laptop infection

billoak Topic Starter

Post #1January 27, 2010, 3:10 PM UTC last edited January 28, 2010, 9:41 PM UTC

This particularly nasty infection causes involuntary reboots particularly when I try to run malwarebytes. Need help

Here is the HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:05:06 AM, on 1/27/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Lenovo\Logger\logmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {90222687-F593-4738-B738-FBEE9C7B26DF} - (no file)
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2DEF4530-8CE6-41C9-84B6-A54536C90213} (Crystal Report Viewer Control 9) - https://www.etoreports.com/viewer9/activeXV…tivexviewer.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase8942.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = COAST.PCD
O17 - HKLM\Software\..\Telephony: DomainName = COAST.PCD
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = COAST.PCD
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = COAST.PCD
O23 - Service: ccEvtMgr - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: COM Host (comHost) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe (file missing)
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Unknown owner - C:\Program Files\Norton Internet Security\isPwdSvc.exe (file missing)
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)
O23 - Service: Symantec AppCore Service (SymAppCore) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe (file missing)
O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
O23 - Service: TVT Backup Protection Service - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Lenovo Group Limited - c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
O23 - Service: tvtnetwk - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe

–
End of file - 7066 bytes

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-28 16:38:35
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Admin\LOCALS~1\Temp\fxtorpog.sys

—- System - GMER 1.0.15 —-

SSDT 8620E288 ZwConnectPort

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)
AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip epfwtdir.sys
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdir.sys
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp epfwtdir.sys
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device \FileSystem\Fastfat \Fat 9D914D20

AttachedDevice \FileSystem\Fastfat \Fat eamon.sys (Amon monitor/ESET)

Device \FileSystem\Cdfs \Cdfs DLAIFS_M.SYS (Drive Letter Access Component/Sonic Solutions)

