# Sister's log



## fliime (Dec 11, 2003)

Could someone please take a look at this, ran spybot and ad-aware to remove some junk.

Thanks

Logfile of HijackThis v1.99.1
Scan saved at 2:22:42 AM, on 10/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\mswinup.exe
C:\WINDOWS\system32\winsvcup.exe
C:\WINDOWS\system32\winupsvc.exe
C:\windows\system32\stonedrv.exe
C:\WINDOWS\system.exe
C:\WINDOWS\system32\mdms2.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\{4065618A-0510-1033-0327-010923990001}\Update.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Marisa\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.search-spree.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Sympatico
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: (no name) - {C004DEC2-2623-438e-9CA2-C9043AB28508} - (no file)
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MSWindowsUpdate] C:\WINDOWS\system32\mswinup.exe
O4 - HKLM\..\Run: [WindowsFirewallSvc] C:\WINDOWS\system32\winsvcup.exe
O4 - HKLM\..\Run: [Windows Update Host] C:\WINDOWS\system32\winupsvc.exe
O4 - HKLM\..\Run: [explorer] C:\Documents and Settings\Marisa\Desktop\Yinstall.exe
O4 - HKLM\..\Run: [Windows APCI Verifier] dhcpserv.exe
O4 - HKLM\..\Run: [stonedrv] c:\windows\system32\stonedrv.exe
O4 - HKLM\..\Run: [_mzu_stonedrv2] C:\WINDOWS\system32\_mzu_stonedrv2.exe
O4 - HKLM\..\Run: [NvCplSystem] C:\WINDOWS\system.exe
O4 - HKLM\..\Run: [SvcManager] mdms2.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [Windows APCI Verifier] dhcpserv.exe
O4 - HKLM\..\RunServices: [stonedrv] c:\windows\system32\stonedrv.exe
O4 - HKLM\..\RunServices: [_mzu_stonedrv2] C:\WINDOWS\system32\_mzu_stonedrv2.exe
O4 - HKCU\..\Run: [stonedrv] c:\windows\system32\stonedrv.exe
O4 - HKCU\..\Run: [_mzu_stonedrv2] C:\WINDOWS\system32\_mzu_stonedrv2.exe
O4 - HKCU\..\Run: [shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00033.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O20 - Winlogon Notify: xartcd5 - xartcd5.dll (file missing)
O21 - SSODL: SysRun - {D7FFD784-5276-42D1-887B-00267870A4C7} - C:\WINDOWS\system32\svshost.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe


----------



## Cookiegal (Aug 27, 2003)

Download *haxfix.exe*
and save it to your desktop.

Double click on *haxfix.exe* to install haxfix. (standard installation path is c:\program Files\haxfix)
Checkmark "Create a desktop icon"
Click "Next"
When the installation is completed, make sure that the checkmark "Launch HaxFix" is placed
Click "Finish"

A red "dos window" (dos box) will open with options:
1. Make logfile
2. Run auto fix
3. Run manual fix
E. Exit Haxfix


Select option *1. Make logfile* by typing *1* and then pressing Enter
Haxfix will start scanning the computer. When it is finished a logfile will open: *haxlog.txt* > (c:\haxfix.txt)
Copy the contents of that logfile and paste it into this thread.


----------



## Cookiegal (Aug 27, 2003)

I think this is more likely HackerDefender but we'll see if Haxfix finds anything.


----------



## fliime (Dec 11, 2003)

cookiegal,

thank you for your response, unfortunately, when I click on the haxfix link, it doesn't work.

Thanks


----------



## Cookiegal (Aug 27, 2003)

What happens? Do you get an error message?


----------



## fliime (Dec 11, 2003)

there was an error message: site not found

but it is now working, performing the steps you requested now

thanks


----------



## fliime (Dec 11, 2003)

Here is the log...

again, thanks for your time!

HAXFIX logfile - by Marckie
______________
version 4.21 
Wed 10/11/2006 11:51:56.85 

checking for haxdoor
--------------------
checking for a3d files....
a3d files not found

checking for matching notify keys....
no matching notify keys found 

checking for matching services....
matching services found 
tmcomm

checking for matching safeboot services....
no matching safeboot services found 

checking for other haxdoorfiles....


Checking for goldun
-------------------

checking for SSODL keys....
no ssodl keys found

checking for notify keys....
no notify keys found

checking for services....
no services found

checking for other goldunfiles....


Finished


----------



## Cookiegal (Aug 27, 2003)

Download Suspicious File Packer from http://www.safer-networking.org/en/tools/index.html and unzip it to desktop, open it & 
paste in this list of files and when it has created the archive on your desktop please upload that to http://www.thespykiller.co.uk/forum/index.php?board=1.0 so we can examine the files

C:\WINDOWS\system32\mswinup.exe
C:\WINDOWS\system32\winsvcup.exe
C:\WINDOWS\system32\winupsvc.exe
C:\WINDOWS\system32\svshost.dll
C:\WINDOWS\system32\xartcd5.dll
C:\WINDOWS\system32\ntos.exe

Please add a link to your post here so we know where the files came from. Thanks.


----------



## fliime (Dec 11, 2003)

done, thanks


----------



## dvk01 (Dec 14, 2002)

only these were in teh package
the first 3 are detected as irc worm Drefir
C:\WINDOWS\system32\mswinup.exe
C:\WINDOWS\system32\winsvcup.exe
C:\WINDOWS\system32\winupsvc.exe

this one is backdoor peke or kiddy 
C:\WINDOWS\system32\svshost.dll


----------



## Cookiegal (Aug 27, 2003)

Thanks Derek.


