteAdvisor\6145\SAService.exe C:\WINDOWS\system32\alg.exe C:\Program Files\McAfee\VirusScan\mcsysmon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Owner\Desktop\dss.exe C:\Program Files\Internet Explorer\iexplore.exe R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsoft.com/access/autosearch.asp?p=%s R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft.com/isapi/redir...ie&ar=iesearch F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\iftuyszv.exe, O2 - BHO: (no name) - {00110011-4b0b-44d5-9718-90c88817369b} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {086ae192-23a6-48d6-96ec-715f53797e85} - (no file) O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6145\SiteAdv.dll O2 - BHO: (no name) - {150fa160-130d-451f-b863-b655061432ba} - (no file) O2 - BHO: (no name) - {17da0c9e-4a27-4ac5-bb75-5d24b8cdb972} - (no file) O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb1} - (no file) O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb2} - (no file) O2 - BHO: (no name) - {2d38a51a-23c9-48a1-a33c-48675aa2b494} - (no file) O2 - BHO: (no name) - {2e9caff6-30c7-4208-8807-e79d4ec6f806} - (no file) O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - C:\Program Files\McAfee\MSK\mcapbho.dll O2 - BHO: (no name) - {467faeb2-5f5b-4c81-bae0-2a4752ca7f4e} - (no file) O2 - BHO: (no name) - {5321e378-ffad-4999-8c62-03ca8155f0b3} - (no file) O2 - BHO: (no name) - {587dbf2d-9145-4c9e-92c2-1f953da73773} - (no file) O2 - BHO: (no name) - {6cc1c91a-ae8b-4373-a5b4-28ba1851e39a} - (no file) O2 - BHO: (no name) - {79369d5c-2903-4b7a-ade2-d5e0dee14d24} - (no file) O2 - BHO: (no name) - {799a370d-5993-4887-9df7-0a4756a77d00} - (no file) O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll O2 - BHO: (no name) - {98dbbf16-ca43-4c33-be80-99e6694468a4} - (no file) O2 - BHO: (no name) - {a55581dc-2cdb-4089-8878-71a080b22342} - (no file) O2 - BHO: (no name) - {b847676d-72ac-4393-bfff-43a1eb979352} - (no file) O2 - BHO: (no name) - {bc97b254-b2b9-4d40-971d-78e0978f5f26} - (no file) O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765721306} - (no file) O2 - BHO: (no name) - {e2ddf680-9905-4dee-8c64-0a5de7fe133c} - (no file) O2 - BHO: (no name) - {e3eebbe8-9cab-4c76-b26a-747e25ebb4c6} - (no file) O2 - BHO: (no name) - {e7afff2a-1b57-49c7-bf6b-e5123394c970} - (no file) O2 - BHO: (no name) - {F632550A-A855-4203-983A-0C2362C98401} - C:\WINDOWS\system32\qoMeBqRK.dll (file missing) O2 - BHO: (no name) - {fcaddc14-bd46-408a-9842-cdbe1c6d37eb} - (no file) O2 - BHO: (no name) - {fd9bc004-8331-4457-b830-4759ff704c22} - (no file) O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file) O2 - BHO: (no name) - {ff1bf4c7-4e08-4a28-a43f-9d60a9f7a880} - (no file) O3 - Toolbar: (no name) - - (no file) O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6145\SiteAdv.dll O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6145\SiteAdv.exe O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKLM\..\Run: [BMaf8893fe] Rundll32.exe "C:\WINDOWS\system32\cxvhxoks.dll",s O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableTaskMgr=1 O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableTaskMgr=1 O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...p=ZRxdm678NTUS O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} () - http://ak.exe.imgfarm.com/images/noc...tup1.0.1.0.cab O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h20264.www2.hp.com/ediags/dd/...osticsxp2k.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1207881416890 O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://ak.imgag.com/imgag/cp/install/Crusher.cab O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://plugin.driveragent.com/files/driveragent.cab O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6145\SiteAdv.dll O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\system32\gearsec.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McProxy\McProxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\Mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MpfSrv.exe O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\msksrver.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6145\SAService.exe -- End of file - 9199 bytes -- Files created between 2008-05-09 and 2008-06-09 ----------------------------- 2008-06-09 03:33:14 0 d-------- C:\Program Files\SpywareBlaster 2008-06-09 03:27:15 23040 --a------ C:\WINDOWS\window.exe 2008-06-09 03:27:15 26880 --a------ C:\WINDOWS\svchost32.exe 2008-06-09 03:27:15 21504 --a------ C:\WINDOWS\quicken.exe 2008-06-09 03:27:14 11264 --a------ C:\WINDOWS\notepad32.exe 2008-06-09 03:27:14 16128 --a------ C:\WINDOWS\msupdate.exe 2008-06-09 03:27:14 26112 --a------ C:\WINDOWS\mssys.exe 2008-06-09 03:27:14 14080 --a------ C:\WINDOWS\msconfd.dll 2008-06-09 03:27:14 19968 --a------ C:\WINDOWS\internet.exe 2008-06-09 03:27:14 15616 --a------ C:\WINDOWS\iexplorer.exe 2008-06-09 03:27:13 15616 --a------ C:\WINDOWS\iedll.exe 2008-06-09 03:27:13 9984 --a------ C:\WINDOWS\editpad.exe 2008-06-09 02:29:42 1152 --a------ C:\WINDOWS\system32\windrv.sys 2008-06-09 02:29:27 0 d-------- C:\Program Files\Common Files\Download Manager 2008-06-09 01:49:40 0 d-------- C:\Program Files\Enigma Software Group 2008-06-09 01:38:18 9472 --a------ C:\WINDOWS\systemcritical.exe 2008-06-09 01:31:46 0 dr------- C:\Documents and Settings\Administrator\Favorites 2008-06-09 01:31:46 0 d-------- C:\Documents and Settings\Administrator\Desktop 2008-06-09 01:31:46 0 d--hs---- C:\Documents and Settings\Administrator\Cookies 2008-06-09 01:31:46 0 dr-h----- C:\Documents and Settings\Administrator\Application Data 2008-06-09 01:31:46 0 d-------- C:\Documents and Settings\Administrator\Application Data\Symantec 2008-06-09 01:31:46 0 d-------- C:\Documents and Settings\Administrator\Application Data\Sun 2008-06-09 01:31:46 0 d-------- C:\Documents and Settings\Administrator\Application Data\SampleView 2008-06-09 01:31:46 0 d-------- C:\Documents and Settings\Administrator\Application Data\Real 2008-06-09 01:31:46 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft 2008-06-09 01:31:46 0 d-------- C:\Documents and Settings\Administrator\Application Data\Identities 2008-06-09 01:31:45 0 d-------- C:\Documents and Settings\Administrator\WINDOWS 2008-06-09 01:31:45 0 d--h----- C:\Documents and Settings\Administrator\Templates 2008-06-09 01:31:45 0 dr------- C:\Documents and Settings\Administrator\Start Menu 2008-06-09 01:31:45 0 dr-h----- C:\Documents and Settings\Administrator\SendTo 2008-06-09 01:31:45 0 dr-h----- C:\Documents and