—- Files - GMER 1.0.15 —-

File C:\RRbackups\C 0 bytes
File C:\RRbackups\C\0 0 bytes
File C:\RRbackups\C\0\Data27 50003968 bytes
File C:\RRbackups\C\0\Data46 50003968 bytes
File C:\RRbackups\C\0\Data65 50003968 bytes
File C:\RRbackups\C\0\Data84 50003968 bytes
File C:\RRbackups\C\0\Data0 50003968 bytes
File C:\RRbackups\C\0\Data1 50003968 bytes
File C:\RRbackups\C\0\Data10 50003968 bytes
File C:\RRbackups\C\0\Data100 50003968 bytes
File C:\RRbackups\C\0\Data101 50003968 bytes
File C:\RRbackups\C\0\Data102 50003968 bytes
File C:\RRbackups\C\0\Data103 50003968 bytes
File C:\RRbackups\C\0\Data104 50003968 bytes
File C:\RRbackups\C\0\Data105 50003968 bytes
File C:\RRbackups\C\0\Data106 50003968 bytes
File C:\RRbackups\C\0\Data107 50003968 bytes
File C:\RRbackups\C\0\Data108 50003968 bytes
File C:\RRbackups\C\0\Data109 50003968 bytes
File C:\RRbackups\C\0\Data11 50003968 bytes
File C:\RRbackups\C\0\Data110 50003968 bytes
File C:\RRbackups\C\0\Data111 50003968 bytes
File C:\RRbackups\C\0\Data112 50003968 bytes
File C:\RRbackups\C\0\Data113 50003968 bytes
File C:\RRbackups\C\0\Data114 50003968 bytes
File C:\RRbackups\C\0\Data115 46405508 bytes
File C:\RRbackups\C\0\Data12 50003968 bytes
File C:\RRbackups\C\0\Data13 50003968 bytes
File C:\RRbackups\C\0\Data14 50003968 bytes
File C:\RRbackups\C\0\Data15 50003968 bytes
File C:\RRbackups\C\0\Data16 50003968 bytes
File C:\RRbackups\C\0\Data17 50003968 bytes
File C:\RRbackups\C\0\Data18 50003968 bytes
File C:\RRbackups\C\0\Data19 50003968 bytes
File C:\RRbackups\C\0\Data2 50003968 bytes
File C:\RRbackups\C\0\Data20 50003968 bytes
File C:\RRbackups\C\0\Data21 50003968 bytes
File C:\RRbackups\C\0\Data22 50003968 bytes
File C:\RRbackups\C\0\Data23 50003968 bytes
File C:\RRbackups\C\0\Data24 50003968 bytes
File C:\RRbackups\C\0\Data25 50003968 bytes
File C:\RRbackups\C\0\Data26 50003968 bytes
File C:\RRbackups\C\0\Data28 50003968 bytes
File C:\RRbackups\C\0\Data29 50003968 bytes
File C:\RRbackups\C\0\Data3 50003968 bytes
File C:\RRbackups\C\0\Data30 50003968 bytes
File C:\RRbackups\C\0\Data31 50003968 bytes
File C:\RRbackups\C\0\Data32 50003968 bytes
File C:\RRbackups\C\0\Data33 50003968 bytes
File C:\RRbackups\C\0\Data34 50003968 bytes
File C:\RRbackups\C\0\Data35 50003968 bytes
File C:\RRbackups\C\0\Data36 50003968 bytes
File C:\RRbackups\C\0\Data37 50003968 bytes
File C:\RRbackups\C\0\Data38 50003968 bytes
File C:\RRbackups\C\0\Data39 50003968 bytes
File C:\RRbackups\C\0\Data4 50003968 bytes
File C:\RRbackups\C\0\Data40 50003968 bytes
File C:\RRbackups\C\0\Data41 50003968 bytes
File C:\RRbackups\C\0\Data42 50003968 bytes
File C:\RRbackups\C\0\Data43 50003968 bytes
File C:\RRbackups\C\0\Data44 50003968 bytes
File C:\RRbackups\C\0\Data45 50003968 bytes
File C:\RRbackups\C\0\Data47 50003968 bytes
File C:\RRbackups\C\0\Data48 50003968 bytes
File C:\RRbackups\C\0\Data49 50003968 bytes
File C:\RRbackups\C\0\Data5 50003968 bytes
File C:\RRbackups\C\0\Data50 50003968 bytes
File C:\RRbackups\C\0\Data51 50003968 bytes
File C:\RRbackups\C\0\Data52 50003968 bytes
File C:\RRbackups\C\0\Data53 50003968 bytes
File C:\RRbackups\C\0\Data54 50003968 bytes
File C:\RRbackups\C\0\Data55 50003968 bytes
File C:\RRbackups\C\0\Data56 50003968 bytes
File C:\RRbackups\C\0\Data57 50003968 bytes
File C:\RRbackups\C\0\Data58 50003968 bytes
File C:\RRbackups\C\0\Data59 50003968 bytes
File C:\RRbackups\C\0\Data6 50003968 bytes
File C:\RRbackups\C\0\Data60 50003968 bytes
File C:\RRbackups\C\0\Data61 50003968 bytes
File C:\RRbackups\C\0\Data62 50003968 bytes
File C:\RRbackups\C\0\Data63 50003968 bytes
File C:\RRbackups\C\0\Data64 50003968 bytes
File C:\RRbackups\C\0\Data66 50003968 bytes
File C:\RRbackups\C\0\Data67 50003968 bytes
File C:\RRbackups\C\0\Data68 50003968 bytes
File C:\RRbackups\C\0\Data69 50003968 bytes
File C:\RRbackups\C\0\Data7 50003968 bytes
