22 replies to this topic

[jlabram]

I receive the following error message when I close a number of applications, seemingly unrelated: for example, iexplor.exe - Application Error The instruction at "0x0372f020" referenced memory at "0x00000ba0". The memory could not be "read". Click on OK to terminate the program. I get it with OSE.exe, iexplore.exe, ybrowser.exe, tntmpd.exe (a business application) and others. The funny thing is that the referenced memory is always the same no matter the application that is hung up upon termination. This is causing other problems too. I called Microsoft and they had me put in the XP CD and run a SFC /Scannow command but that didn't help at all. Any help on this issue? P.S. Here's the header for running HijackThis. Logfile of HijackThis v1.99.1 Scan saved at 9:42:42 PM, on 5/13/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Thanks, Jlabram

[Siggyx]

Download hijackthis to its own folder C:/HJT for example. Extrat the zip file to that folder. Then close all browser windows, open hijackthis and click on scan. Once the scan has completed click on Save Log, this will produce a text file log. Highlight all of the information from in that text box then right click and copy. Come back to this post you made and click on "add reply" at the bottom right and a new window will open. Paste the hijackthis log into the new window hit add reply in that new window.

HJT download >>> http://www.softpedia.../10-17-69.shtml

[jlabram]

Here's the hijackthis log...Thanks for any help you can give me!


Logfile of HijackThis v1.99.1
Scan saved at 10:30:47 PM, on 5/13/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\bmwebcfg.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\Program Files\Sprint\Sprint PCS Connection Manager\CMSPCSUtilSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\2Wire\2PortalMon.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\InetCntrl\InetCntrl.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Logitech\ImageStudio\LogiTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\AIM95\aim.exe
C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe
C:\Program Files\Webshots\webshots.scr
C:\PROGRA~1\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Common Files\AOL\1128900178\ee\AOLHostManager.exe
C:\Program Files\Common Files\AOL\1128900178\ee\AOLServiceHost.exe
C:\Program Files\Common Files\AOL\1128900178\ee\AOLServiceHost.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Norton SystemWorks\Norton CleanSweep\QDCSFS.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Canon\MultiPASS4\MPDBMgr.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Messenger\msmsgs.exe
C:\DOCUME~1\Jeff\LOCALS~1\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapp...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapp.../search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapp...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://dsl.sbc.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapp...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: (no name) - {029CA12C-89C1-46a7-A3C7-82F2F98635CB} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\RealBar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O2 - BHO: PopBlockBHO Class - {E0019445-4C1F-414D-A70E-AD80F231C584} - C:\WINDOWS\system32\InetCntrl\PopupKil\BsafeBHO.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [2wSysTray] C:\Program Files\2Wire\2PortalMon.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [InetCntrl] C:\WINDOWS\system32\InetCntrl\InetCntrl.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [YPC] C:\PROGRA~1\Yahoo!\Parental Controls\ypc.exe
O4 - HKLM\..\Run: [QD FastAndSafe] C:\Program Files\Norton SystemWorks\Norton CleanSweep\QDCSFS.exe /scheduler
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Norton GoBack.lnk = C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll/search.htm
O8 - Extra context menu item: &Search - http://bar.mywebsear...ZBzeb032YYUS_ZS
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/229?7629b4afbae54351bbd01d89e19242
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/230?7629b4afbae54351bbd01d89e19242
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: SBC Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'inetcntrl.dll' missing
O16 - DPF: symsupportutil - http://www.symantec....supportutil.CAB
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - https://www-secure.s...trl/tgctlsi.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - https://www-secure.s...trl/tgctlsr.cab
O16 - DPF: {02BED220-FBC7-4392-93A2-3A50B056F78E} - http://down.plaxo.co...ease/instub.cab
O16 - DPF: {10093E98-C073-4C75-8D0E-FB5CD3A71D33} - http://messenger.zon...ds.cab27571.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.s...rl/LSSupCtl.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.micr...ActiveX/odc.cab
O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} - http://install.wildt...iveLauncher.cab
O16 - DPF: {4E7BD74F-2B8D-469E-DEFA-EB76B1D5FA7D} - http://musicoffaith....MOF-toolbar.cab
O16 - DPF: {65E7DB1D-0101-4100-BD66-C5C78C917F93} - http://install.wildt...lim/install.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.s...rl/SymAData.cab
O18 - Protocol: x-excid - {9D6CC632-1337-4A33-9214-2DA092E776F4} - c:\WINDOWS\Downloaded Program Files\mimectl.dll
O20 - AppInit_DLLs: wbsys.dll C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bytemobile Web Configurator (bmwebcfg) - Bytemobile, Inc. - C:\WINDOWS\system32\bmwebcfg.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GoBack Polling Service (GBPoll) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intuit Launcher (IntuitLauncher) - Intuit Inc. - C:\Program Files\Intuit\OLlaunch.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Quicken Online Backup RegCap (OLRegCap) - Intuit Inc. - C:\Program Files\Intuit\OLRegCap.EXE
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Sprint PCS v3 Utility Service - Sprint Spectrum, L.L.C - C:\Program Files\Sprint\Sprint PCS Connection Manager\CMSPCSUtilSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\SYSTEM32\YPCSER~1.EXE

[Siggyx]

Not much in that log.

Lets run a few programs and see what they find.

STEP 1.
======
SpySweeper
Please download http://www.webroot.c...ode=af1&rc=3597
(It's a 2 week trial):

• Click the Free Trial link under to "SpySweeper" to download the program.
• Install it.
• Once the program is installed, it will open.
• It will prompt you to update to the latest definitions, click Yes.
• Once the definitions are installed, click Sweep Now on the left side.
• Click the Start button.
• When it's done scanning, click the Next button.
• Make sure everything has a check next to it, then click the Next button.
• It will remove all of the items found.
• Click Session Log in the upper right corner, copy everything in that window.
• Click the Summary tab and click Finish.
• Paste the contents of the session log you copied into your next reply.

STEP 2.
======
Download Ewido

• Download and install Ewido Security Suite It is a free trial version of the program.
• Install ewido security suite
• Launch ewido, there should be an icon on your desktop double-click it.
• The program will now go to the main screen

STEP 3.
======
Update Ewido
You will need to update ewido to the latest definition files.