----------



## Cookiegal (Aug 27, 2003)

Please upload these two files as well:

C:\WINDOWS\system32\xartcd5.dll
C:\WINDOWS\system32\ntos.exe


----------



## dvk01 (Dec 14, 2002)

and if you can find it 
C:\WINDOWS\system32\dhcpserv.exe


----------



## fliime (Dec 11, 2003)

done thank you,

just did a scan with AVG, 46 viruses found!
 

thanks for looking into this for me my canadian friend!


----------



## fliime (Dec 11, 2003)

Derek, just sent you the last one you requested,

thanks


----------



## dvk01 (Dec 14, 2002)

when you tried the second time 
C:\WINDOWS\system32\xartcd5.dll is definitely missing so don't worry about it

but this one is in use so sfp can't copy it 
C:\WINDOWS\system32\ntos.exe

first Run HJT & fix
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,

then boot to safe mode & copy it Right click teh file & select copy & then right click desktop && select paste so a copy will be on desktop ( hopefully)

reboot to normal mode & uplaod that at spykiller

Then post a fresh HJT log here , it is very possible that teh F2 entry will come back but I hope it doesn't

also please do this as I suspect a lot more hidden files


Download *WinPFind*
*Right Click* the Zip Folder and Select "*Extract All*"
Extract it somewhere you will remember like the *Desktop*
Dont do anything with it yet!

Reboot into Safe Mode
Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Doubleclick *WinPFind.exe*
Click "* Configure Scan Options*"
Select " *Run Add ONs*" and then select *ALL* the options in the box below it, Press Apply 
Now Click "*Start Scan*"
*It will scan the entire System, so please be patient!*
Once the Scan is Complete
Reboot back to Normal Mode!
Go to the *WinPFind folder*
Locate *WinPFind.txt*
Place those results in the next post!. It will be too big to post so you will need to attach it to your reply


----------



## dvk01 (Dec 14, 2002)

this one doesn't appear to actualy exist either 
C:\WINDOWS\system32\dhcpserv.exe


----------



## Cookiegal (Aug 27, 2003)

fliime said:


> done thank you,
> 
> just did a scan with AVG, 46 viruses found!
> 
> ...


Yeah, we are neighbours! 

Derek will take good care of you.


----------



## fliime (Dec 11, 2003)

Derek,

I have uploaded it to spykiller site, here is a new HJT scan, F2 is still there (pesky bugger).

Will download WPfind now

thanks

Logfile of HijackThis v1.99.1
Scan saved at 2:35:48 PM, on 10/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\winsvcup.exe
C:\WINDOWS\system32\winupsvc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\algs5.exe
C:\WINDOWS\system.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Marisa\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.search-spree.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Sympatico
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\system32\ntos.exe,
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [WindowsFirewallSvc] C:\WINDOWS\system32\winsvcup.exe
O4 - HKLM\..\Run: [Windows Update Host] C:\WINDOWS\system32\winupsvc.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SvcManager] algs5.exe
O4 - HKLM\..\Run: [NvCplSystem] C:\WINDOWS\system.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\RunServices: [_mzu_stonedrv2] C:\WINDOWS\system32\_mzu_stonedrv2.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O20 - Winlogon Notify: xartcd5 - xartcd5.dll (file missing)
O21 - SSODL: SysRun - {D7FFD784-5276-42D1-887B-00267870A4C7} - C:\WINDOWS\system32\svshost.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe


----------



## dvk01 (Dec 14, 2002)

C:\WINDOWS\system32\ntos.exe is still locked by something so couldn't be added to sfp 

I think it woukld be safer to see the wpfind log before we attempt any removal in case it has any hidden stings


----------



## fliime (Dec 11, 2003)

Derek,

my sister's cpu rebooted itself quite a few times as the settings were being loaded, took me over 30 minutes before I was able to get online (without cpu rebooting)
here is the log,
thanks


----------



## dvk01 (Dec 14, 2002)

first
download the attached rem_mc.zip & save to desktop
unzip it & double click it the reg file & say yes to prompts to merge with registry

then

Please download  ATF Cleaner by Atribune
This program is for XP and Windows 2000 only

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

1. Please *download* *The Avenger* by Swandog46 to your *Desktop*.
Click on Avenger.zip to open the file
Extract *avenger.exe* to your desktop

2. Copy *all the text* contained in the quote box below to your Clipboard by highlighting it and pressing (*Ctrl+C*):



> Files to delete:
> C:\WINDOWS\SYSTEM32\algs5.exe
> C:\WINDOWS\SYSTEM32\_mzu_stonedrv2.exe
> C:\WINDOWS\system32\winsvcup.exe
> ...


_*
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.*_

3. Now, *start The Avenger program* by clicking on its icon on your desktop.
 Under "*Script file to execute*" choose "*Input Script Manually*".
Now click on the *Magnifying Glass icon* which will open a new window titled "*View/edit script*" 
 Paste the text copied to clipboard into this window by pressing (*Ctrl+V*).
 Click *Done* 
 Now click on the *Green Light* to begin execution of the script 
 Answer "*Yes*" twice when prompted.
4. *The Avenger will automatically do the following*:
It will *Restart your computer*. ( In cases where the code to execute contains "*Drivers to Unload*", The Avenger will actually *restart your system twice.*) 
On reboot, it will briefly *open a black command window* on your desktop, this is normal.
After the restart, it *creates a log file* that should open with the results of Avengers actions. This log file will be located at *C:\avenger.txt*
 The Avenger will also have *backed up all the files, etc., that you asked it to delete*, and will have zipped them and moved the zip archives to *C:\avenger\backup.zip*.
5. Please *copy/paste* the content of *c:\avenger.txt* into your reply.