Settings\Administrator\Recent 2008-06-09 01:31:45 0 d--h----- C:\Documents and Settings\Administrator\PrintHood 2008-06-09 01:31:45 0 d--h----- C:\Documents and Settings\Administrator\NetHood 2008-06-09 01:31:45 0 dr------- C:\Documents and Settings\Administrator\My Documents 2008-06-09 01:31:45 0 d--h----- C:\Documents and Settings\Administrator\Local Settings 2008-06-09 01:31:44 1048576 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT 2008-06-09 01:26:25 21504 --a------ C:\WINDOWS\y.exe 2008-06-09 01:26:24 18944 --a------ C:\WINDOWS\xplugin.dll 2008-06-09 01:26:24 22016 --a------ C:\WINDOWS\x.exe 2008-06-09 01:26:24 23296 --a------ C:\WINDOWS\winmgnt.exe 2008-06-09 01:26:23 20992 --a------ C:\WINDOWS\winajbm.dll 2008-06-09 01:26:23 12032 --a------ C:\WINDOWS\win64.exe 2008-06-09 01:26:23 19968 --a------ C:\WINDOWS\win32e.exe 2008-06-09 01:26:22 28160 --a------ C:\WINDOWS\waol.exe 2008-06-09 01:26:22 19712 --a------ C:\WINDOWS\users32.exe 2008-06-09 01:26:22 9728 --a------ C:\WINDOWS\time.exe 2008-06-09 01:26:21 18176 --a------ C:\WINDOWS\systeem.exe 2008-06-09 01:26:21 24320 --a------ C:\WINDOWS\olehelp.exe 2008-06-09 01:26:20 18944 --a------ C:\WINDOWS\mtwirl32.dll 2008-06-09 01:26:20 13568 --a------ C:\WINDOWS\loader.exe 2008-06-09 01:26:20 18176 --a------ C:\WINDOWS\cpan.dll 2008-06-09 01:26:20 20480 --a------ C:\WINDOWS\clrssn.exe 2008-06-09 01:26:20 23808 --a------ C:\WINDOWS\avpcc.dll 2008-06-09 01:26:19 26112 --a------ C:\WINDOWS\accesss.exe 2008-06-09 01:22:39 25600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-06-09 01:08:13 22272 --a------ C:\WINDOWS\rundll16.exe 2008-06-09 00:58:42 0 d-------- C:\Program Files\Spyware Doctor 2008-06-08 23:54:48 53248 --a------ C:\WINDOWS\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility> 2008-06-08 21:56:54 880 --a------ C:\WINDOWS\system32\tmp.reg 2008-06-08 21:56:06 82944 --a------ C:\WINDOWS\system32\404Fix.exe <Not Verified; S!Ri.URZ; IEDFix> 2008-06-08 21:56:05 289144 --a------ C:\WINDOWS\system32\VCCLSID.exe <Not Verified; S!Ri; > 2008-06-08 21:56:05 86528 --a------ C:\WINDOWS\system32\VACFix.exe <Not Verified; S!Ri.URZ; VACFix> 2008-06-08 21:56:05 82944 --a------ C:\WINDOWS\system32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix> 2008-06-08 21:56:04 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS> 2008-06-08 21:56:04 51200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-06-08 21:22:09 0 d-------- C:\Documents and Settings\LocalService\Application Data\SiteAdvisor 2008-06-08 21:21:51 0 d-------- C:\Program Files\SiteAdvisor 2008-06-08 21:21:51 0 d-------- C:\Documents and Settings\Owner\Application Data\SiteAdvisor 2008-06-08 21:21:51 0 d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor 2008-06-08 21:19:37 143360 --a------ C:\WINDOWS\system32\dunzip32.dll <Not Verified; Inner Media, Inc.; DynaZIP-32 Multi-Threading UnZIP DLL> 2008-06-08 21:15:21 0 d-------- C:\Program Files\McAfee.com 2008-06-08 21:15:05 0 d-------- C:\Program Files\Common Files\McAfee 2008-06-08 21:14:55 0 d-------- C:\Program Files\McAfee 2008-06-08 21:08:58 0 d-------- C:\Documents and Settings\All Users\Application Data\McAfee 2008-06-08 21:08:48 100864 --a------ C:\WINDOWS\system32\cxvhxoks.dll 2008-06-08 21:08:00 0 d-------- C:\WINDOWS\system32\5076 2008-06-08 21:07:55 55808 --a------ C:\WINDOWS\portsv.exe 2008-06-05 09:00:27 0 dr-h----- C:\Documents and Settings\Owner\Recent 2008-06-04 21:21:15 116224 --a------ C:\WINDOWS\system32\tvuuioqx.dll 2008-06-04 21:20:21 0 d-------- C:\Program Files\?icrosoft 2008-06-04 21:15:15 131584 --a------ C:\WINDOWS\system32\lopopuju.dll 2008-06-04 21:13:07 125952 --a------ C:\WINDOWS\system32\nvfweblw.dll 2008-06-04 16:11:21 22528 --a------ C:\WINDOWS\svcinit.exe 2008-06-04 16:11:21 13056 --a------ C:\WINDOWS\sistem.exe 2008-06-04 16:11:20 20480 --a------ C:\WINDOWS\searchword.dll 2008-06-04 16:11:20 12288 --a------ C:\WINDOWS\qttasks.exe 2008-06-04 16:11:19 30208 --a------ C:\WINDOWS\mswsc20.dll 2008-06-04 16:11:19 24064 --a------ C:\WINDOWS\mswsc10.dll 2008-06-04 16:11:18 11008 --a------ C:\WINDOWS\msspi.dll 2008-06-04 16:11:18 15872 --a------ C:\WINDOWS\inetinf.exe 2008-06-04 16:11:18 9472 --a------ C:\WINDOWS\helpcvs.exe 2008-06-04 16:11:17 20992 --a------ C:\WINDOWS\gfmnaaa.dll 2008-06-04 16:11:17 21504 --a------ C:\WINDOWS\funny.exe 2008-06-04 16:11:17 21504 --a------ C:\WINDOWS\funniest.exe 2008-06-04 16:11:17 26368 --a------ C:\WINDOWS\explorer32.exe 2008-06-04 16:11:17 11520 --a------ C:\WINDOWS\explore.exe 2008-06-04 16:11:16 32256 --a------ C:\WINDOWS\dnsrelay.dll 2008-06-04 16:11:16 10752 --a------ C:\WINDOWS\directx32.exe 2008-06-04 16:11:16 9472 --a------ C:\WINDOWS\ctrlpan.dll 2008-06-04 16:11:16 29184 --a------ C:\WINDOWS\ctfmon32.exe 2008-06-04 16:09:54 401972 --a------ C:\WINDOWS\system32\g3.exe 2008-06-04 11:41:41 738847 --ahs---- C:\WINDOWS\system32\KRqBeMoq.ini2 2008-06-04 11:37:25 0 d-------- C:\Documents and Settings\LocalService\Application Data\Macromedia 2008-06-04 11:37:24 0 d-------- C:\Documents and Settings\LocalService\Application Data\Adobe 2008-06-04 11:37:10 860 --a------ C:\WINDOWS\system32\winpfz33.sys 2008-06-04 11:37:05 0 dr------- C:\Documents and Settings\LocalService\Favorites 2008-06-04 11:37:02 4 --a------ C:\WINDOWS\system32\hljwugsf.bin 2008-06-04 11:36:59 88961 --a------ C:\WINDOWS\system32\mysidesearch_sidebar_uninstall.exe 2008-06-04 11:36:54 87513 --a------ C:\WINDOWS\system32\iftuyszv.exe <Not Verified; Microsoft; XML Media> 2008-06-04 11:36:54 87513 --a------ C:\WINDOWS\lfn.exe <Not Verified; Microsoft; XML Media> 2008-06-04 11:36:53 298311 --a------ C:\WINDOWS\system32\gside.exe 2008-06-04 11:36:38 86144 --a------ C:\WINDOWS\system32\drivers\hidirr.sys 2008-06-04 11:36:36 0 d-------- C:\WINDOWS\system32\fIE 2008-06-04 11:36:35 0 d-------- C:\WINDOWS\system32\Vco1 2008-06-04 11:36:35 0 d-------- C:\WINDOWS\system32\sTMP 2008-06-04 11:36:35 0 d-------- C:\WINDOWS\system32\Dev3 2008-06-04 11:36:35 0 d-------- C:\WINDOWS\system32\a053 2008-06-04 11:36:35 0 d-------- C:\WINDOWS\system32\6026c 2008-06-04 11:36:29 0 d-------- C:\WINDOWS\system32\vntiho01 -- Find3M Report --------------------------------------------------------------- 2008-06-09 02:29:27 0 d-------- C:\Program Files\Common Files 2008-06-08 21:13:46 0 d-------- C:\Program Files\Symantec 2008-06-08 21:13:44 0 d-------- C:\Program Files\Norton AntiVirus 2008-06-05 09:11:35 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-06-04 21:20:24 0 d-------- C:\Program Files\?icrosoft 2008-05-13 14:05:25 0 d-------- C:\Program