• On the left hand side of the main screen click update
• Then click on Start Update

The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use Ewido manual updates

STEP 4.
======
Ewido Scan
Once the updates are installed do the following:

• Click on scanner
• Click on Complete System Scan and the scan will begin.
• NOTE: During some scans with ewido it is finding cases of false positives.**
  o You will need to step through the process of cleaning files one-by-one.
  o If ewido detects a file you KNOW to be legitimate, select none as the action.
  o DO NOT select "Perform action on all infections"
  o If you are unsure of any entry found select none for now.
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report
• Click Save report.
• Save the report .txt file to your desktop.

Now close ewido security suite.
**(Ewido for example has been flagging parts of AVG Anti-Virus, pcAnywhere and the game "Risk")


STEP 5.
======
CWShredder

Please download and run CWShredder
Make sure that all browser windows are closed with the exception of Cwshredder and choose FIX.

STEP 6.
======

Please do an onlione scan here http://housecall.trendmicro.com/ and allow it to clean/remove what it finds.


Please post the results from SpySweeper, ewido and a new hijackthis log.

[jlabram]

 XoftSpy_log_051406.doc   218.5KB   50 downloadsHere are the logs. Sorry for the time to get them. I've had a lot of different problems in getting this done. Whenever I click on My Computer or another shortcut off of the Start Menu, it hangs when I click on a folder to go to. One problem at a time... Here's the Ewido Log and the Spy Sweeper log. Also, just a note that I purchased XoftSpy and ran that as well and I'm attaching that log from yesterday morning. Hopefully you can see something. By the way, this problem now has spread to other laptops that I use on my home network. Wow--what a mess. --------------------------------------------------------- ewido anti-malware - Scan report --------------------------------------------------------- + Created on: 8:15:51 PM, 5/14/2006 + Report-Checksum: 7E6E307B + Scan result: C:\RECYCLER\NPROTECT\00261232. -> TrackingCookie.Com : Ignored C:\Documents and Settings\Bryan\Cookies\bryan@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : Cleaned with backup C:\Documents and Settings\Bryan\Cookies\bryan@ads.realcastmedia[2].txt -> TrackingCookie.Realcastmedia : Cleaned with backup C:\Documents and Settings\Bryan\Cookies\bryan@com[1].txt -> TrackingCookie.Com : Cleaned with backup C:\Documents and Settings\Bryan\Cookies\bryan@login.tracking101[1].txt -> TrackingCookie.Tracking101 : Cleaned with backup C:\Documents and Settings\Bryan\Cookies\bryan@www.realcastmedia[2].txt -> TrackingCookie.Realcastmedia : Cleaned with backup C:\Documents and Settings\Erin\Cookies\erin@com[2].txt -> TrackingCookie.Com : Cleaned with backup C:\Documents and Settings\Jaclyn\Cookies\jaclyn@com[2].txt -> TrackingCookie.Com : Cleaned with backup C:\Documents and Settings\Jeff\Cookies\jeff@com[1].txt -> TrackingCookie.Com : Cleaned with backup C:\RECYCLER\NPROTECT\00311145. -> TrackingCookie.Ru4 : Cleaned with backup C:\RECYCLER\NPROTECT\00311152. -> TrackingCookie.Ru4 : Cleaned with backup C:\RECYCLER\NPROTECT\00426455. -> TrackingCookie.Falkag : Cleaned with backup C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP1522\A0352166.exe -> Not-A-Virus.Monitor.Win32.Perflogger.ad : Cleaned with backup C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP1522\A0352167.dll -> Not-A-Virus.Monitor.Win32.Perflogger.al : Cleaned with backup C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP1522\A0352168.dll -> Logger.Peflog.30 : Cleaned with backup C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP1522\A0352169.exe -> Logger.Perfloger.l : Cleaned with backup C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP1522\A0352170.exe -> Not-A-Virus.Monitor.Win32.Perflogger.an : Cleaned with backup C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP1522\A0352171.exe -> Not-A-Virus.Monitor.Win32.Perflogger.aq : Cleaned with backup C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP1576\A0479383.dll -> Adware.Sidesearch : Cleaned with backup C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP1577\A0479481.exe -> Not-A-Virus.Downloader.Win32.DigStream.a : Cleaned with backup ::Report End ******** 9:47 AM: | Start of Session, Sunday, May 14, 2006 | 9:47 AM: Spy Sweeper started 9:47 AM: Sweep initiated using definitions version 677 9:47 AM: Starting Memory Sweep 9:53 AM: Memory Sweep Complete, Elapsed Time: 00:06:32 9:53 AM: Starting Registry Sweep 9:53 AM: Found Adware: deskad 9:53 AM: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/deskadx.dll\ (2 subtraces) (ID = 124926) 9:53 AM: HKLM\software\deskad service\ (8 subtraces) (ID = 124927) 9:53 AM: Found System Monitor: stealth webpage recorder 9:53 AM: HKLM\software\blazing tools\ (ID = 142923) 9:53 AM: Found System Monitor: netnanny chat monitor 9:53 AM: HKCR\appid\nnsvc.exe\ (1 subtraces) (ID = 595241) 9:53 AM: HKLM\software\nns\ (3 subtraces) (ID = 595256) 9:53 AM: HKLM\software\nns\5\ (2 subtraces) (ID = 595257) 9:53 AM: HKLM\software\nns\5\ || a (ID = 595258) 9:54 AM: Found Adware: ist software 9:54 AM: HKU\WRSS_Profile_S-1-5-21-1294642078-2690133624-1694720459-1010\software\ist\ (1 subtraces) (ID = 129108) 9:54 AM: Found Adware: 180search assistant/zango 9:54 AM: HKU\WRSS_Profile_S-1-5-21-1294642078-2690133624-1694720459-1010\software\zango\ (16 subtraces) (ID = 147919) 9:54 AM: HKU\WRSS_Profile_S-1-5-21-1294642078-2690133624-1694720459-1009\software\ist\ (1 subtraces) (ID = 129108) 9:54 AM: HKU\WRSS_Profile_S-1-5-21-1294642078-2690133624-1694720459-1007\software\ist\ (1 subtraces) (ID = 129108) 9:54 AM: Found System Monitor: perfect keylogger 9:54 AM: HKU\S-1-5-21-1294642078-2690133624-1694720459-1006\software\blazing tools\ (ID = 136699) 9:54 AM: Registry Sweep Complete, Elapsed Time:00:00:41 9:54 AM: Starting Cookie Sweep 9:54 AM: Found Spy Cookie: 2o7.net cookie 9:54 AM: jaclyn@2o7[2].txt (ID = 1957) 9:54 AM: Found Spy Cookie: go.com cookie 9:54 AM: jaclyn@a.disney.go[1].txt (ID = 2729) 9:54 AM: Found Spy Cookie: gorillanation cookie 9:54 AM: jaclyn@ads.gorillanation[1].txt (ID = 2744) 9:54 AM: Found Spy Cookie: ads.techtv.com cookie 9:54 AM: jaclyn@ads.techtv[1].txt (ID = 2129) 9:54 AM: Found Spy Cookie: pricegrabber cookie 9:54 AM: jaclyn@ask2.pricegrabber[1].txt (ID = 3186) 9:54 AM: Found Spy Cookie: ask cookie 9:54 AM: jaclyn@ask[1].txt (ID = 2245) 9:54 AM: Found Spy Cookie: atwola cookie 9:54 AM: jaclyn@atwola[2].txt (ID = 2255) 9:54 AM: Found Spy Cookie: belnk cookie 9:54 AM: jaclyn@belnk[1].txt (ID = 2292) 9:54 AM: Found Spy Cookie: bizrate cookie 9:54 AM: jaclyn@bizrate[2].txt (ID = 2308) 9:54 AM: jaclyn@dist.belnk[2].txt (ID = 2293) 9:54 AM: jaclyn@go[1].txt (ID = 2728) 9:54 AM: jaclyn@pricegrabber[1].txt (ID = 3185) 9:54 AM: jaclyn@psc.disney.go[1].txt (ID = 2729) 9:54 AM: Found Spy Cookie: rightmedia cookie 9:54 AM: jaclyn@rightmedia[1].txt (ID = 3259) 9:54 AM: Found Spy Cookie: rn11 cookie 9:54 AM: jaclyn@rn11[1].txt (ID = 3261) 9:54 AM: Found Spy Cookie: smni cookie 9:54 AM: jaclyn@smni[1].txt (ID = 3389) 9:54 AM: jaclyn@www.ask[1].txt (ID = 2246) 9:54 AM: jaclyn@www.disney.go[1].txt (ID = 2729) 9:54 AM: Found Spy Cookie: myaffiliateprogram.com cookie 9:54 AM: jaclyn@www.myaffiliateprogram[1].txt (ID = 3032) 9:54 AM: Found Spy Cookie: l2m.net cookie 9:54 AM: erin@33673508a.l2m[2].txt (ID = 2914) 9:54 AM: Found Spy Cookie: about cookie 9:54 AM: erin@about[2].txt (ID = 2037) 9:54 AM: Found Spy Cookie: yieldmanager cookie 9:54 AM: erin@ad.yieldmanager[2].txt (ID = 3751) 9:54 AM: Found Spy Cookie: ads.oneplace cookie 9:54 AM: erin@ads.oneplace[1].txt (ID = 2122) 9:54 AM: erin@atwola[2].txt (ID = 2255) 9:54 AM: erin@go[1].txt (ID = 2728) 9:54 AM: erin@l2m[1].txt (ID = 2913) 9:54 AM: erin@movies.go[2].txt (ID = 2729) 9:54 AM: erin@msnportal.112.2o7[1].txt (ID = 1958) 9:54 AM: erin@psc.disney.go[1].txt (ID = 2729) 9:54 AM: erin@www.ask[1].txt (ID = 2246) 9:54 AM: erin@www.disney.go[1].txt (ID = 2729) 9:54 AM: bryan@112.2o7[2].txt (ID = 1958) 9:54 AM: bryan@2o7[1].txt (ID = 1957) 9:54 AM: Found Spy Cookie: 3 cookie 9:54 AM: bryan@3[2].txt (ID = 1959) 9:54 AM: Found Spy Cookie: 5 cookie 9:54 AM: bryan@5[1].txt (ID = 1979) 9:54 AM: Found Spy Cookie: websponsors cookie 9:54 AM: bryan@a.websponsors[2].txt (ID = 3665) 9:54 AM: bryan@abc.go[1].txt (ID = 2729) 9:54 AM: bryan@abcnews.go[2].txt (ID = 2729) 9:54 AM: bryan@about[1].txt (ID = 2037) 9:54 AM: bryan@ad.yieldmanager[2].txt (ID = 3751) 9:54 AM: Found Spy Cookie: adknowledge cookie 9:54 AM: bryan@adknowledge[2].txt (ID = 2072) 9:54 AM: Found Spy Cookie: precisead cookie 9:54 AM: bryan@adopt.precisead[1].txt (ID = 3182) 9:54 AM: Found Spy Cookie: specificclick.com cookie 9:54 AM: bryan@adopt.specificclick[1].txt (ID = 3400) 9:54 AM: Found Spy Cookie: adorigin cookie 9:54 AM: bryan@adorigin[2].txt (ID = 2082) 9:54 AM: Found Spy Cookie: adprofile cookie 9:54 AM: bryan@adprofile[1].txt (ID = 2084) 9:54 AM: bryan@ads.oneplace[1].txt (ID = 2122) 9:54 AM: Found Spy Cookie: anm.co.uk cookie 9:54 AM: bryan@anm.co[2].txt (ID = 2223) 9:54 AM: Found Spy Cookie: aptimus cookie 9:54 AM: bryan@aptimus[1].txt (ID = 2233) 9:54 AM: bryan@ask[1].txt (ID = 2245) 9:54 AM: bryan@ath.belnk[1].txt (ID = 2293) 9:54 AM: bryan@atwola[1].txt (ID = 2255) 9:54 AM: Found Spy Cookie: banner cookie 9:54 AM: bryan@banner[2].txt (ID = 2276) 9:54 AM: bryan@belnk[2].txt (ID = 2292) 9:54 AM: Found Spy Cookie: burstnet cookie 9:54 AM: bryan@burstnet[2].txt (ID = 2336) 9:54 AM: Found Spy Cookie: dealtime cookie 9:54 AM: bryan@dealtime[1].txt (ID = 2505) 9:54 AM: bryan@disney.go[1].txt (ID = 2729) 9:54 AM: bryan@disneyvideos.disney.go[2].txt (ID = 2729) 9:54 AM: bryan@dist.belnk[1].txt (ID = 2293) 9:54 AM: Found Spy Cookie: e.spyspotter cookie 9:54 AM: bryan@e.spyspotter[2].txt (ID = 2553) 9:54 AM: bryan@espn.go[1].txt (ID = 2729) 9:54 AM: bryan@go[1].txt (ID = 2728) 9:54 AM: Found Spy Cookie: homestore cookie 9:54 AM: bryan@homestore[1].txt (ID = 2793) 9:54 AM: Found Spy Cookie: metareward.com cookie 9:54 AM: bryan@metareward[2].txt (ID = 2990) 9:54 AM: bryan@movies.go[1].txt (ID = 2729) 9:54 AM: bryan@msnportal.112.2o7[1].txt (ID = 1958) 9:54 AM: Found Spy Cookie: qsrch cookie 9:54 AM: bryan@newnet.qsrch[2].txt (ID = 3216) 9:54 AM: Found Spy Cookie: nextag cookie 9:54 AM: bryan@nextag[1].txt (ID = 5014) 9:54 AM: bryan@radio.disney.go[1].txt (ID = 2729) 9:54 AM: bryan@rsi.abcnews.go[1].txt (ID = 2729) 9:54 AM: bryan@rsi.espn.go[1].txt (ID = 2729) 9:54 AM: bryan@search.disney.go[1].txt (ID = 2729) 9:54 AM: Found Spy Cookie: sex cookie 9:54 AM: bryan@sex[1].txt (ID = 3347) 9:54 AM: bryan@singleparents.about[1].txt (ID = 2038) 9:54 AM: bryan@sonycorporate.122.2o7[1].txt (ID = 1958) 9:54 AM: bryan@sportingnews.122.2o7[1].txt (ID = 1958) 9:54 AM: bryan@sports.espn.go[1].txt (ID = 2729) 9:54 AM: Found Spy Cookie: tacoda cookie 9:54 AM: bryan@tacoda[2].txt (ID = 6444) 9:54 AM: Found Spy Cookie: web-stat cookie 9:54 AM: bryan@web-stat[1].txt (ID = 3648) 9:54 AM: Found Spy Cookie: burstbeacon cookie 9:54 AM: bryan@www.burstbeacon[1].txt (ID = 2335) 9:54 AM: Found Spy Cookie: xiti cookie 9:54 AM: bryan@xiti[1].txt (ID = 3717) 9:54 AM: bryan@yieldmanager[1].txt (ID = 3749) 9:54 AM: jeff@ask[2].txt (ID = 2245) 9:54 AM: jeff@atwola[1].txt (ID = 2255) 9:54 AM: Found Spy Cookie: clickbank cookie 9:54 AM: jeff@clickbank[1].txt (ID = 2398) 9:54 AM: jeff@www.burstbeacon[1].txt (ID = 2335) 9:54 AM: Cookie Sweep Complete, Elapsed Time: 00:00:07 9:54 AM: Starting File Sweep 9:54 AM: c:\program files\net nanny (2 subtraces) (ID = -2147475693) 9:54 AM: Found Adware: music of faith toolbar 9:54 AM: c:\program files\musicoffaith\toolbar (1 subtraces) (ID = -2147463604) 9:55 AM: Found Adware: xupiter toolbar 9:55 AM: 00247512. (ID = 90959) 9:56 AM: Warning: Failed to open file "c:\recycler\nprotect\00488792.". The system cannot find the file specified 9:56 AM: Warning: Failed to open file "c:\recycler\nprotect\00488794.". The system cannot find the file specified 9:56 AM: Warning: Failed to open file "c:\recycler\nprotect\00488770.". The system cannot find the file specified 9:56 AM: 00247504. (ID = 90959) 9:56 AM: 00247496. (ID = 90959) 9:56 AM: 00247488. (ID = 90959) 9:56 AM: 00247480. (ID = 90959) 9:56 AM: 00247472. (ID = 90959) 9:56 AM: Warning: Failed to open file "c:\recycler\nprotect\00334725.". The system cannot find the file specified 9:56 AM: Warning: Failed to open file "c:\recycler\nprotect\00456199.". The system cannot find the file specified 9:57 AM: 00247464. (ID = 90959) 9:57 AM: 00247681. (ID = 90950) 9:57 AM: 00247448. (ID = 90959) 9:57 AM: 00247456. (ID = 90959) 9:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00308963.". The system cannot find the file specified 9:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00325069.". The system cannot find the file specified 9:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00431916.". The system cannot find the file specified 10:01 AM: Warning: Failed to open file "c:\recycler\nprotect\00494531.". The system cannot find the file specified 10:02 AM: Warning: Failed to open file "c:\recycler\nprotect\00403748.". The system cannot find the file specified 10:03 AM: Warning: Failed to open file "c:\recycler\nprotect\00530755.lnk". Access is denied 10:04 AM: Warning: Failed to open file "c:\recycler\nprotect\00533488.dll". Access is denied 10:09 AM: Warning: Failed to open file "c:\recycler\nprotect\00484122.html". Access is denied 10:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528360.lnk". Access is denied 10:11 AM: Warning: Failed to open file "c:\recycler\nprotect\00533810.exe". Access is denied 10:15 AM: Warning: Failed to open file "c:\recycler\nprotect\00529136.". The system cannot find the file specified 10:18 AM: Warning: Failed to open file "c:\recycler\nprotect\00528064.vxd". Access is denied 10:19 AM: Warning: Failed to open file "c:\recycler\nprotect\00528069.vxd". Access is denied 10:22 AM: Warning: Failed to open file "c:\recycler\nprotect\00530794.exe". Access is denied 10:23 AM: Warning: Failed to open file "c:\recycler\nprotect\00532137.lnk". Access is denied 10:24 AM: Warning: Failed to open file "c:\recycler\nprotect\00431973.". The system cannot find the file specified 