when it reboots

Run hijackthis, put a tick in the box beside these entries listed below and *ONLY these entries*, double check to make sure, then make sure all browser & email windows are closed and press fix checked

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.search-spree.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\system32\ntos.exe,
O4 - HKLM\..\Run: [WindowsFirewallSvc] C:\WINDOWS\system32\winsvcup.exe
O4 - HKLM\..\Run: [Windows Update Host] C:\WINDOWS\system32\winupsvc.exe
O4 - HKLM\..\Run: [SvcManager] algs5.exe
O4 - HKLM\..\Run: [NvCplSystem] C:\WINDOWS\system.exe
O4 - HKLM\..\RunServices: [_mzu_stonedrv2] C:\WINDOWS\system32\_mzu_stonedrv2.exe
O20 - Winlogon Notify: xartcd5 - xartcd5.dll (file missing)
O21 - SSODL: SysRun - {D7FFD784-5276-42D1-887B-00267870A4C7} - C:\WINDOWS\system32\svshost.dll

then

upload C:\avenger\backup.zip to spykiller

then

Download AlcanShorty_en.exe
to your desktop

double click the alcanShorty.exe file and follow prompts. It will make a folder on desktop called Alcan Shorty
Open the folder & double click the run.bat

This will download a file called BFU.exe and a BFU script. If your firewall asks for permission to connect then allow it

a message box will pop up saying complete. Press OK 
Then BFU.exe will open.

select the option to show log at completion

Execute the script by clicking the Execute button.
Note that you should see a progress bar while the script is being executed.

_If you have any questions about the use of BFU please read here:
http://metallica.geekstogo.com/BFUinstructions.html _

when the script has finished press copy & that will make a copy of the report in your clipboard. paste that log back here

along with a new HJT log please


----------



## fliime (Dec 11, 2003)

Derek

I am typing this from my laptop. I am finding it very difficult to log into my sister's cpu as it is always rebooting while the settings are being loaded (desktop icons). I went into safe mode and checked and fixed the items you mentioned to do so via HJT. But it is still rebooting. I have been attempting now for the last 2 hours, is there a way around this?

Thanks


----------



## fliime (Dec 11, 2003)

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\moggdrqh

*******************

Script file located at: \??\C:\Program Files\uevddgso.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\SYSTEM32\algs5.exe deleted successfully.
File C:\WINDOWS\SYSTEM32\_mzu_stonedrv2.exe deleted successfully.


File C:\WINDOWS\system32\winsvcup.exe not found!
Deletion of file C:\WINDOWS\system32\winsvcup.exe failed!

Could not process line:
C:\WINDOWS\system32\winsvcup.exe
Status: 0xc0000034



File C:\WINDOWS\system32\winupsvc.exe not found!
Deletion of file C:\WINDOWS\system32\winupsvc.exe failed!

Could not process line:
C:\WINDOWS\system32\winupsvc.exe
Status: 0xc0000034

File C:\WINDOWS\system.exe deleted successfully.
File C:\WINDOWS\system32\svshost.dll deleted successfully.
File C:\WINDOWS\system32\ntos.exe deleted successfully.


File c:\windows\system32\mdms2.exe not found!
Deletion of file c:\windows\system32\mdms2.exe failed!

Could not process line:
c:\windows\system32\mdms2.exe
Status: 0xc0000034

Folder C:\Program Files\Common Files\{4065618A-0510-1033-0327-010923990001} deleted successfully.

Completed script processing.

*******************

Finished! Terminate.//////////////////////////////////////////


Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\moggdrqh

*******************

Script file located at: \??\C:\Program Files\uevddgso.txt

Script file not found! Error

Could not open script file! Status: 0xc0000034 Abort!


----------



## fliime (Dec 11, 2003)

Derek I apologize, this log is 2nd run log after I forgot to check "SHOW LOG" after the first run. So I guess the log is very inaccurate. My apologies.
Here is the 2nd log anyway.

Just made a donation to your "Hedgehog Rescue Fund"
Your time and assistance is greatly appreciated.
Seems better already,

BFU v1.00.9
Windows XP SP2 (WinNT 5.01.2600 SP2)
Script started at 8:34:12 PM, on 10/11/2006