Files\World of Warcraft 2008-04-14 23:02:34 0 d-------- C:\Program Files\Messenger 2008-04-11 16:55:16 0 d-------- C:\Program Files\Quicken 2008-04-11 16:44:39 0 --a------ C:\WINDOWS\ativpsrm.bin 2008-04-11 16:33:03 0 d-------- C:\Documents and Settings\Owner\Application Data\Uniblue 2008-04-11 16:30:19 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2008-04-10 22:19:15 0 d-------- C:\Program Files\Movie Maker 2008-04-10 22:18:52 0 d-------- C:\Program Files\Windows NT 2008-04-10 21:28:12 0 d--h----- C:\Program Files\WindowsUpdate 2008-04-10 21:27:17 3884 --a------ C:\WINDOWS\viassary-hp.reg 2008-04-10 21:17:24 0 d-------- C:\Documents and Settings\Owner\Application Data\Real 2008-04-09 08:27:50 0 d-------- C:\Program Files\ATI -- Registry Dump --------------------------------------------------------------- Note empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00110011-4b0b-44d5-9718-90c88817369b}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{086ae192-23a6-48d6-96ec-715f53797e85}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{150fa160-130d-451f-b863-b655061432ba}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{17da0c9e-4a27-4ac5-bb75-5d24b8cdb972}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb1}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb2}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2d38a51a-23c9-48a1-a33c-48675aa2b494}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2e9caff6-30c7-4208-8807-e79d4ec6f806}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{377C180E-6F0E-4D4C-980F-F45BD3D40CF4}] 11/26/2007 10:46 AM 324936 --a------ c:\PROGRA~1\mcafee\msk\mcapbho.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{467faeb2-5f5b-4c81-bae0-2a4752ca7f4e}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5321e378-ffad-4999-8c62-03ca8155f0b3}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{587dbf2d-9145-4c9e-92c2-1f953da73773}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6cc1c91a-ae8b-4373-a5b4-28ba1851e39a}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{79369d5c-2903-4b7a-ade2-d5e0dee14d24}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{799a370d-5993-4887-9df7-0a4756a77d00}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{98dbbf16-ca43-4c33-be80-99e6694468a4}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a55581dc-2cdb-4089-8878-71a080b22342}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b847676d-72ac-4393-bfff-43a1eb979352}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bc97b254-b2b9-4d40-971d-78e0978f5f26}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cf021f40-3e14-23a5-cba2-717765721306}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e2ddf680-9905-4dee-8c64-0a5de7fe133c}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e3eebbe8-9cab-4c76-b26a-747e25ebb4c6}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e7afff2a-1b57-49c7-bf6b-e5123394c970}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F632550A-A855-4203-983A-0C2362C98401}] C:\WINDOWS\system32\qoMeBqRK.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fd9bc004-8331-4457-b830-4759ff704c22}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ff1bf4c7-4e08-4a28-a43f-9d60a9f7a880}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SiteAdvisor"="C:\Program Files\SiteAdvisor\6145\SiteAdv.exe" [06/21/2007 03:06 PM] "McENUI"="C:\PROGRA~1\McAfee\MHN\McENUI.exe" [11/30/2007 05:42 AM] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [11/01/2007 07:12 PM] "ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [04/10/2008 03:14 PM] "BMaf8893fe"="C:\WINDOWS\system32\cxvhxoks.dll" [06/08/2008 09:08 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:56 AM] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 11:24 AM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "Userinit"="C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\iftuyszv.exe," [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\qoMeBqRK [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" -- End of Deckard's System Scanner: finished at 2008-06-09 04:08:50 ------------

06-12-2008, 03:20 AM	#2 (permalink)
Robbyj717 Registered User Join Date: Jan 2008 Posts: 20 OS: windows xp	Re: Suspected malware /bump

06-15-2008, 10:01 AM	#3 (permalink)
TheBruce1 Moderator, Analyst, Security Team Join Date: Oct 2006 Location: Dùn Èideann,Scotland. Posts: 5,093 OS: XP	Re: Suspected malware Hello Apologises for the delay getting to your log. The helpers here are all volunteers and we have been very busy lately. If you are still having malware problems, follow instructions below. ======== Please run Deckard's System Scanner once again, this time using these instructions: Click the Windows 'Start' button > Select 'Run' - then copy/paste this into the run box & click OK "%userprofile%\desktop\dss.exe" /config Click on Extra Log and tick all boxes below that. Click Scan! When finished, it shall produce two logs for you. Post those logs in your next reply. ======== Logs Required C:\Deckard\System Scanner\main.txt C:\Deckard\System Scanner\extra.txt<----Attached __________________ Member of ASAP since 2007 Member of UNITE since 2008 Notice to BT customers BT to dump Phorm, see Here for more information. No DPI If we have helped you in anyway, please consider Donating

06-16-2008, 08:08 PM	#5 (permalink)
Robbyj717 Registered User Join Date: Jan 2008 Posts: 20 OS: windows xp	Re: Suspected malware I missed the end on c&p. 2008-06-09 02:29:27 0 d-------- C:\Program Files\Common Files 2008-06-08 21:13:46 0 d-------- C:\Program Files\Symantec 2008-06-08 21:13:44 0 d-------- C:\Program Files\Norton AntiVirus 2008-06-05 09:11:35 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-06-04 21:20:24 0 d-------- C:\Program Files\?icrosoft 2008-05-13 14:05:25 0 d-------- C:\Program Files\World of Warcraft 2008-04-11 16:44:39 0 --a------ C:\WINDOWS\ativpsrm.bin 2008-04-11 16:30:19 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2008-04-10 21:27:17 3884 --a------ C:\WINDOWS\viassary-hp.reg -- Registry Dump --------------------------------------------------------------- Note empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00110011-4b0b-44d5-9718-90c88817369b}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{086ae192-23a6-48d6-96ec-715f53797e85}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{150fa160-130d-451f-b863-b655061432ba}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{17da0c9e-4a27-4ac5-bb75-5d24b8cdb972}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb1}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb2}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2d38a51a-23c9-48a1-a33c-48675aa2b494}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2e9caff6-30c7-4208-8807-e79d4ec6f806}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{377C180E-6F0E-4D4C-980F-F45BD3D40CF4}] 11/26/2007 10:46 AM 324936 --a------ c:\PROGRA~1\mcafee\msk\mcapbho.