10:26 AM: Warning: Failed to open file "c:\recycler\nprotect\00526962.exe". Access is denied 10:28 AM: Warning: Failed to open file "c:\recycler\nprotect\00526980.cat". Access is denied 10:28 AM: Warning: Failed to open file "c:\recycler\nprotect\00526982.cat". Access is denied 10:28 AM: Warning: Failed to open file "c:\recycler\nprotect\00526999.pnf". Access is denied 10:29 AM: Warning: Failed to open file "c:\recycler\nprotect\00526996.sys". Access is denied 10:29 AM: Warning: Failed to open file "c:\recycler\nprotect\00526995.sys". Access is denied 10:31 AM: Warning: Failed to open file "c:\recycler\nprotect\00532138.lnk". Access is denied 10:32 AM: Warning: Failed to open file "c:\recycler\nprotect\00526966.exe". Access is denied 10:35 AM: salmau.dat (ID = 93788) 10:41 AM: Warning: Failed to open file "c:\recycler\nprotect\00528077.cat". Access is denied 10:41 AM: Warning: Failed to open file "c:\recycler\nprotect\00446704.". The system cannot find the file specified 10:41 AM: Warning: Failed to open file "c:\recycler\nprotect\00528091.inf". Access is denied 10:42 AM: Warning: Failed to open file "c:\recycler\nprotect\00526997.cat". Access is denied 10:42 AM: Warning: Failed to open file "c:\recycler\nprotect\00526971.dll". Access is denied 10:42 AM: Warning: Failed to open file "c:\recycler\nprotect\00484199.". The system cannot find the file specified 10:42 AM: Warning: Failed to open file "c:\recycler\nprotect\00484193.". The system cannot find the file specified 10:42 AM: Warning: Failed to open file "c:\recycler\nprotect\00484173.". The system cannot find the file specified 10:42 AM: Warning: Failed to open file "c:\recycler\nprotect\00484170.". The system cannot find the file specified 10:43 AM: Warning: Failed to open file "c:\recycler\nprotect\00484167.". The system cannot find the file specified 10:44 AM: Warning: Failed to open file "c:\recycler\nprotect\00484137.". The system cannot find the file specified 10:44 AM: Warning: Failed to open file "c:\recycler\nprotect\00484140.". The system cannot find the file specified 10:44 AM: Warning: Failed to open file "c:\recycler\nprotect\00484023.". The system cannot find the file specified 10:44 AM: Warning: Failed to open file "c:\recycler\nprotect\00484027.". The system cannot find the file specified 10:44 AM: Warning: Failed to open file "c:\recycler\nprotect\00526839.lnk". Access is denied 10:44 AM: Warning: Failed to open file "c:\recycler\nprotect\00526845.lnk". Access is denied 10:44 AM: Warning: Failed to open file "c:\recycler\nprotect\00530340.lnk". Access is denied 10:45 AM: Warning: Failed to open file "c:\recycler\nprotect\00529684.lnk". Access is denied 10:45 AM: Warning: Failed to open file "c:\recycler\nprotect\00432014.". The system cannot find the file specified 10:47 AM: Warning: Failed to open file "c:\recycler\nprotect\00527423.lnk". Access is denied 10:50 AM: Warning: Failed to open file "c:\recycler\nprotect\00528065.dll". Access is denied 10:53 AM: Warning: Failed to open file "c:\recycler\nprotect\00526955.lnk". Access is denied 10:55 AM: Warning: Failed to open file "c:\recycler\nprotect\00526981.inf". Access is denied 10:55 AM: Warning: Failed to open file "c:\recycler\nprotect\00526953.lnk". Access is denied 10:55 AM: Warning: Failed to open file "c:\recycler\nprotect\00526989.inf". Access is denied 10:55 AM: Warning: Failed to open file "c:\recycler\nprotect\00484038.html". Access is denied 10:56 AM: Warning: Failed to open file "c:\recycler\nprotect\00528068.sys". Access is denied 10:57 AM: Warning: Failed to open file "c:\recycler\nprotect\00527715.exe". Access is denied 10:58 AM: Warning: Failed to open file "c:\recycler\nprotect\00528070.dll". Access is denied 10:58 AM: Warning: Failed to open file "c:\recycler\nprotect\00526988.sys". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00527383.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526923.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526938.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526937.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526926.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526928.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00525868.spc". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00525894.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526228.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526939.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526229.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00525895.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00525896.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00525897.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526819.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526820.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526821.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526822.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526825.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526829.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526830.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526866.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00527358.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00527357.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526872.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526919.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526895.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00527221.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00527222.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00527224.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00527225.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00525906.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526894.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526874.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526876.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00527384.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526890.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526888.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526885.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526881.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526879.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526878.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526877.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00527327.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00527326.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526934.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526935.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526936.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00527121.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00527123.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00527131.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00527120.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00527132.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00527211.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00527212.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00527219.