Option Unload Explorer: Yes
Failed: DllUnregister C:\WINDOWS\DH.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\Deskbar\deskbar.dll|1 (file not found)
Failed: DllUnregister \asappsrv.dll|1 (file not found)
Failed: DllUnregister \MyToolBar.dll (file not found)
Failed: ServiceStop Network Monitor (service not found)
Failed: ServiceStop cmdService (service not found)
Failed: ServiceDisable Network Monitor (service not found)
Failed: ServiceDisable cmdService (service not found)
Failed: ServiceDelete Network Monitor (service not found)
Failed: ServiceDelete cmdService (service not found)
Failed: RegDelValue HKCU\System\CurrentControlSet\Control\Lsa|p2pnetwork (key not found)
Failed: RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Associations|LowRiskFileTypes (key not found)
Failed: RegDelValue HKCU\Microsoft\Windows\CurrentVersion\policies\Explorer\Run|WinUpdate.exe (key not found)
Failed: RegDelValue HKCU\software\microsoft\windows\currentversion\policies\explorer\run|{84c4d3ae-0bb0-1033-0729-050001} (key not found)
Option pause between commands: 300 ms
Option pause between commands: 50 ms
Failed: FolderDelete C:\Program Files\MsConfigs (folder not found)
Failed: FolderDelete C:\Program Files\winupdates (folder not found)
Failed: FolderDelete C:\Program Files\winupdate (folder not found)
Failed: FolderDelete C:\Program Files\winsupdater (folder not found)
Failed: FolderDelete C:\Program Files\MsUpdate (folder not found)
Failed: FolderDelete C:\Program Files\MsMovies (folder not found)
Failed: FolderDelete C:\Program Files\wmplayer (folder not found)
Failed: FolderDelete C:\Program Files\outlook (folder not found)
Failed: FileDelete C:\Program Files\Common Files\Windows\mc-*-*.exe (operation failed)
Failed: FileDelete C:\Program Files\Common Files\Download\mc-*-*.exe (operation failed)
Failed: FileDelete C:\Program Files\common files\{*-*-1033-*-*}\update.exe (operation failed)
Failed: FileDelete C:\Program Files\common files\{*-*-1033-*-*}\services.dll (operation failed)
Failed: FileDelete C:\Program Files\common files\{*-*-1033-*-*}\activate.exe (operation failed)
Failed: FileDelete C:\Program Files\common files\{*-*-1033-*-*}\MyToolBar.dll (operation failed)
Failed: FileDelete C:\Program Files\common files\{*-*-2057-*-*}\update.exe (operation failed)
Failed: FileDelete C:\Program Files\common files\{*-*-2057-*-*}\services.dll (operation failed)
Failed: FileDelete C:\Program Files\common files\{*-*-2057-*-*}\activate.exe (operation failed)
Failed: FileDelete C:\Program Files\common files\{*-*-2057-*-*}\MyToolBar.dll (operation failed)
Failed: FolderDelete C:\Program Files\toolbar888 (folder not found)
Failed: FolderDelete C:\Program Files\e-mailpaysu toolbar (folder not found)
Failed: FolderDelete C:\Program Files\EMUSIC TOOLBAR (folder not found)
Failed: FolderDelete C:\Program Files\find dvd toolbar (folder not found)
Failed: FolderDelete C:\Program Files\GULESIDER VERKTøYLINJE (folder not found)
Failed: FolderDelete C:\Program Files\sesam-p4 toolbar (folder not found)
Failed: FolderDelete C:\Program Files\slownik ling (folder not found)
Failed: FolderDelete C:\Program Files\MediaPipe (folder not found)
Failed: FolderDelete C:\Program Files\p2pnetworks (folder not found)
Failed: FileDelete C:\DOCUME~1\Marisa\LOCALS~1\Temp\~DFA512.tmp (operation failed)
Failed: FileDelete C:\DOCUME~1\Marisa\LOCALS~1\Temp\~DFF630.tmp (operation failed)
Failed: FolderDelete C:\Program Files\Maxifiles (folder not found)
Failed: FolderDelete C:\Program Files\DNS (folder not found)
Failed: FolderDelete C:\Program Files\EQAdvice (folder not found)
Failed: FolderDelete C:\Program Files\FCAdvice (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\FreeProd1 (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\FreeProd2 (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\InetGet (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\InetGet2 (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\svchostsys (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\simtest (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\misc001 (folder not found)
Failed: FolderDelete C:\Program Files\InetGet2 (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\VCClient (folder not found)
Failed: FolderDelete C:\Program Files\Network Monitor (folder not found)
Failed: FolderDelete C:\WINDOWS\inet20001 (folder not found)
Failed: FolderDelete C:\Program Files\Update06 (folder not found)
Failed: FolderDelete C:\Program Files\Update03 (folder not found)
Failed: FolderDelete C:\Program Files\Update04 (folder not found)
Failed: FolderDelete C:\Program Files\Update08 (folder not found)
Failed: FolderDelete C:\Program Files\W-Update (folder not found)
Failed: FolderDelete C:\Program Files\Yazzle Sudoku (folder not found)
Failed: FolderDelete C:\Program Files\Cas (folder not found)
Failed: FolderDelete C:\Program Files\CasStub (folder not found)
Failed: FolderDelete C:\Program Files\Cas2Stub (folder not found)
Failed: FolderDelete C:\Program Files\ipwins (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\Snowball Wars (folder not found)
Failed: FolderDelete C:\temp (folder not found)
Failed: FolderDelete C:\WINDOWS\mdrive (folder not found)
Failed: FolderDelete C:\WINDOWS\system32\crunner (folder not found)
Failed: FolderDelete C:\Program Files\PECarlin (folder not found)
Failed: FolderDelete C:\Program Files\AXVenore (folder not found)
Failed: FolderDelete C:\Program Files\SDVita (folder not found)
Failed: FolderDelete C:\Program Files\EQBranch (folder not found)
Failed: FolderDelete C:\Program Files\EQArticle (folder not found)
Failed: FolderDelete C:\Program Files\PSHope (folder not found)
Failed: FolderDelete C:\Program Files\Batty (folder not found)
Failed: FolderDelete C:\Program Files\Batty2 (folder not found)
Failed: FolderDelete C:\Program Files\AXFibula (folder not found)
Failed: FolderDelete C:\Program Files\CMFibula (folder not found)
Failed: FolderDelete C:\Program Files\PSLister (folder not found)
Failed: FolderDelete C:\Program Files\PSCloner (folder not found)
Failed: FolderDelete C:\Program Files\cmapp (folder not found)
Failed: FolderDelete C:\Program Files\cmman (folder not found)
Failed: FolderDelete C:\Program Files\cmsystem (folder not found)
Failed: FolderDelete C:\Program Files\fcengine (folder not found)
Failed: FolderDelete C:\Program Files\wincmapp (folder not found)
Failed: FolderDelete C:\Program Files\Deskbar\Cache (folder not found)
Failed: FolderDelete C:\Program Files\popupwithcast (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\cloader (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\misc001 (folder not found)
Failed: FolderCreate C:\bintheredunthat (folder already exists)
Failed: FileMove C:\WINDOWS\win*-*.exe|C:\bintheredunthat (source file not found)
Script completed.