File C:\RRbackups\C\0\Data70 50003968 bytes
File C:\RRbackups\C\0\Data71 50003968 bytes
File C:\RRbackups\C\0\Data72 50003968 bytes
File C:\RRbackups\C\0\Data73 50003968 bytes
File C:\RRbackups\C\0\Data74 50003968 bytes
File C:\RRbackups\C\0\Data75 50003968 bytes
File C:\RRbackups\C\0\Data76 50003968 bytes
File C:\RRbackups\C\0\Data77 50003968 bytes
File C:\RRbackups\C\0\Data78 50003968 bytes
File C:\RRbackups\C\0\Data79 50003968 bytes
File C:\RRbackups\C\0\Data8 50003968 bytes
File C:\RRbackups\C\0\Data80 50003968 bytes
File C:\RRbackups\C\0\Data81 50003968 bytes
File C:\RRbackups\C\0\Data82 50003968 bytes
File C:\RRbackups\C\0\Data83 50003968 bytes
File C:\RRbackups\C\0\Data85 50003968 bytes
File C:\RRbackups\C\0\Data86 50003968 bytes
File C:\RRbackups\C\0\Data87 50003968 bytes
File C:\RRbackups\C\0\Data88 50003968 bytes
File C:\RRbackups\C\0\Data89 50003968 bytes
File C:\RRbackups\C\0\Data9 50003968 bytes
File C:\RRbackups\C\0\Data90 50003968 bytes
File C:\RRbackups\C\0\Data91 50003968 bytes
File C:\RRbackups\C\0\Data92 50003968 bytes
File C:\RRbackups\C\0\Data93 50003968 bytes
File C:\RRbackups\C\0\Data94 50003968 bytes
File C:\RRbackups\C\0\Data95 50003968 bytes
File C:\RRbackups\C\0\Data96 50003968 bytes
File C:\RRbackups\C\0\Data97 50003968 bytes
File C:\RRbackups\C\0\Data98 50003968 bytes
File C:\RRbackups\C\0\Data99 50003968 bytes
File C:\RRbackups\C\0\dats 0 bytes
File C:\RRbackups\C\0\EFSFile 0 bytes
File C:\RRbackups\C\0\HashFile 319554 bytes
File C:\RRbackups\C\0\Info 756 bytes
File C:\RRbackups\C\0\TOCFile 32487990 bytes
File C:\RRbackups\C\1 0 bytes
File C:\RRbackups\C\1\Data27 50003968 bytes
File C:\RRbackups\C\1\Data46 50003968 bytes
File C:\RRbackups\C\1\Data65 50003968 bytes
File C:\RRbackups\C\1\Data0 50003968 bytes
File C:\RRbackups\C\1\Data1 50003968 bytes
File C:\RRbackups\C\1\Data10 50003968 bytes
File C:\RRbackups\C\1\Data11 50003968 bytes
File C:\RRbackups\C\1\Data12 50003968 bytes
File C:\RRbackups\C\1\Data13 50003968 bytes
File C:\RRbackups\C\1\Data14 50003968 bytes
File C:\RRbackups\C\1\Data15 50003968 bytes
File C:\RRbackups\C\1\Data16 50003968 bytes
File C:\RRbackups\C\1\Data17 50003968 bytes
File C:\RRbackups\C\1\Data18 50003968 bytes
File C:\RRbackups\C\1\Data19 50003968 bytes
File C:\RRbackups\C\1\Data2 50003968 bytes
File C:\RRbackups\C\1\Data20 50003968 bytes
File C:\RRbackups\C\1\Data21 50003968 bytes
File C:\RRbackups\C\1\Data22 50003968 bytes
File C:\RRbackups\C\1\Data23 50003968 bytes
File C:\RRbackups\C\1\Data24 50003968 bytes
File C:\RRbackups\C\1\Data25 50003968 bytes
File C:\RRbackups\C\1\Data26 50003968 bytes
File C:\RRbackups\C\1\Data28 50003968 bytes
File C:\RRbackups\C\1\Data29 50003968 bytes
File C:\RRbackups\C\1\Data3 50003968 bytes
File C:\RRbackups\C\1\Data30 50003968 bytes
File C:\RRbackups\C\1\Data31 50003968 bytes
File C:\RRbackups\C\1\Data32 50003968 bytes
File C:\RRbackups\C\1\Data33 50003968 bytes
File C:\RRbackups\C\1\Data34 50003968 bytes
File C:\RRbackups\C\1\Data35 50003968 bytes
File C:\RRbackups\C\1\Data36 50003968 bytes
File C:\RRbackups\C\1\Data37 50003968 bytes
File C:\RRbackups\C\1\Data38 50003968 bytes
File C:\RRbackups\C\1\Data39 50003968 bytes
File C:\RRbackups\C\1\Data4 50003968 bytes
File C:\RRbackups\C\1\Data40 50003968 bytes
File C:\RRbackups\C\1\Data41 50003968 bytes
File C:\RRbackups\C\1\Data42 50003968 bytes
File C:\RRbackups\C\1\Data43 50003968 bytes
File C:\RRbackups\C\1\Data44 50003968 bytes
File C:\RRbackups\C\1\Data45 50003968 bytes
File C:\RRbackups\C\1\Data47 50003968 bytes
File C:\RRbackups\C\1\Data48 50003968 bytes
File C:\RRbackups\C\1\Data49 50003968 bytes
File C:\RRbackups\C\1\Data5 50003968 bytes
File C:\RRbackups\C\1\Data50 50003968 bytes
File C:\RRbackups\C\1\Data51 50003968 bytes
File C:\RRbackups\C\1\Data52 50003968 bytes
File C:\RRbackups\C\1\Data53 50003968 bytes