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00527220.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00527945.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00525907.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00525934.spc". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00527320.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00527321.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00527914.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00526868.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00527323.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00528516.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00528515.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00527578.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00532759.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00532758.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00532493.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00532492.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00532486.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00532485.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00533624.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00533623.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00532488.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00532487.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00531066.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00531160.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00531161.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00529854.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00529855.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00531201.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00531202.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00533485.ico". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00532895.spc". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00531265.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00531274.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00531275.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00531276.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00531277.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00531280.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00531282.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00530753.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00531284.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00532472.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00530754.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00531287.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00531288.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00531315.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00484051.html". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00484052.html". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00532479.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00532478.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00532390.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00532434.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00532433.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00533561.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00533560.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00530752.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00530427.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00530428.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00530760.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00530761.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00530322.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00530323.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00530363.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00530364.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00530923.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00530365.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00530366.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00530924.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00530369.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00530371.lnk". Access is denied 10:59 AM: Warning: Failed to open file "c:\recycler\nprotect\00532324.lnk". Access is denied 11:00 AM: Warning: Failed to open file "c:\recycler\nprotect\00484050.html". Access is denied 11:00 AM: Warning: Failed to open file "c:\recycler\nprotect\00532391.lnk". Access is denied 11:00 AM: Warning: Failed to open file "c:\recycler\nprotect\00532404.lnk". Access is denied 11:00 AM: Warning: Failed to open file "c:\recycler\nprotect\00532405.lnk". Access is denied 11:00 AM: Warning: Failed to open file "c:\recycler\nprotect\00484371.". The system cannot find the file specified 11:00 AM: Warning: Failed to open file "c:\recycler\nprotect\00532484.lnk". Access is denied 11:00 AM: Warning: Failed to open file "c:\recycler\nprotect\00532819.lnk". Access is denied 11:00 AM: Warning: Failed to open file "c:\recycler\nprotect\00532491.lnk". Access is denied 11:00 AM: Warning: Failed to open file "c:\recycler\nprotect\00532818.lnk". Access is denied 11:00 AM: Warning: Failed to open file "c:\recycler\nprotect\00532490.lnk". Access is denied 11:00 AM: Warning: Failed to open file "c:\recycler\nprotect\00532418.lnk". Access is denied 11:00 AM: Warning: Failed to open file "c:\recycler\nprotect\00532417.lnk". Access is denied 11:01 AM: Warning: Failed to open file "c:\recycler\nprotect\00530381.lnk". Access is denied 11:01 AM: Warning: Failed to open file "c:\recycler\nprotect\00484054.html". Access is denied 11:01 AM: Warning: Failed to open file "c:\recycler\nprotect\00528078.inf". Access is denied 11:02 AM: Warning: Failed to open file "c:\recycler\nprotect\00484053.html". Access is denied 11:02 AM: Warning: Failed to open file "c:\recycler\nprotect\00484104.html". Access is denied 11:02 AM: Warning: Failed to open file "c:\recycler\nprotect\00527000.sys". Access is denied 11:03 AM: Warning: Failed to open file "c:\recycler\nprotect\00484130.html". Access is denied 11:03 AM: Warning: Failed to open file "c:\recycler\nprotect\00526961.dll". Access is denied 11:04 AM: Warning: Failed to open file "c:\recycler\nprotect\00484106.html". Access is denied 11:04 AM: Warning: Failed to open file "c:\recycler\nprotect\00526978.cat". Access is denied 11:05 AM: Warning: Failed to open file "c:\recycler\nprotect\00526992.inf". Access is denied 11:05 AM: Warning: Failed to open file "c:\recycler\nprotect\00532471.lnk". Access is denied 11:05 AM: Warning: Failed to open file "c:\recycler\nprotect\00526965.dll". Access is denied 11:07 AM: Warning: Failed to open file "c:\recycler\nprotect\00532480.lnk". Access is denied 11:08 AM: Warning: Failed to open file "c:\recycler\nprotect\00447982.presenta". Access is denied 11:08 AM: Warning: Failed to open file "c:\recycler\nprotect\00526984.inf". Access is denied 11:08 AM: Warning: Failed to open file "c:\recycler\nprotect\00526952.lnk". Access is denied 11:08 AM: Warning: Failed to open file "c:\recycler\nprotect\00484024.html". Access is denied 11:08 AM: Warning: Failed to open file "c:\recycler\nprotect\00527122.lnk". Access is denied 11:08 AM: Warning: Failed to open file "c:\recycler\nprotect\00532389.lnk". Access is denied 11:09 AM: Warning: Failed to open file "c:\recycler\nprotect\00527004.reg". Access is denied 11:09 AM: Warning: Failed to open file "c:\recycler\nprotect\00488760.". The system cannot find the file specified 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00532388.