HTJ log

Logfile of HijackThis v1.99.1
Scan saved at 8:47:31 PM, on 10/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Marisa\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Sympatico
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe


----------



## fliime (Dec 11, 2003)

Derek, 

here is a kaspersky report after I followed your instructions.
Thanks for your help Sir!
Wednesday, October 11, 2006 11:28:56 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 12/10/2006
Kaspersky Anti-Virus database records: 217581


Scan Settings 
Scan using the following antivirus database standard 
Scan Archives true 
Scan Mail Bases true 

Scan Target My Computer 
A:\
C:\
D:\
E:\
F:\ 

Scan Statistics 
Total number of scanned objects 29014 
Number of viruses found 10 
Number of infected objects 39 / 0 
Number of suspicious objects 2 
Duration of the scan process 01:07:27 

Infected Object Name Virus Name Last Action 
C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped 

C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped 

C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped 

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped 

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped 

C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Data\settings.dat Object is locked skipped 

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped 

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped 

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped 

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped 

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped 

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped 

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped 

C:\Documents and Settings\Marisa\Cookies\index.dat Object is locked skipped 

C:\Documents and Settings\Marisa\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped 

C:\Documents and Settings\Marisa\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped 

C:\Documents and Settings\Marisa\Local Settings\History\History.IE5\index.dat Object is locked skipped 

C:\Documents and Settings\Marisa\Local Settings\Temp\Perflib_Perfdata_8c0.dat Object is locked skipped 

C:\Documents and Settings\Marisa\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped 

C:\Documents and Settings\Marisa\NTUSER.DAT Object is locked skipped 

C:\Documents and Settings\Marisa\NTUSER.DAT.LOG Object is locked skipped 

C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped 

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped 

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped 

C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped 

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped 

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped 

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped 

C:\Program Files\Webroot\Spy Sweeper\Masters\masters.bak Object is locked skipped 

C:\Program Files\Webroot\Spy Sweeper\Masters\Masters.const Object is locked skipped 

C:\Program Files\Webroot\Spy Sweeper\Masters\masters.mst Object is locked skipped 

C:\Program Files\Webroot\Spy Sweeper\Masters.base Object is locked skipped 

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP294\A0037862.exe/data.rar/dev.exe Infected: Backdoor.Win32.VanBot.s skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP294\A0037862.exe/data.rar/server2.exe Infected: Trojan-Dropper.Win32.Agent.mf skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP294\A0037862.exe/data.rar Infected: Trojan-Dropper.Win32.Agent.mf skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP294\A0037862.exe RarSFX: infected - 3 skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP294\A0037958.exe Infected: Trojan-Clicker.Win32.Costrat.k skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP296\A0040418.exe/data.rar/dev.exe Infected: Backdoor.Win32.VanBot.s skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP296\A0040418.exe/data.rar/server2.exe Infected: Trojan-Dropper.Win32.Agent.mf skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP296\A0040418.exe/data.rar Infected: Trojan-Dropper.Win32.Agent.mf skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP296\A0040418.exe RarSFX: infected - 3 skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP296\A0040551.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP296\A0041563.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP296\A0041572.exe Infected: Trojan-Proxy.Win32.Small.bo skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP296\A0041573.sys Infected: Trojan-Proxy.Win32.Small.bo skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP296\A0041580.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP296\A0041643.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP296\A0041652.exe Infected: Trojan-Proxy.Win32.Small.bo skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP296\A0041653.sys Infected: Trojan-Proxy.Win32.Small.bo skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP296\A0041665.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP296\A0041673.exe Infected: Trojan-Proxy.Win32.Small.bo skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP296\A0041674.sys Infected: Trojan-Proxy.Win32.Small.bo skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP296\A0041675.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP297\A0041742.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP297\A0041749.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP298\A0042666.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP298\A0042677.exe Infected: Trojan-Proxy.Win32.Small.bo skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP298\A0042682.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP298\A0042695.sys Infected: Trojan-Proxy.Win32.Small.bo skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP298\A0042715.exe Infected: Trojan-Proxy.Win32.Small.bo skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP298\A0042716.sys Infected: Trojan-Proxy.Win32.Small.bo skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP298\A0043708.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP302\A0044322.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046937.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046940.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046941.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046943.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046944.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046945.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046946.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046947.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046948.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046949.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046950.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046951.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046952.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046953.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046954.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046955.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046956.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046957.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046958.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046959.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046960.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046961.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046962.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046963.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046964.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046965.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046966.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046967.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046968.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046969.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046970.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046971.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046972.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046973.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046974.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046975.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046976.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046977.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046978.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046979.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046980.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046981.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046982.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046983.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046984.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046985.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046986.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046987.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046988.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046989.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046990.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046991.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046992.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046993.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046994.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046995.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046996.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046997.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046998.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0046999.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047000.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047001.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047002.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047003.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047004.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047005.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047006.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047007.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047008.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047009.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047010.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047011.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047012.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047013.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047014.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047015.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047016.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047017.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047018.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047019.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047020.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047021.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047022.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047023.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047024.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047025.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047026.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047027.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047028.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047029.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047030.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047031.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047032.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047033.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047034.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047035.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047036.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047037.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047038.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047039.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047040.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047041.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047042.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047044.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047045.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047046.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047047.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047048.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047049.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047064.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047066.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047073.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047137.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047138.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047139.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047140.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047141.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047142.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047157.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048716.exe Infected: Trojan-Proxy.Win32.Small.bo skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048717.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048718.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048719.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048720.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048723.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048724.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048725.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048726.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048727.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048728.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048729.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048730.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048731.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048732.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048733.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048734.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048735.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048736.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048737.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048738.exe Object is locked skipped