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{467faeb2-5f5b-4c81-bae0-2a4752ca7f4e}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5321e378-ffad-4999-8c62-03ca8155f0b3}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{587dbf2d-9145-4c9e-92c2-1f953da73773}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6cc1c91a-ae8b-4373-a5b4-28ba1851e39a}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{79369d5c-2903-4b7a-ade2-d5e0dee14d24}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{799a370d-5993-4887-9df7-0a4756a77d00}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{98dbbf16-ca43-4c33-be80-99e6694468a4}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a55581dc-2cdb-4089-8878-71a080b22342}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b847676d-72ac-4393-bfff-43a1eb979352}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bc97b254-b2b9-4d40-971d-78e0978f5f26}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cf021f40-3e14-23a5-cba2-717765721306}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e2ddf680-9905-4dee-8c64-0a5de7fe133c}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e3eebbe8-9cab-4c76-b26a-747e25ebb4c6}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e7afff2a-1b57-49c7-bf6b-e5123394c970}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F632550A-A855-4203-983A-0C2362C98401}] C:\WINDOWS\system32\qoMeBqRK.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fd9bc004-8331-4457-b830-4759ff704c22}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ff1bf4c7-4e08-4a28-a43f-9d60a9f7a880}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SiteAdvisor"="C:\Program Files\SiteAdvisor\6145\SiteAdv.exe" [06/21/2007 03:06 PM] "McENUI"="C:\PROGRA~1\McAfee\MHN\McENUI.exe" [11/30/2007 05:42 AM] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [11/01/2007 07:12 PM] "ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [04/10/2008 03:14 PM] "BMaf8893fe"="C:\WINDOWS\system32\cxvhxoks.dll" [06/08/2008 09:08 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:56 AM] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 11:24 AM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "Userinit"="C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\iftuyszv.exe," [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\qoMeBqRK [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" -- End of Deckard's System Scanner: finished at 2008-06-16 21:03:56 ------------

06-17-2008, 05:28 AM	#6 (permalink)
TheBruce1 Moderator, Analyst, Security Team Join Date: Oct 2006 Location: Dùn Èideann,Scotland. Posts: 5,093 OS: XP	Re: Suspected malware Hello again Your logs suggest the possibility that your computer was attacked by a backdoor trojan. This type of infection allows hackers to remotely control your computer, steal critical system information and download and execute files without your knowledge. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation. Please read this: How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud? ========= Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. ======== Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear, a lack of symptoms does not mean that it is no longer present. Please Do Not Attach logs to your posts unless you are advised to do so. ======== Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions. ======== Download SDFix and save it to your Desktop. Double click SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows Directory, typically C:SDFix) Please then reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, the Advanced Options Menu should appear; Select the first option, to run Windows in Safe Mode, then press Enter. Choose your usual account. Open the extracted SDFix folder and double click RunThis.bat to start the script. Type Y to begin the cleanup process. It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot. Press any Key and it will restart the PC. When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons. Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt (Report.txt will also be copied to Clipboard ready for posting back on the forum). Finally paste the contents of the Report.txt back on the forum with all the required logs ========= Please visit this webpage for instructions for downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery mode. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Once the Recovery Console is installed using ComboFix, you should see a message that says: The Recovery Console was successfully installed. Please continue as follows: Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Click Yes to allow ComboFix to continue scanning for malware. When the tool is finished, it will produce a report for you. ========== Please download HijackThis to your desktop Alternate link Double-click on the file you just downloaded. Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis Upon install, HijackThis should open for you. Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe 1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'. 2. If you don't get the intro screen, just hit Scan and then click on Save log. 3. Post the hijackthis.log file here. Do not fix anything in HijackThis since they may be harmless. ========= Logs Required Report.txt C:\Combofix.txt Hijackthis Log __________________ Member of ASAP since 2007 Member of UNITE since 2008 Notice to BT customers BT to dump Phorm, see Here for more information. No DPI If we have helped you in anyway, please consider Donating

06-17-2008, 12:08 PM	#7 (permalink)
Robbyj717 Registered User Join Date: Jan 2008 Posts: 20 OS: windows xp	Re: Suspected malware Ok, I got the SDFix and ran it and now I have the report.txt, but internet explorer will not load the combofix link. It doesnt give me an error screen or a message that it is being blocked by anything, I just get a internet explorer loading icon at the top and nothing happens. It was doing the same thing the last week for certain sites. Google and yahoo search wouldn't work but msn live search does and i can't acces my yahoo email but other sites work fine and load quickly. Is there another combofix link that i can try?