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00531065.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00530394.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00530380.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527456.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527439.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527429.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00526968.dll". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00526977.inf". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00526964.ini". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00526974.dll". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00526979.inf". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00526998.inf". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528644.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528638.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528637.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528636.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528635.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528615.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528614.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528612.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528610.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528607.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528605.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528603.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528601.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528599.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528596.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528594.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528589.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528588.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528587.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528584.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528582.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00529692.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00529691.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528535.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528523.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528522.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528518.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528517.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527923.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527921.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527919.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527918.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527917.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528366.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528364.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528116.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527916.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527872.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527871.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527868.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527322.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527867.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527866.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527865.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528115.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527608.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527607.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527730.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527729.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527662.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527661.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527654.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527724.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527579.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527569.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527568.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527567.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527529.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527566.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527528.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527513.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527512.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527495.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527494.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527493.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527492.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527466.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527465.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527462.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527461.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527460.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527457.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527450.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527449.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527448.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527447.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527440.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527438.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527437.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527430.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527408.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527407.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527386.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527951.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527950.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527946.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527927.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527926.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528547.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528546.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528538.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528537.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00529361.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528731.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528716.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528715.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528703.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528693.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528692.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528691.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528690.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528645.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528536.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00530348.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528875.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528852.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528851.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528785.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528876.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528784.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528732.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00529360.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00529344.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00529343.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00529342.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00529341.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527372.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00527373.lnk". Access is denied 11:10 AM: Warning: Failed to open file "c:\recycler\nprotect\00528580.lnk". Access is denied 11:11 AM: Warning: Failed to open file "c:\recycler\nprotect\00480845.". The system cannot find the file specified 11:11 AM: Warning: Failed to open file "c:\recycler\nprotect\00530374.lnk". Access is denied 11:11 AM: Warning: Failed to open file "c:\recycler\nprotect\00525866.exe". Access is denied 11:11 AM: Warning: Failed to open file "c:\recycler\nprotect\00530376.lnk". Access is denied 11:13 AM: Warning: Failed to open file "c:\recycler\nprotect\00527424.lnk". Access is denied 11:13 AM: Warning: Failed to open file "c:\recycler\nprotect\00531316.lnk". Access is denied 11:15 AM: Warning: Failed to open file "c:\recycler\nprotect\00530797.dll". Access is denied 11:15 AM: Warning: Failed to open file "c:\recycler\nprotect\00484379.". The system cannot find the file specified 11:18 AM: Warning: Failed to open file "c:\recycler\nprotect\00526990.cat". Access is denied 11:18 AM: Warning: Failed to open file "c:\recycler\nprotect\00526993.inf". Access is denied 11:19 AM: Warning: Failed to open file "c:\recycler\nprotect\00526985.sys". Access is denied 11:19 AM: Warning: Failed to open file "c:\recycler\nprotect\00526987.sys". Access is denied 11:20 AM: Warning: Failed to open file "c:\recycler\nprotect\00527110.exe". Access is denied 11:23 AM: Warning: Failed to open file "c:\recycler\nprotect\00526983.sys". Access is denied 11:24 AM: Warning: Failed to open file "c:\recycler\nprotect\00526986.sys". Access is denied 11:25 AM: Warning: Failed to open file "c:\recycler\nprotect\00526973.exe". Access is denied 11:26 AM: Warning: Failed to open file "c:\recycler\nprotect\00459619.". The system cannot find the file specified 11:27 AM: Warning: Failed to open file "c:\recycler\nprotect\00343821.". The system cannot find the file specified 11:27 AM: Warning: Failed to open file "c:\recycler\nprotect\00528967.exe". Access is denied 11:27 AM: Warning: Failed to open file "c:\recycler\nprotect\00527077.exe". Access is denied 11:28 AM: Warning: Failed to open file "c:\recycler\nprotect\00525944.exe". Access is denied 11:29 AM: mof-toolbar.dll (ID = 198948) 11:30 AM: Warning: Failed to open file "c:\recycler\nprotect\00526994.inf". Access is denied 11:30 AM: Warning: Failed to open file "c:\recycler\nprotect\00526967.exe". Access is denied 11:31 AM: Warning: Failed to open file "c:\recycler\nprotect\00529531.exe". Access is denied 11:31 AM: Warning: Failed to open file "c:\recycler\nprotect\00530661.exe". Access is denied 11:31 AM: Warning: Failed to open file "c:\recycler\nprotect\00526593.exe". Access is denied 11:31 AM: Warning: Failed to open file "c:\recycler\nprotect\00528395.exe". Access is denied 11:31 AM: Warning: Failed to open file "c:\recycler\nprotect\00527648.exe". Access is denied 11:31 AM: Warning: Failed to open file "c:\recycler\nprotect\00530186.exe". Access is denied 11:31 AM: Warning: Failed to open file "c:\recycler\nprotect\00528900.exe". Access is denied 11:31 AM: Warning: Failed to open file "c:\recycler\nprotect\00528073.vxd". Access is denied 11:33 AM: Warning: Failed to open file "c:\recycler\nprotect\00528281.exe". Access is denied 11:33 AM: Warning: Failed to open file "c:\recycler\nprotect\00526554.exe". Access is denied 11:33 AM: Warning: Failed to open file "c:\recycler\nprotect\00533543.exe". Access is denied 11:33 AM: i_bpk2003.exe (ID = 72435) 11:33 AM: Warning: Failed to open file "c:\recycler\nprotect\00325474.". The system cannot find the file specified 11:34 AM: Warning: Failed to open file "c:\recycler\nprotect\00532127.exe". Access is denied 11:34 AM: Warning: Failed to open file "c:\recycler\nprotect\00532848.exe". Access is denied 11:35 AM: Warning: Failed to open file "c:\recycler\nprotect\00361693.". The system cannot find the file specified 11:35 AM: Warning: Failed to open file "c:\recycler\nprotect\00530796.exe". Access is denied 11:35 AM: Warning: Failed to open file "c:\recycler\nprotect\00484256.". The system cannot find the file specified 11:35 AM: Warning: Failed to open file "c:\recycler\nprotect\00446732.". The system cannot find the file specified 11:35 AM: Warning: Failed to open file "c:\recycler\nprotect\00361285.". The system cannot find the file specified 11:35 AM: Warning: Failed to open file "c:\recycler\nprotect\00530793.exe". Access is denied 11:35 AM: Warning: Failed to open file "c:\recycler\nprotect\00373140.". The system cannot find the file specified 11:36 AM: Warning: Failed to open file "c:\recycler\nprotect\00533486.exe". Access is denied 11:37 AM: Warning: Failed to open file "c:\recycler\nprotect\00484114.". The system cannot find the file specified 11:38 AM: Warning: Failed to open file "c:\recycler\nprotect\00529564.exe". Access is denied 11:38 AM: Warning: Failed to open file "c:\recycler\nprotect\00529611.exe". Access is denied 11:39 AM: Warning: Failed to open file "c:\recycler\nprotect\00532096.rgs". Access is denied 11:41 AM: Warning: Failed to open file "c:\recycler\nprotect\00533518.rgs". Access is denied 11:45 AM: Warning: Failed to open file "c:\recycler\nprotect\00526963.exe". Access is denied 11:46 AM: Warning: Failed to open file "c:\recycler\nprotect\00526970.exe". Access is denied 11:48 AM: Warning: Failed to open file "c:\recycler\nprotect\00528074.dll". Access is denied 11:48 AM: Warning: Failed to open file "c:\recycler\nprotect\00528072.sys". Access is denied 11:55 AM: Warning: Failed to open file "c:\recycler\nprotect\00532085.exe". Access is denied 11:55 AM: Warning: Failed to open file "c:\recycler\nprotect\00532481.lnk". Access is denied 11:56 AM: Warning: Failed to open file "c:\recycler\nprotect\00530791.exe". Access is denied 11:56 AM: Warning: Failed to open file "c:\recycler\nprotect\00532483.lnk". Access is denied 11:58 AM: Warning: Failed to open file "c:\recycler\nprotect\00530393.lnk". Access is denied 12:02 PM: Warning: Failed to open file "c:\recycler\nprotect\00532082.exe". Access is denied<