----------



## fliime (Dec 11, 2003)

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048739.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048740.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048741.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048742.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048743.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048744.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048745.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048747.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048748.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048749.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048750.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048751.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048754.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048755.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048756.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048757.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048758.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048759.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048760.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048761.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048762.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048763.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048764.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048765.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048766.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048767.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048768.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048769.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048770.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048771.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048772.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048774.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048775.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048778.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048779.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048780.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048781.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048782.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048783.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048784.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048785.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048786.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048787.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048788.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048789.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048790.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048791.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048792.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048793.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048794.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048795.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048796.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048797.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048798.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048799.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048800.EXE Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048801.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048802.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048804.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048805.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048806.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048807.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048808.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048809.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048810.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048811.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048812.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048813.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048815.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048816.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048817.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048818.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048819.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048820.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048821.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048822.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048823.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048824.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048825.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048826.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048827.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048828.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048829.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048831.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048832.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048833.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048834.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048835.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048836.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048837.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048838.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048840.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048841.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048842.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048843.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048844.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048845.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048847.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0048848.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0098016.exe Object is locked skipped 

C:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\change.log Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB896423\update\arpidfix.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB896423\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB896424\update\arpidfix.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB896424\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB896428\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB896688\update\arpidfix.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB896688\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB898461\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB899587\update\arpidfix.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB899587\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB899589\update\arpidfix.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB899589\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB899591\update\arpidfix.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB899591\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB900485\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB900725\update\arpidfix.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB900725\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB901017\update\arpidfix.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB901017\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB901214\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB902400\update\arpidfix.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB902400\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB904706\update\arpidfix.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB904706\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB905414\update\arpidfix.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB905414\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB905749\update\arpidfix.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB905749\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB905915\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB908519\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB908531\SP2QFE\verclsid.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB908531\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB910437\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB911562\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB911567\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB911927\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB912812\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB912919\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB913446\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB913580\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB914389\update\update.exe Object is locked skipped 

C:\WINDOWS\$hf_mig$\KB920683\update\update.exe Object is locked skipped 

C:\WINDOWS\$NtUninstallKB887472$\spuninst\spuninst.exe Object is locked skipped 

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped 

C:\WINDOWS\SchedLgU.Txt Object is locked skipped 

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped 

C:\WINDOWS\Sti_Trace.log Object is locked skipped 

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped 

C:\WINDOWS\system32\config\default Object is locked skipped 

C:\WINDOWS\system32\config\default.LOG Object is locked skipped 

C:\WINDOWS\system32\config\SAM Object is locked skipped 

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped 

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped 

C:\WINDOWS\system32\config\SECURITY Object is locked skipped 

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped 

C:\WINDOWS\system32\config\software Object is locked skipped 

C:\WINDOWS\system32\config\software.LOG Object is locked skipped 

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped 

C:\WINDOWS\system32\config\system Object is locked skipped 

C:\WINDOWS\system32\config\system.LOG Object is locked skipped 

C:\WINDOWS\system32\h323log.txt Object is locked skipped 

C:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log Object is locked skipped 