06-17-2008, 12:23 PM	#8 (permalink)
TheBruce1 Moderator, Analyst, Security Team Join Date: Oct 2006 Location: Dùn Èideann,Scotland. Posts: 5,093 OS: XP	Re: Suspected malware Download Combofix from any of the links below, and save it to your desktop. Link 1 Link 2 Link 3 Note: It is important that it is saved directly to your desktop -------------------------------------------------------------------- 1. Disconnect from the internet. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. -------------------------------------------------------------------- Double click on ComboFix.exe & follow the prompts. When finished, it will produce a report for you. Please post the C:\ComboFix.txt along with a new HijackThis log so we can continue cleaning the system. Note: Do not mouseclick combofix's window while it's running. That may cause it to stall __________________ Member of ASAP since 2007 Member of UNITE since 2008 Notice to BT customers BT to dump Phorm, see Here for more information. No DPI If we have helped you in anyway, please consider Donating

06-17-2008, 01:32 PM	#9 (permalink)
Robbyj717 Registered User Join Date: Jan 2008 Posts: 20 OS: windows xp	Re: Suspected malware SDFix: Version 1.194 Run by Administrator on Tue 06/17/2008 at 12:43 PM Microsoft Windows XP [Version 5.1.2600] Running From: C:\DOCUME~1\Owner\Desktop\SDFix Checking Services : Name : HIDIRR Path : System32\drivers\hidirr.sys HIDIRR - Deleted Restoring Windows Registry Values Restoring Windows Default Hosts File Restoring Default Desktop Wallpaper Rebooting Checking Files : Trojan Files Found: C:\WINDOWS\x.exe - Deleted C:\WINDOWS\y.exe - Deleted C:\WINDOWS\accesss.exe - Deleted C:\WINDOWS\astctl32.ocx - Deleted C:\WINDOWS\avpcc.dll - Deleted C:\WINDOWS\clrssn.exe - Deleted C:\WINDOWS\cpan.dll - Deleted C:\WINDOWS\ctfmon32.exe - Deleted C:\WINDOWS\ctrlpan.dll - Deleted C:\WINDOWS\default.htm - Deleted C:\WINDOWS\directx32.exe - Deleted C:\WINDOWS\dnsrelay.dll - Deleted C:\WINDOWS\editpad.exe - Deleted C:\WINDOWS\explore.exe - Deleted C:\WINDOWS\explorer32.exe - Deleted C:\WINDOWS\funniest.exe - Deleted C:\WINDOWS\funny.exe - Deleted C:\WINDOWS\gfmnaaa.dll - Deleted C:\WINDOWS\helpcvs.exe - Deleted C:\WINDOWS\iedll.exe - Deleted C:\WINDOWS\iexplorer.exe - Deleted C:\WINDOWS\inetinf.exe - Deleted C:\WINDOWS\internet.exe - Deleted C:\WINDOWS\loader.exe - Deleted C:\WINDOWS\megavid.cdt - Deleted C:\WINDOWS\msconfd.dll - Deleted C:\WINDOWS\msspi.dll - Deleted C:\WINDOWS\mssys.exe - Deleted C:\WINDOWS\msupdate.exe - Deleted C:\WINDOWS\mswsc10.dll - Deleted C:\WINDOWS\mswsc20.dll - Deleted C:\WINDOWS\mtwirl32.dll - Deleted C:\WINDOWS\muotr.so - Deleted C:\WINDOWS\notepad32.exe - Deleted C:\WINDOWS\olehelp.exe - Deleted C:\WINDOWS\qttasks.exe - Deleted C:\WINDOWS\quicken.exe - Deleted C:\WINDOWS\rundll16.exe - Deleted C:\WINDOWS\rundll32.vbe - Deleted C:\WINDOWS\searchword.dll - Deleted C:\WINDOWS\sistem.exe - Deleted C:\WINDOWS\svchost32.exe - Deleted C:\WINDOWS\svcinit.exe - Deleted C:\WINDOWS\systeem.exe - Deleted C:\WINDOWS\systemcritical.exe - Deleted C:\WINDOWS\system32\drivers\core.cache.dsk - Deleted C:\WINDOWS\system32\hljwugsf.bin - Deleted C:\WINDOWS\time.exe - Deleted C:\WINDOWS\users32.exe - Deleted C:\WINDOWS\waol.exe - Deleted C:\WINDOWS\win32e.exe - Deleted C:\WINDOWS\win64.exe - Deleted C:\WINDOWS\winajbm.dll - Deleted C:\WINDOWS\window.exe - Deleted C:\WINDOWS\winmgnt.exe - Deleted C:\WINDOWS\xplugin.dll - Deleted C:\WINDOWS\xxxvideo.hta - Deleted C:\WINDOWS\system32\drivers\HIDIRR.sys - Deleted Folder C:\Temp\tn3 - Removed Folder C:\WINDOWS\system32\vntiho01 - Removed Removing Temp Files ADS Check : Final Check : catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-17 12:52:48 Windows 5.1.2600 Service Pack 2 NTFS detected NTDLL code modification: ZwClose scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher] "TracesProcessed"=dword:000000b9 "TracesSuccessful"=dword:00000003 scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe::enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe::Enabled:iTunes" "C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"="C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe::Enabled:McAfee Network Agent" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe::enabled:@xpsp2res.dll,-22019" Remaining Files : File Backups: - C:\DOCUME~1\Owner\Desktop\SDFix\backups\backups.zip Files with Hidden Attributes : Thu 10 Apr 2008 196 A.SHR --- "C:\BOOT.BAK" Mon 10 Dec 2007 31 A..H. --- "C:\WINDOWS\uccspecc.sys" Mon 2 Oct 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Tue 30 Aug 2005 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.key.bak" Mon 9 Jun 2008 20,487 A.SHR --- "C:\Program Files\McAfee\MQC\MRU.bak" Mon 9 Jun 2008 265 A.SHR --- "C:\Program Files\McAfee\MQC\qcconf.bak" Wed 7 Mar 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp" Thu 10 Apr 2008 2,367,240 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5ad35005cb1cf6ab0e5d8906b81ef3e1\BITE.tmp" Fri 11 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ab59ac72525ea90a47679441587835c9\BIT2.tmp" Wed 7 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\fd0264849c01086f3c6b505dc02dbd44\BIT3.tmp" Thu 10 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0615c0a0d589689e7965d4bf87a5872b\download\BIT58.tmp" Thu 10 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\26850ce336513bfee15ef865c4e6576c\download\BIT442.tmp" Thu 10 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\2d5cb53f40c94c45549672fbf4eb14b2\download\BIT815.tmp" Thu 10 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\409eeb5b15ac5b9aeee323d7da0f978c\download\BIT801.tmp" Thu 10 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\4730fbe8056ad6eb56eb6cc23d82cd01\download\BIT7A.tmp" Thu 10 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\4cd8fa349c86e90c2d5b6edfe250f0d9\download\BIT817.tmp" Thu 10 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\6aa2d4bcedcee9617227cafceab09f02\download\BIT811.tmp" Thu 10 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\92554586f3df257ccc6f5cd3e1efab22\download\BIT80C.tmp" Thu 10 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\94ee68f37097c1148365727afa16d894\download\BIT59.tmp" Thu 10 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a1394c19ce964344512c4b8ba52cbec5\download\BIT80F.tmp" Thu 10 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\c4989c7d9cfedbbe50931f1ce8778e69\download\BIT5B.tmp" Tue 20 Jun 2006 2,142 A.SH. --- "C:\Documents and Settings\Owner\Application Data\Roxio\Dragon\DiscInfoCache\SAMSUNG__CD-ROM_SC-148A___B401_310_DICV018_DRGV20100BC.TMP" Finished!