[jlabram]

By the way--I'm still getting the initial application error messages when I close a number of applications and browser windows even after all this cleaning.

[jlabram]

Anyone there?

[Doug]

How much physical RAM do you have installed?
What are your Virtual Memory settings?
How much Free Space do you have on your C:\ drive?

You've got enough processes running from your Start Menu to choke your Memory.
When you close applications, are you closing several in rapid succession?
Or does the "error message" appear when you close only one application?

Using your System Configuration Utility --- Start -- Run (type) msconfig

Select the StartUp tab and see what applications and processes you can afford to disable at startup.
If you disable an item, and later find you want to run it, you can click on its "icon" to start it.
And of course, if you find that your computer doesn't run the way you want it to, you can always re-enable various items in the StartUp tab.

Keep your Firewall and Anti-Virus active in startup, but many of the others (Office, MusicMatch, messenger, AOL, yahoo browser, Bytemobile Optimization Client bmwebcfg.exe, Dell Support, Photodex Corporation - ProShow Gold, nvsvc32.exe, Real\Update_OB\realsched.exe, QuickTime, Webshots\webshots.scr), Are all good candidates to disable in StartUp and run manually when you need them.

See if this idea of thinning down your active applications and processes helps.
And let us know about the RAM and Virtual Memory, and Free Space issues.

This would be a good time to clean out all your Temp and Temporary Internet Files.

Post back with your progress.

Best Regards

[jlabram]

Thanks for your reply. I'll answer a couple of your questions and then I'll perform the tasks you suggest. I have 512 MB RAM. 768MB of Virtual Memory. I have about 38 GB out of 111 GB available on the hard drive. When I close an application (one at a time and with various applications/browsers; e.g. yahoo browser, internet explorer, OSE.exe, adobe, and others but not any MS Office products) is when I get the application error message, always referring to the address '0x00000ab0'. I've cleaned all the temp and temporary internet files that the various cleaning apps find (Symantec, Spyware apps, Disk Cleanup, etc). Is there another way to clean out temporary files that these are not identifying? I'll go ahead and reduce the items in startup to a minimum few as you suggest and see what happens. Good news is that the system is running a lot faster than it was prior to all of the cleanup attention I've given it over the last few days. But, I still get the error that initiated this whole process. Thanks for your help so far and any help you can provide to get this cleaned up. Jlabram

[jlabram]

Forget what I said about NOT getting the error message with MS office products--I just got it with Word.

[Doug]

Here's the comprehensive manual procedure for cleaning out temps.

To clean out all the temporary files and cookies on your system.
Go to
Start - Run - (type) "cleanmgr" without the quotes.
Let it scan your system for files to remove.
Check these three boxes and then press ok to remove:
Temporary Files,
Temporary Internet Files,
Recycle Bin.

Then GoTo:
Start - Find/search - Files or folders - in the named box, type: *.tmp
When the list is generated, choose
Edit - select all - File - delete.

Note: If you cannot delete them all at once because you have too many, then click and hold ctrl and highlight a batch of them at a time. Once highlighted, R-click over the highlight and select delete.

Then use
Start - Run - (type) "%temp%" (without the quotes).
Delete the entire contents of that "temp" folder
(use Edit - Select All - press "Delete", click "Yes").

Then,
Empty your Temporary Internet Cache completely.
Close all instances of Outlook and Internet Explorer,
then use "Control Panel - Internet Options - General tab and click the "Delete File" button.
When prompted place a check in: "Delete all offline content", then click OK.

Then, use Windows Explorer to clean out ALL the other temp folders on your system
(navigate to the folder, (as listed below)
use "Edit - Select All", press "Delete", click "Yes"

* C:\Documents and Settings\<Your Profile>\Local Settings\Temp\
* C:\Documents and Settings\<Any other users Profile>\Local Settings\Temporary Internet Files\
* C:\Documents and Settings\<Any other users Profile>\Local Settings\Temp\

* C:\Windows\Prefetch\

* Empty your "Recycle Bin".

Note: This is a long manual way to clear out .tmp files. It is safe and highly recommended.

Now go to Control Panel - Java
Double-click on Java to open the JAVA Console

On the "General tab" press Delet Files. This will remove all ActiveX scripts that you've downloaded/allowed.
Removing the ActiveX scripts is not harmful, and can remove various scripts that you may not have wanted, or which have become corrupt. Next time you visit a WebSite where you had previously accepted an ActiveX, you will be prompted to download and accept a fresh copy of the ActiveX.

If you want to use a Utility to clean out your temp files, instead of going through all the manual steps, here is the one I use:
CleanUp! 4.50 from: http://www.stevengould.org

I highly recommend you do the manual procedure at least once, so you will experience what sections of your files and operating system is being addressed when you use an automatic utility like CleanUp! 4.5.

You can use the default settings of CleanUp! 4.5 safely.

I you haven't already done so, run your Scan Disk and then Disk Defrag next.

I'll be interested to hear what progress you make with System Configuration Utility - StartUp Menu.

Note: Windows XP consumes approximately 384mb RAM just to be up and running. That leaves very little for the additional applications and processes you have running. If you've set 768mb Virtual Memory (1.5 X 512 installed RAM) Then you are correctly following the recommended guidelines, but may not have enough Virutual Memory for the ton of stuff you have running. You can boast that Virtual Memory to 1536 and maybe be a happier camper.

Note: I'd suggest that you consider adding at least another 512mb and maybe more if you are a gamer or handle/edit a large amount of video, image, or media files.

Note: Norton is a notorious "resource hog" and you have a minimal amount of RAM installed. And you seem to have the whole Suite installed, much of which is not necessary. A low resource system like your own may balk with all the load that Norton, just by itself, places on your machine resources.

I use the Free AVG Anti-virus and the Free ZoneAlarm Firewall, instead of Norton. I know it's hard to convince someone who may have already started "believing in" a product like Norton, that they paid good hard cash for, but AVG and ZoneAlarm have been serving me quite well for several years. Please don't get me wrong here. I do like Norton/Symantec. I do think it does a good job and provides good services. I even consult the Symantec knowledge base site for assistance when I'm cleaning someone else's machine. So if you own it and like it........keep it, but realize that it may cause your system to have memory resource difficulties until you increase the amount of physical RAM installed on your machine.

Best Regards

[jlabram]

What does it mean when you get a message that it "Cannot delete the file. Cannot read from the source file or disk." How do you delete these temp files?

[jlabram]

Seem to have gotten them all eventually so disregard the error messages I was getting

[jlabram]

Still getting the memory reference error at address '0x00000ba0' whenever I close various applications/browsers--even after all the cleaning, defragging, etc. Any more advice on this one?

[jlabram]

Still hoping that someone can try and troubleshoot this error message even after cleaning up the garbage on my PC. Almost every close of an application or getting out of IE causes the same application error with the same message as described in my opening post. Any help or ideas someone might have would be greatly appreciated. Thanks. jlabram