C:\WINDOWS\system32\MZU_DRV.sys Infected: Trojan-Proxy.Win32.Small.bo skipped 

C:\WINDOWS\system32\spool\PRINTERS\FP00000.SPL Object is locked skipped 

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped 

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped 

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped 

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped 

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped 

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped 

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped 

C:\WINDOWS\wiadebug.log Object is locked skipped 

C:\WINDOWS\wiaservc.log Object is locked skipped 

C:\WINDOWS\WindowsUpdate.log Object is locked skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\MSN\MSNCoreFiles\Setup\msnunin.exe Object is locked skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Norton AntiVirus\Quarantine\060E31C5.cla Infected: Exploit.Java.ByteVerify skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Norton AntiVirus\Quarantine\5171484F.htm Suspicious: Exploit.HTML.Mht skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Norton AntiVirus\Quarantine\51C935EE.htm Infected: Exploit.HTML.Mht skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Norton AntiVirus\Quarantine\523F1D6C.cla Infected: Exploit.Java.ByteVerify skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Norton AntiVirus\Quarantine\523F1D6C.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Norton AntiVirus\Quarantine\523F1D6C.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Norton AntiVirus\Quarantine\523F1D6C.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Norton AntiVirus\Quarantine\523F1D6C.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Norton AntiVirus\Quarantine\523F1D6C.zip ZIP: infected - 4 skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Norton AntiVirus\Quarantine\523F1D6C.zip CryptFF: infected - 4 skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Norton AntiVirus\Quarantine\527A112C.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Norton AntiVirus\Quarantine\527A112C.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Norton AntiVirus\Quarantine\527A112C.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Norton AntiVirus\Quarantine\527A112C.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Norton AntiVirus\Quarantine\527A112C.zip ZIP: infected - 4 skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Norton AntiVirus\Quarantine\527A112C.zip CryptFF: infected - 4 skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Norton AntiVirus\Quarantine\52B15AEF.htm Suspicious: Exploit.HTML.Mht skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Norton AntiVirus\Quarantine\52B404EB.htm Infected: Exploit.HTML.Mht skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Norton AntiVirus\Quarantine\52BB58E4.cla Infected: Exploit.Java.ByteVerify skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Norton AntiVirus\Quarantine\68A87158.cla Infected: Trojan.Java.ClassLoader.Dummy.d skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Windows Media Player\dlimport.exe Object is locked skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Windows Media Player\wmlaunch.exe Object is locked skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Windows Media Player\wmpenc.exe Object is locked skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Windows Media Player\wmsetsdk.exe Object is locked skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Windows NT\hypertrm.exe Object is locked skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\WinRAR\Rar.exe Object is locked skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\WinRAR\Uninstall.exe Object is locked skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\WinRAR\UnRAR.exe Object is locked skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\WinRAR\WinRAR.exe Object is locked skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\WinZip\WINZIP32.EXE Object is locked skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\WinZip\WZQKPICK.EXE Object is locked skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\WinZip\WZSEPE32.EXE Object is locked skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Yahoo!\Messenger\UNWISE.EXE Object is locked skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Yahoo!\Messenger\Ymsgr_tray.exe Object is locked skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Yahoo!\Messenger\YPager.exe Object is locked skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Yahoo!\Messenger\YServer.exe Object is locked skipped 

D:\RECYCLER\S-1-5-21-1177238915-1677128483-854245398-1003\Dd1\Yahoo!\Messenger\yupdater.exe Object is locked skipped 

D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped 

D:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047215.exe Object is locked skipped 

D:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047216.exe Object is locked skipped 

D:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\A0047217.exe Object is locked skipped 

D:\System Volume Information\_restore{6DA18811-4F5D-45FF-BED4-08BD989593CF}\RP313\change.log Object is locked skipped 

Scan process completed.


----------



## dvk01 (Dec 14, 2002)

well Kaspersky has found one more to fix

Copy *all the text* contained in the quote box below to your Clipboard by highlighting it and pressing (*Ctrl+C*):



> Files to delete:
> C:\WINDOWS\system32\MZU_DRV.sys


_*
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.*_

3. Now, *start The Avenger program* by clicking on its icon on your desktop.
 Under "*Script file to execute*" choose "*Input Script Manually*".
Now click on the *Magnifying Glass icon* which will open a new window titled "*View/edit script*" 
 Paste the text copied to clipboard into this window by pressing (*Ctrl+V*).
 Click *Done* 
 Now click on the *Green Light* to begin execution of the script 
 Answer "*Yes*" twice when prompted.
4. *The Avenger will automatically do the following*:
It will *Restart your computer*. ( In cases where the code to execute contains "*Drivers to Unload*", The Avenger will actually *restart your system twice.*) 
On reboot, it will briefly *open a black command window* on your desktop, this is normal.
After the restart, it *creates a log file* that should open with the results of Avenger's actions. This log file will be located at *C:\avenger.txt*
 The Avenger will also have *backed up all the files, etc., that you asked it to delete*, and will have zipped them and moved the zip archives to *C:\avenger\backup.zip*.
5. Please *copy/paste* the content of *c:\avenger.txt* into your reply.

then

Turn off system restore by following instructions here 
http://www.thespykiller.co.uk/forum/index.php?page=8
That will purge the restore folder and clear any malware that has been put in there. Then reboot & then re-enable sytem restore & create a new restore point.


----------



## dvk01 (Dec 14, 2002)

in view of the problems we have had in deleting & getting copies of soem of the files I would like you to do this please to check for other files

Download  Combofix to your desktop:

* Double-click combofix.exe & follow the prompts.
* When finished, it shall produce a log for you. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

&

download filesearch.bat to your desktop from http://www.thespykiller.co.uk/forum/index.php?action=tpmod;dl=item11

double click it and it will make a list of ALL files and folders in both C:\windows & c:\windows\system32 and a list of all folders in C:\program files so we can plough through them and spot anything dodgy, hopefully

it will only pop up for a quick flash

a file search.txt should pop up, save it to desktop as it makes it easier to find 
If it doesn't pop up then a copy will be in C:\filesearch.txt

It will be too big to upload here so go to http://www.thespykiller.co.uk/forum/index.php?board=1.0 and upload there
Just press new topic, fill in the needed details and just give a link to your post here & then press the browse button and then navigate to & select the file on your computer, when the file is listed in the windows press send to upload the files


----------



## fliime (Dec 11, 2003)

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\wlqvrbhm

*******************

Script file located at: \??\C:\WINDOWS\qxjeyamk.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32\MZU_DRV.sys deleted successfully.

Completed script processing.

*******************

Finished! Terminate.