06-17-2008, 01:33 PM	#10 (permalink)
Robbyj717 Registered User Join Date: Jan 2008 Posts: 20 OS: windows xp	Re: Suspected malware ComboFix 08-06-16.5 - Owner 2008-06-17 14:12:33.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2041 [GMT -5:00] Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Owner\My Documents\MANTEC~1 C:\Program Files\icroso~1 C:\WINDOWS\cookies.ini C:\WINDOWS\Downloaded Program Files\setup.inf C:\WINDOWS\lfn.exe C:\WINDOWS\mainms.vpi C:\WINDOWS\portsv.exe C:\WINDOWS\pskt.ini C:\WINDOWS\system32\cxvhxoks.dll C:\WINDOWS\system32\dwwucsvr.ini C:\WINDOWS\system32\gside.exe C:\WINDOWS\system32\kgubutaw.ini C:\WINDOWS\system32\KRqBeMoq.ini C:\WINDOWS\system32\KRqBeMoq.ini2 C:\WINDOWS\system32\lopopuju.dll C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\MSINET.oca C:\WINDOWS\system32\mysidesearch_sidebar_uninstall.exe C:\WINDOWS\system32\nvfweblw.dll C:\WINDOWS\system32\tvuuioqx.dll C:\WINDOWS\system32\winpfz33.sys C:\WINDOWS\system32\xqoiuuvt.ini . ((((((((((((((((((((((((( Files Created from 2008-05-17 to 2008-06-17 ))))))))))))))))))))))))))))))) . 2008-06-17 12:38 . 2008-06-17 12:38 <DIR> d-------- C:\WINDOWS\ERUNT 2008-06-16 21:50 . 2008-06-16 21:50 118 --a------ C:\WINDOWS\system32\MRT.INI 2008-06-16 20:58 . 2008-04-14 06:01 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-09 03:47 . 2008-06-09 03:47 <DIR> d-------- C:\Deckard 2008-06-09 03:33 . 2008-06-09 03:33 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-06-09 02:29 . 2008-06-09 02:29 <DIR> d-------- C:\Program Files\Common Files\Download Manager 2008-06-09 02:29 . 2008-06-09 02:29 1,152 --a------ C:\WINDOWS\system32\windrv.sys 2008-06-09 01:49 . 2008-06-09 01:49 <DIR> d-------- C:\Program Files\Enigma Software Group 2008-06-09 01:31 . 2004-05-12 06:29 <DIR> d-------- C:\Documents and Settings\Administrator\WINDOWS 2008-06-09 01:31 . 2004-05-13 00:57 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Symantec 2008-06-09 01:31 . 2004-05-12 07:05 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SampleView 2008-06-09 01:31 . 2008-06-09 01:31 <DIR> d-------- C:\Documents and Settings\Administrator 2008-06-09 01:22 . 2008-06-08 21:55 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-06-09 00:58 . 2008-06-17 13:05 <DIR> d-------- C:\Program Files\Spyware Doctor 2008-06-09 00:58 . 2007-12-10 13:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-06-09 00:58 . 2007-12-10 13:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-06-09 00:58 . 2008-02-01 11:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-06-09 00:58 . 2007-12-10 13:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-06-08 23:54 . 2008-06-08 21:55 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-06-08 22:37 . 2008-06-16 21:49 1,374 --a------ C:\WINDOWS\imsins.BAK 2008-06-08 21:56 . 2008-06-08 21:55 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-06-08 21:56 . 2008-06-08 21:55 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-06-08 21:56 . 2008-06-08 21:55 86,528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-06-08 21:56 . 2008-06-08 21:55 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-06-08 21:56 . 2008-06-08 21:55 82,944 --a------ C:\WINDOWS\system32\404Fix.exe 2008-06-08 21:56 . 2008-06-08 21:55 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-06-08 21:56 . 2008-06-09 01:38 880 --a------ C:\WINDOWS\system32\tmp.reg 2008-06-08 21:31 . 2008-06-17 14:18 6,224 --a------ C:\WINDOWS\system32\Config.MPF 2008-06-08 21:22 . 2008-06-08 21:22 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\SiteAdvisor 2008-06-08 21:21 . 2008-06-08 21:33 <DIR> d-------- C:\Program Files\SiteAdvisor 2008-06-08 21:21 . 2008-06-09 02:24 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\SiteAdvisor 2008-06-08 21:21 . 2008-06-08 21:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor 2008-06-08 21:19 . 2006-03-03 08:07 143,360 --a------ C:\WINDOWS\system32\dunzip32.dll 2008-06-08 21:17 . 2007-11-22 06:44 201,320 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys 2008-06-08 21:17 . 2007-11-22 06:44 79,304 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys 2008-06-08 21:17 . 2007-12-02 12:51 40,488 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys 2008-06-08 21:17 . 2007-11-22 06:44 35,240 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys 2008-06-08 21:17 . 2007-11-22 06:44 33,832 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys 2008-06-08 21:16 . 2007-07-13 06:20 113,952 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys 2008-06-08 21:15 . 2008-06-08 21:15 <DIR> d-------- C:\Program Files\McAfee.com 2008-06-08 21:15 . 2008-06-09 01:06 <DIR> d-------- C:\Program Files\Common Files\McAfee 2008-06-08 21:14 . 2008-06-09 01:42 <DIR> d-------- C:\Program Files\McAfee 2008-06-08 21:08 . 2008-06-09 00:16 <DIR> d-------- C:\WINDOWS\system32\5076 2008-06-08 21:08 . 2008-06-08 21:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee 2008-06-04 21:13 . 2008-06-16 20:55 117 --a------ C:\WINDOWS\BMaf8893fe.xml 2008-06-04 16:18 . 2008-06-04 16:18 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-06-04 16:18 . 2008-06-04 16:18 1,409 --a------ C:\WINDOWS\QTFont.for 2008-06-04 16:09 . 2008-06-04 16:09 401,972 --a------ C:\WINDOWS\system32\g3.exe 2008-06-04 11:47 . 2008-06-04 11:47 9,662 --a------ C:\WINDOWS\system32\ZoneAlarmIconUS.ico 2008-06-04 11:36 . 2008-06-08 23:33 <DIR> d-------- C:\WINDOWS\system32\Vco1 2008-06-04 11:36 . 2008-06-09 02:01 <DIR> d-------- C:\WINDOWS\system32\sTMP 2008-06-04 11:36 . 2008-06-09 02:01 <DIR> d-------- C:\WINDOWS\system32\fIE 2008-06-04 11:36 . 2008-06-09 02:00 <DIR> d-------- C:\WINDOWS\system32\Dev3 2008-06-04 11:36 . 2008-06-08 23:15 <DIR> d-------- C:\WINDOWS\system32\a053 2008-06-04 11:36 . 2008-06-08 23:15 <DIR> d-------- C:\WINDOWS\system32\6026c . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-17 19:18 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-09 02:13 --------- d-----w C:\Program Files\Symantec 2008-06-09 02:13 --------- d-----w C:\Program Files\Norton AntiVirus 2008-06-09 02:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2008-06-05 14:11 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-13 19:05 --------- d-----w C:\Program Files\World of Warcraft 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-04-11 02:27 3,884 ----a-w C:\WINDOWS\viassary-hp.reg 2008-01-13 16:12 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat 2006-06-12 06:17 0 ----a-w C:\Documents and Settings\Owner\ignorelist.