File C:\RRbackups\C\1\Data54 50003968 bytes
File C:\RRbackups\C\1\Data55 50003968 bytes
File C:\RRbackups\C\1\Data56 50003968 bytes
File C:\RRbackups\C\1\Data57 50003968 bytes
File C:\RRbackups\C\1\Data58 50003968 bytes
File C:\RRbackups\C\1\Data59 50003968 bytes
File C:\RRbackups\C\1\Data6 50003968 bytes
File C:\RRbackups\C\1\Data60 50003968 bytes
File C:\RRbackups\C\1\Data61 50003968 bytes
File C:\RRbackups\C\1\Data62 50003968 bytes
File C:\RRbackups\C\1\Data63 50003968 bytes
File C:\RRbackups\C\1\Data64 50003968 bytes
File C:\RRbackups\C\1\Data66 50003968 bytes
File C:\RRbackups\C\1\Data67 50003968 bytes
File C:\RRbackups\C\1\Data68 50003968 bytes
File C:\RRbackups\C\1\Data69 50003968 bytes
File C:\RRbackups\C\1\Data7 50003968 bytes
File C:\RRbackups\C\1\Data70 50003968 bytes
File C:\RRbackups\C\1\Data71 50003968 bytes
File C:\RRbackups\C\1\Data72 50003968 bytes
File C:\RRbackups\C\1\Data73 50003968 bytes
File C:\RRbackups\C\1\Data74 50003968 bytes
File C:\RRbackups\C\1\Data75 50003968 bytes
File C:\RRbackups\C\1\Data76 50003968 bytes
File C:\RRbackups\C\1\Data77 50003968 bytes
File C:\RRbackups\C\1\Data78 50003968 bytes
File C:\RRbackups\C\1\Data79 50003968 bytes
File C:\RRbackups\C\1\Data8 50003968 bytes
File C:\RRbackups\C\1\Data80 50003968 bytes
File C:\RRbackups\C\1\Data81 50003968 bytes
File C:\RRbackups\C\1\Data82 50003968 bytes
File C:\RRbackups\C\1\Data83 50003968 bytes
File C:\RRbackups\C\1\Data84 50003968 bytes
File C:\RRbackups\C\1\Data85 50003968 bytes
File C:\RRbackups\C\1\Data86 50003968 bytes
File C:\RRbackups\C\1\Data87 4965306 bytes
File C:\RRbackups\C\1\Data9 50003968 bytes
File C:\RRbackups\C\1\dats 0 bytes
File C:\RRbackups\C\1\EFSFile 0 bytes
File C:\RRbackups\C\1\HashFile 455598 bytes
File C:\RRbackups\C\1\Info 756 bytes
File C:\RRbackups\C\1\TOCFile 46319130 bytes
File C:\RRbackups\C\2 0 bytes
File C:\RRbackups\C\2\Data0 50003968 bytes
File C:\RRbackups\C\2\Data1 50003968 bytes
File C:\RRbackups\C\2\Data2 50003968 bytes
File C:\RRbackups\C\2\Data3 50003968 bytes
File C:\RRbackups\C\2\Data4 50003968 bytes
File C:\RRbackups\C\2\Data5 21063812 bytes
File C:\RRbackups\C\2\dats 0 bytes
File C:\RRbackups\C\2\EFSFile 0 bytes
File C:\RRbackups\C\2\HashFile 473304 bytes
File C:\RRbackups\C\2\Info 756 bytes
File C:\RRbackups\C\2\TOCFile 48119240 bytes
File C:\RRbackups\C\3 0 bytes
File C:\RRbackups\C\3\Data0 50003968 bytes
File C:\RRbackups\C\3\Data1 50003968 bytes
File C:\RRbackups\C\3\Data10 50003968 bytes
File C:\RRbackups\C\3\Data11 50003968 bytes
File C:\RRbackups\C\3\Data12 50003968 bytes
File C:\RRbackups\C\3\Data13 50003968 bytes
File C:\RRbackups\C\3\Data14 50003968 bytes
File C:\RRbackups\C\3\Data15 22367932 bytes
File C:\RRbackups\C\3\Data2 50003968 bytes
File C:\RRbackups\C\3\Data3 50003968 bytes
File C:\RRbackups\C\3\Data4 50003968 bytes
File C:\RRbackups\C\3\Data5 50003968 bytes
File C:\RRbackups\C\3\Data6 50003968 bytes
File C:\RRbackups\C\3\Data7 50003968 bytes
File C:\RRbackups\C\3\Data8 50003968 bytes
File C:\RRbackups\C\3\Data9 50003968 bytes
File C:\RRbackups\C\3\dats 0 bytes
File C:\RRbackups\C\3\EFSFile 0 bytes
File C:\RRbackups\C\3\HashFile 472182 bytes
File C:\RRbackups\C\3\Info 756 bytes
File C:\RRbackups\C\3\TOCFile 48005170 bytes
File C:\RRbackups\C\4 0 bytes
File C:\RRbackups\C\4\Data0 50003968 bytes
File C:\RRbackups\C\4\Data1 50003968 bytes
File C:\RRbackups\C\4\Data2 47673998 bytes
File C:\RRbackups\C\4\dats 0 bytes
File C:\RRbackups\C\4\EFSFile 0 bytes
File C:\RRbackups\C\4\HashFile 482712 bytes
File C:\RRbackups\C\4\Info 756 bytes
File C:\RRbackups\C\4\TOCFile 49075720 bytes
File C:\RRbackups\C\5 0 bytes
File C:\RRbackups\C\5\Data0 50003968 bytes
File C:\RRbackups\C\5\Data1 50003968 bytes
File C:\RRbackups\C\5\Data2 50003968 bytes
File C:\RRbackups\C\5\Data3 50003968 bytes
File C:\RRbackups\C\5\Data4 50003968 bytes