Derek, now I am turning off system restore and will download Combofix now.

thanks


----------



## fliime (Dec 11, 2003)

Marisa - 06-10-12 6:34:43.91 Service Pack 2
ComboFix 06.10.12 - Running from: "C:\Documents and Settings\Marisa\Desktop"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Program Files\Common Files\{3065618A-0510-1033-0327-010923990001}

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\Documents and Settings\Marisa\Application Data\WNSXS~1

((((((((((((((((((((((((((((((( Files Created from 2006-09-12 to 2006-10-12 ))))))))))))))))))))))))))))))))))

2006-10-11	15:59	3,968	--a------	C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-10-11	13:08	778,656	--a------	C:\WINDOWS\system32\drivers\avg7core.sys
2006-10-11	13:08	4,992	--a------	C:\WINDOWS\system32\drivers\avgtdi.sys
2006-10-11	13:08	4,288	--a------	C:\WINDOWS\system32\drivers\avg7rsw.sys
2006-10-11	13:08	27,904	--a------	C:\WINDOWS\system32\drivers\avg7rsxp.sys
2006-10-11	13:08	23,104	--a------	C:\WINDOWS\system32\drivers\avgmfrs.sys
2006-10-11	11:51	90,112	--a------	C:\WINDOWS\system32\RegDACL.exe
2006-10-11	11:51	7,483	--a------	C:\clean.bat
2006-10-11	11:51	40,960	--a------	C:\WINDOWS\system32\swsc.exe
2006-10-11	11:51	4,096	--a------	C:\WINDOWS\system32\reboot.exe
2006-10-11	11:51	38,400	--a------	C:\WINDOWS\system32\moveex.exe
2006-10-08	09:43	71,370	--a------	C:\WINDOWS\system32\lzx32.sys
2006-10-05	17:10	2	--a------	C:\WINDOWS\system32\wnstssv.exe
2006-10-02	00:42	76,560	--a------	C:\WINDOWS\system32\drivers\tmcomm.sys

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

*Rootkit driver pe386 is present. A rootkit scan is required*

2006-10-12 06:35	--------	d--------	C:\Program Files\Common Files
2006-10-11 23:50	--------	d--------	C:\Program Files\HaxFix
2006-10-11 23:49	--------	d--h-----	C:\Program Files\InstallShield Installation Information
2006-10-11 15:58	--------	d--------	C:\Program Files\Grisoft
2006-10-11 13:08	--------	d--------	C:\Documents and Settings\Marisa\Application Data\AVG7
2006-10-11 13:07	--------	d---s----	C:\Documents and Settings\Marisa\Application Data\Microsoft
2006-10-11 12:41	--------	d--------	C:\Program Files\WinRAR
2006-10-11 12:29	--------	d--------	C:\Program Files\Internet Explorer
2006-10-11 02:41	--------	d--------	C:\Program Files\InterMute
2006-10-11 02:34	--------	d--------	C:\Documents and Settings\Marisa\Application Data\MSNInstaller
2006-10-11 02:33	--------	d--------	C:\Program Files\CCleaner
2006-10-11 02:31	--------	d--------	C:\Program Files\SpywareBlaster
2006-10-11 01:12	--------	d--------	C:\Program Files\CyberLink DVD Solution
2006-10-10 22:47	--------	d--------	C:\Program Files\CleanUp!
2006-10-10 20:32	--------	d--------	C:\Documents and Settings\Marisa\Application Data\Macromedia
2006-10-10 20:15	--------	d--------	C:\Program Files\Common Files\Adobe
2006-10-10 20:15	--------	d--------	C:\Program Files\Adobe
2006-10-10 20:15	--------	d--------	C:\Documents and Settings\Marisa\Application Data\Adobe
2006-10-10 17:57	--------	d--------	C:\Program Files\Zone Labs
2006-10-02 10:45	--------	d--------	C:\Program Files\Common Files\Microsoft Shared
2006-10-02 10:25	--------	d--------	C:\Documents and Settings\Marisa\Application Data\Lavasoft
2006-10-02 10:24	--------	d--------	C:\Program Files\Lavasoft
2006-09-03 16:16	--------	d--------	C:\Documents and Settings\Marisa\Application Data\Google
2006-08-27 17:16	22768	--a------	C:\WINDOWS\system32\drivers\usbsermpt.sys
2006-08-20 11:27	--------	d--------	C:\Documents and Settings\Marisa\Application Data\Azureus
2006-08-17 00:44	--------	d--------	C:\Documents and Settings\Marisa\Application Data\dvdcss
2006-08-17 00:40	--------	d--------	C:\Documents and Settings\Marisa\Application Data\CyberLink
2006-08-12 16:00	--------	d--------	C:\Documents and Settings\Marisa\Application Data\Corel Photo Album
2006-08-12 15:47	88	-r-hs----	C:\WINDOWS\system32\635CD359A9.sys
2006-08-12 15:47	3766	--ahs----	C:\WINDOWS\system32\KGyGaAvL.sys
2006-08-12 15:45	--------	d--------	C:\Program Files\Common Files\InstallShield

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,e6,00,00,00,00,00,00,00,9a,03,00,00,3e,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
"location"="Common Startup"
"command"="C:\\PROGRA~1\\COMMON~1\\Adobe\\CALIBR~1\\ADOBEG~1.EXE "
"item"="Adobe Gamma Loader"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=dword:00000002
"wscsvc"=dword:00000002

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll

Completion time: 06-10-12 6:35:50.18 
ComboFix.txt


----------



## dvk01 (Dec 14, 2002)

well that shows a nasty rootkit that will be hiding lots more junk

you might want to consider that the safest bet will be format & reinstall but we can have a go at removing it

first stage

Please download *SmitfraudFix* (by *S!Ri*)
Extract the content (a folder named *SmitfraudFix*) to your Desktop.

Open the *SmitfraudFix* folder and double-click *smitfraudfix.cmd*
Select option #1 - *Search* by typing *1* and press "*Enter*"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

*Note* : *process.exe* is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

the Engish Tutorial


----------



## fliime (Dec 11, 2003)

I am away from her cpu for a few days, I'll let you know of the results Derek

thanks


----------



## dvk01 (Dec 14, 2002)

Don't let her use it on the net until we get it clean


----------