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F632550A-A855-4203-983A-0C2362C98401}] C:\WINDOWS\system32\qoMeBqRK.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SiteAdvisor"="C:\Program Files\SiteAdvisor\6145\SiteAdv.exe" [2007-06-21 15:06 36640] "McENUI"="C:\PROGRA~1\McAfee\MHN\McENUI.exe" [2007-11-30 05:42 1164576] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-11-01 19:12 582992] "ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2008-04-10 15:14 1107848] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= R3 Alpham;Ideazon Merc Composite Keyboard Driver;C:\WINDOWS\system32\DRIVERS\Alpham.sys [2005-12-04 13:55] . Contents of the 'Scheduled Tasks' folder "2008-06-09 02:16:12 C:\WINDOWS\Tasks\McDefragTask.job" - c:\program files\mcafee\mqc\QcConsol.exe' "2008-06-09 02:16:11 C:\WINDOWS\Tasks\McQcTask.job" - c:\program files\mcafee\mqc\QcConsol.exe "2008-06-03 01:00:00 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Owner.job" - C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeh/TASK: . ************************************************************************ catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-17 14:18:50 Windows 5.1.2600 Service Pack 2 NTFS detected NTDLL code modification: ZwClose scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\explorer.exe -> C:\Program Files\SiteAdvisor\6145\saHook.dll . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\gearsec.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe C:\Program Files\McAfee\MPF\MpfSrv.exe C:\Program Files\McAfee\MSK\msksrver.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\Program Files\SiteAdvisor\6145\SAService.exe C:\PROGRA~1\McAfee.com\Agent\mcagent.exe C:\PROGRA~1\McAfee\MSC\mcuimgr.exe . ************************************************************************ . Completion time: 2008-06-17 14:22:11 - machine was rebooted ComboFix-quarantined-files.txt 2008-06-17 19:22:04 Pre-Run: 115,792,863,232 bytes free Post-Run: 115,772,567,552 bytes free 175 --- E O F --- 2008-06-17 02:51:20

06-17-2008, 01:34 PM	#11 (permalink)
Robbyj717 Registered User Join Date: Jan 2008 Posts: 20 OS: windows xp	Re: Suspected malware Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:31:26 PM, on 6/17/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\gearsec.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\McAfee\MSK\MskSrver.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\Program Files\SiteAdvisor\6145\SAService.exe c:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\WINDOWS\System32\alg.exe C:\Program Files\SiteAdvisor\6145\SiteAdv.exe C:\WINDOWS\system32\ctfmon.exe c:\PROGRA~1\mcafee\msc\mcuimgr.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Documents and Settings\Owner\Desktop\HiJackThis\HijackThis.exe C:\WINDOWS\System32\wbem\wmiprvse.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6145\SiteAdv.dll O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll O2 - BHO: (no name) - {F632550A-A855-4203-983A-0C2362C98401} - C:\WINDOWS\system32\qoMeBqRK.dll (file missing) O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6145\SiteAdv.dll O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6145\SiteAdv.exe O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...p=ZRxdm678NTUS O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...tup1.0.1.0.cab O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h20264.www2.hp.com/ediags/dd/...osticsxp2k.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1207881416890 O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://ak.imgag.com/imgag/cp/install/Crusher.cab O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://plugin.driveragent.com/files/driveragent.cab O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6145\SAService.exe -- End of file - 6331 bytes

06-17-2008, 09:46 PM	#15 (permalink)
Robbyj717 Registered User Join Date: Jan 2008 Posts: 20 OS: windows xp	Re: Suspected malware Kaspersky: -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Tuesday, June 17, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Wednesday, June 18, 2008 01:46:41 Records in database: 877463 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ K:\ Scan statistics: Files scanned: 79820 Threat name: 8 Infected objects: 13 Suspicious objects: 0 Duration of the scan: 02:08:22 File name / Threat name / Threats count C:\Deckard\System Scanner\20080609040703\backup\WINDOWS\temp\Temporary Internet Files\Content.IE5\09GG2KZS\install_en[1].exe Infected: not-a-virus:Downloader.Win32.WinFixer.au 1 C:\Documents and Settings\Owner\.housecall6.6\Quarantine\omfg.class-14fdec45-4f709e9b.class.bac_a02800 Infected: Trojan-Downloader.Java.OpenStream.y 1 C:\Documents and Settings\Owner\.housecall6.6\Quarantine\omfg.class-c973141-40aacea9.class.bac_a02800 Infected: Trojan-Downloader.Java.OpenStream.y 1 C:\Documents and Settings\Owner\Desktop\SmitfraudFix\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1 C:\Documents and Settings\Owner\Desktop\SmitfraudFix.zip Infected: not-a-virus:RiskTool.Win32.Reboot.f 1 C:\Program Files\Common Files\Real\Toolbar\RealBar.dll Infected: not-a-virus:AdWare.Win32.MegaSearch.s 1 C:\QooBox\Quarantine\C\WINDOWS\lfn.exe.vir Infected: not-virus:Hoax.Win32.Renos.ctv 1 C:\QooBox\Quarantine\C\WINDOWS\system32\cxvhxoks.dll.vir Infected: Trojan.Win32.Monder.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\g3.exe.vir Infected: not-a-virus:AdWare.Win32.Agent.byy 1 C:\QooBox\Quarantine\C\WINDOWS\system32\lopopuju.dll.vir Infected: Trojan.Win32.Monder.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\nvfweblw.dll.vir Infected: Trojan.Win32.Monder.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\tvuuioqx.dll.vir Infected: Trojan.Win32.Monder.gen 1 C:\QooBox\Quarantine\catchme2008-06-17_141840.21.zip Infected: Rootkit.Win32.Agent.aol 1 The selected area was scanned.