File C:\RRbackups\C\5\Data5 50003968 bytes
File C:\RRbackups\C\5\Data6 50003968 bytes
File C:\RRbackups\C\5\Data7 33573292 bytes
File C:\RRbackups\C\5\dats 0 bytes
File C:\RRbackups\C\5\EFSFile 0 bytes
File C:\RRbackups\C\5\HashFile 483348 bytes
File C:\RRbackups\C\5\Info 756 bytes
File C:\RRbackups\C\5\TOCFile 49140380 bytes
File C:\RRbackups\C\MERGE 0 bytes
File C:\RRbackups\C\MERGE\Data27 50003968 bytes
File C:\RRbackups\C\MERGE\Data0 50003968 bytes
File C:\RRbackups\C\MERGE\Data1 50003968 bytes
File C:\RRbackups\C\MERGE\Data10 50003968 bytes
File C:\RRbackups\C\MERGE\Data11 50003968 bytes
File C:\RRbackups\C\MERGE\Data12 50003968 bytes
File C:\RRbackups\C\MERGE\Data13 50003968 bytes
File C:\RRbackups\C\MERGE\Data14 50003968 bytes
File C:\RRbackups\C\MERGE\Data15 50003968 bytes
File C:\RRbackups\C\MERGE\Data16 50003968 bytes
File C:\RRbackups\C\MERGE\Data17 50003968 bytes
File C:\RRbackups\C\MERGE\Data18 50003968 bytes
File C:\RRbackups\C\MERGE\Data19 50003968 bytes
File C:\RRbackups\C\MERGE\Data2 50003968 bytes
File C:\RRbackups\C\MERGE\Data20 50003968 bytes
File C:\RRbackups\C\MERGE\Data21 50003968 bytes
File C:\RRbackups\C\MERGE\Data22 50003968 bytes
File C:\RRbackups\C\MERGE\Data23 50003968 bytes
File C:\RRbackups\C\MERGE\Data24 50003968 bytes
File C:\RRbackups\C\MERGE\Data25 50003968 bytes
File C:\RRbackups\C\MERGE\Data26 50003968 bytes
File C:\RRbackups\C\MERGE\Data28 50003968 bytes
File C:\RRbackups\C\MERGE\Data29 50003968 bytes
File C:\RRbackups\C\MERGE\Data3 50003968 bytes
File C:\RRbackups\C\MERGE\Data30 50003968 bytes
File C:\RRbackups\C\MERGE\Data31 50003968 bytes
File C:\RRbackups\C\MERGE\Data32 50003968 bytes
File C:\RRbackups\C\MERGE\Data33 50003968 bytes
File C:\RRbackups\C\MERGE\Data34 50003968 bytes
File C:\RRbackups\C\MERGE\Data35 50003968 bytes
File C:\RRbackups\C\MERGE\Data36 50003968 bytes
File C:\RRbackups\C\MERGE\Data37 50003968 bytes
File C:\RRbackups\C\MERGE\Data38 50003968 bytes
File C:\RRbackups\C\MERGE\Data4 50003968 bytes
File C:\RRbackups\C\MERGE\Data5 50003968 bytes
File C:\RRbackups\C\MERGE\Data6 50003968 bytes
File C:\RRbackups\C\MERGE\Data7 50003968 bytes
File C:\RRbackups\C\MERGE\Data8 50003968 bytes
File C:\RRbackups\C\MERGE\Data9 50003968 bytes
File C:\RRbackups\C\MERGE\EFSFile 0 bytes
File C:\RRbackups\C\MERGE\HashFile 473304 bytes
File C:\RRbackups\C\MERGE\Info 0 bytes
File C:\RRbackups\C\MERGE\TOCFile 48119240 bytes
File C:\RRbackups\common 0 bytes
File C:\RRbackups\common\backups.dat 8192 bytes
File C:\RRbackups\common\bt0.dat 32256 bytes
File C:\RRbackups\common\bt1.dat 32256 bytes
File C:\RRbackups\common\bt2.dat 32256 bytes
File C:\RRbackups\common\bt3.dat 32256 bytes
File C:\RRbackups\common\bt4.dat 32256 bytes
File C:\RRbackups\common\bt5.dat 32256 bytes
File C:\RRbackups\common\css.dat 8192 bytes
File C:\RRbackups\common\hints.dat 8192 bytes
File C:\RRbackups\common\mnd.dat 8192 bytes
File C:\RRbackups\common\regcerts.dat 8192 bytes
File C:\RRbackups\common\restore.log 110 bytes
File C:\RRbackups\common\rr.log 122965 bytes
File C:\RRbackups\common\SAM 32768 bytes
File C:\RRbackups\common\seccache.dat 8192 bytes
File C:\RRbackups\common\secpolicy.dat 61440 bytes
File C:\RRbackups\common\settings.dat 28672 bytes
File C:\RRbackups\common\system.dat 12288 bytes
File C:\RRbackups\common\tvtcmn.dat 8192 bytes
File C:\RRbackups\common\tvtns.bin 23 bytes
File C:\RRbackups\common\usersids.dat 17680 bytes
File C:\RRbackups\Documents and Settings 0 bytes
File C:\RRbackups\Documents and Settings\Admin 0 bytes
File C:\RRbackups\Documents and Settings\Admin\Application Data 0 bytes
File C:\RRbackups\Documents and Settings\Admin\Application Data\Lenovo 0 bytes
File C:\RRbackups\Documents and Settings\Admin\Application Data\Lenovo\Client Security Solution 0 bytes
File C:\RRbackups\Documents and Settings\Admin\Application Data\Microsoft 0 bytes