06-17-2008, 09:47 PM	#16 (permalink)
Robbyj717 Registered User Join Date: Jan 2008 Posts: 20 OS: windows xp	Re: Suspected malware Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:37:28 PM, on 6/17/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\SiteAdvisor\6145\SiteAdv.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\System32\gearsec.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\McAfee\MSK\MskSrver.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\Program Files\SiteAdvisor\6145\SAService.exe C:\WINDOWS\System32\alg.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe c:\PROGRA~1\mcafee\msc\mcuimgr.exe C:\Documents and Settings\Owner\Desktop\HiJackThis\HijackThis.exe C:\WINDOWS\System32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6145\SiteAdv.dll O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6145\SiteAdv.dll O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6145\SiteAdv.exe O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...p=ZRxdm678NTUS O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...tup1.0.1.0.cab O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h20264.www2.hp.com/ediags/dd/...osticsxp2k.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1207881416890 O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://ak.imgag.com/imgag/cp/install/Crusher.cab O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://plugin.driveragent.com/files/driveragent.cab O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6145\SAService.exe -- End of file - 6643 bytes

06-18-2008, 06:42 AM	#17 (permalink)
TheBruce1 Moderator, Analyst, Security Team Join Date: Oct 2006 Location: Dùn Èideann,Scotland. Posts: 5,093 OS: XP	Re: Suspected malware Hi Robby Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any) O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...p=ZRxdm678NTUS O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...tup1.0.1.0.cab *Please remember to close all other windows, including browsers then click Fix checked.* ======== Delete the following Files indicated in RED and Folders indicated in BLUE C:\Documents and Settings\Owner\.housecall6.6 C:\WINDOWS\system32\ZoneAlarmIconUS.ico ======== Delete SmitFraudFix and SDFix from your desktop, also delete these folders C:\Smitfraudfix and C:\SDFix. You can keep ATF-Cleaner if you wish. ========= Well done,your logs are clean. Click start>run>type(or copy/paste command into run box): ComboFix /u Click ok. ======= Clear IE7 cookies On the Internet Explorer 7 Tools menu, click Internet Options. The Internet Options box should open to the General tab. On the General tab, in the Browsing History, click the Delete button. This will delete all the files that are currently stored in your cache [that includes cookies too]. Click OK, and then click OK again. Clear Firefox cookies/cache* • Select "Tools" • Select "Options". • Select "Privacy". • In "Settings" window put the check mark for Cookies,Cache,Browsing history and any others you want. • Click OK. • In Private area click "Clear Now". ------------------------------------------------------------------------------------------- MICROSOFT UPDATES 1.Click Start,Run, type sysdm.cpl, and then press OK. 2.Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended). Microsoft updates are released every second Tuesday of each month,what is called "Patch Tuesday". ------------------------------------------------------------------------------------------ Useful Information and Programs to keep you safe. TrendProtect is a FREE browser plug-in that helps you avoid Web pages with unwanted content and hidden threats. TrendProtect rates the current page and pages listed in Google, MSN, and Yahoo search results. You can use the rating to decide if you want to visit or avoid a given Web page. To rate Web pages, TrendProtect refers to an extensive database that covers the following information for billions of Web pages: * Content category * Phishing scam detection * Site reputation * Page reputation WOT Free helps you avoid disingenuous Internet content by allowing you to learn from others' experiences. WOT shows you website reputations on your browser, telling you how much other users trust a website. This helps you make better decisions while browsing and avoid phishing, malware, and other types of fraud. Reputations can also be added to web search results, Gmail, Wikipedia, and other selected sites. WOT reputations are computed mainly from user testimonies. Sharing your knowledge with others is just a click away, without ever having to leave the site. We also collect data from hundreds of other sources (including PhishTank) to quickly warn you of emerging threats. Currently, WOT knows over 12 million websites. Note:Only compatible with Firefox 1.5 and higher. -------------------------------------------------------------------------------------- Alternate Browsers Try the following free alternate browsers rather than Internet Explorer Avant Firefox Opera K-Meleon ------------------------------------------------------------------------------------------ Free Antispyware Products SuperAntiSpyware Ad-Aware Spybot S&D Download SpywareBlaster 3.5.1 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items. Download Spyware Guard to catch and block spyware before it can execute. ------------------------------------------------------------------ IE-Spyad™ is a freeware utility that places more than 4000 dubious websites and domains in the Internet Explorer Restricted List. Download and installation instructions for IE-Spyad™ Here ----------------------------------------- The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file. If your having trouble downloading & extracting,see link below for guidance: http://www.mvps.org/winhelp2002/hosts2.htm Once you have extracted the host file,double click on it and a new window will open. Double-click on mvps.batand follow the prompts --------------------------------------------------------------- Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here: Using Winpatrol to protect your computer. ---------------------------------------- SnoopFree is a programme that informs you when another programme is wanting to log your keystrokes or read your screen.Only for XP users. Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released. ============================================== Also, please take a look at these well written articles: PC Safety and Security--What Do I Need? HOW DID I GET INFECTED IN THE FIRST PLACE? by Tony Klein THE ANTI-SPYWARE TUTORIAL MAKING INTERNET EXPLORER SAFER Understanding and Using Firewalls Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. Please reply to this thread once more, as we may mark this as resolved, thanks. __________________ Member of ASAP since 2007 Member of UNITE since 2008 Notice to BT customers BT to dump Phorm, see Here for more information. No DPI If we have helped you in anyway, please consider Donating**

06-18-2008, 07:49 AM	#18 (permalink)
Robbyj717 Registered User Join Date: Jan 2008 Posts: 20 OS: windows xp	Re: Suspected malware You guys are awesome. Thanks for all the help, I really appreciate it. Keep up the good work.