File C:\RRbackups\Documents and Settings\Admin\Application Data\Microsoft\Crypto 0 bytes
File C:\RRbackups\Documents and Settings\Admin\Application Data\Microsoft\Crypto\RSA 0 bytes
File C:\RRbackups\Documents and Settings\Admin\Application Data\Microsoft\Protect 0 bytes
File C:\RRbackups\Documents and Settings\Admin\Application Data\Microsoft\Protect\CREDHIST 24 bytes
File C:\RRbackups\Documents and Settings\Admin\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500 0 bytes
File C:\RRbackups\Documents and Settings\Admin\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\70ceb0a1-00c1-4ae4-9a21-f9fdb7446739 388 bytes
File C:\RRbackups\Documents and Settings\Admin\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\Admin\Application Data\Microsoft\Protect\S-1-5-21-2830379330-2618101235-829512762-1010 0 bytes
File C:\RRbackups\Documents and Settings\Admin\Application Data\Microsoft\Protect\S-1-5-21-2830379330-2618101235-829512762-1010\2cfcea37-100c-47a7-819e-3e7e058fc32f 388 bytes
File C:\RRbackups\Documents and Settings\Admin\Application Data\Microsoft\Protect\S-1-5-21-2830379330-2618101235-829512762-1010\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\Admin\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500 0 bytes
File C:\RRbackups\Documents and Settings\Admin\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\c330d5b5-275f-4755-a305-a8f45c3f4b54 388 bytes
File C:\RRbackups\Documents and Settings\Admin\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\Admin\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500 0 bytes
File C:\RRbackups\Documents and Settings\Admin\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\9912b362-06d8-40b1-a1b4-5bd61e408a03 388 bytes
File C:\RRbackups\Documents and Settings\Admin\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\Admin\Application Data\Microsoft\SystemCertificates 0 bytes
File C:\RRbackups\Documents and Settings\Admin\Application Data\Microsoft\SystemCertificates\My 0 bytes
File C:\RRbackups\Documents and Settings\Admin\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes
File C:\RRbackups\Documents and Settings\Admin\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes
File C:\RRbackups\Documents and Settings\Admin\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes
File C:\RRbackups\Documents and Settings\Administrator 0 bytes
File C:\RRbackups\Documents and Settings\Administrator\Application Data 0 bytes
File C:\RRbackups\Documents and Settings\Administrator\Application Data\Lenovo 0 bytes
File C:\RRbackups\Documents and Settings\Administrator\Application Data\Lenovo\Client Security Solution 0 bytes
File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft 0 bytes
File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Crypto 0 bytes
File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Crypto\RSA 0 bytes
File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Protect 0 bytes
File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Protect\CREDHIST 24 bytes
File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500 0 bytes
File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\70ceb0a1-00c1-4ae4-9a21-f9fdb7446739 388 bytes
File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500 0 bytes
File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\c330d5b5-275f-4755-a305-a8f45c3f4b54 388 bytes
File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500 0 bytes
File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\9912b362-06d8-40b1-a1b4-5bd61e408a03 388 bytes
File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\SystemCertificates 0 bytes
File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\SystemCertificates\My 0 bytes
File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes
File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes
File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST 0 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data 0 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Lenovo 0 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Lenovo\Client Security Solution 0 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Lenovo\Client Security Solution\encobject.dat 0 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Lenovo\Client Security Solution\hibernation.dat 4 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Microsoft 0 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Microsoft\Crypto 0 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Microsoft\Crypto\RSA 0 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1292428093-1647877149-682003330-500 0 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1292428093-1647877149-682003330-500\6b29ae44e85efac3c72ff4d1865d73f1_2d152889-fd39-45c6-86ae-ec5a0b1805bf 53 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Microsoft\Protect 0 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Microsoft\Protect\CREDHIST 24 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Microsoft\Protect\S-1-5-21-1292428093-1647877149-682003330-500 0 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Microsoft\Protect\S-1-5-21-1292428093-1647877149-682003330-500\b61ad25e-4a80-4a7e-bdff-3d1126389b8e 664 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Microsoft\Protect\S-1-5-21-1292428093-1647877149-682003330-500\d39defb7-bcb8-429a-b675-3008ecf60c7c 664 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Microsoft\Protect\S-1-5-21-1292428093-1647877149-682003330-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500 0 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\70ceb0a1-00c1-4ae4-9a21-f9fdb7446739 388 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500 0 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\c330d5b5-275f-4755-a305-a8f45c3f4b54 388 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500 0 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\9912b362-06d8-40b1-a1b4-5bd61e408a03 388 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Microsoft\SystemCertificates 0 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Microsoft\SystemCertificates\My 0 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes
File C:\RRbackups\Documents and Settings\administrator.COAST\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M\Application Data 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M\Application Data\Lenovo 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M\Application Data\Lenovo\Client Security Solution 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M\Application Data\Microsoft 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M\Application Data\Microsoft\Crypto 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M\Application Data\Microsoft\Crypto\RSA 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M\Application Data\Microsoft\Protect 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M\Application Data\Microsoft\Protect\CREDHIST 24 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\70ceb0a1-00c1-4ae4-9a21-f9fdb7446739 388 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\c330d5b5-275f-4755-a305-a8f45c3f4b54 388 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\9912b362-06d8-40b1-a1b4-5bd61e408a03 388 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M\Application Data\Microsoft\SystemCertificates 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M\Application Data\Microsoft\SystemCertificates\My 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M.000 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M.000\Application Data 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M.000\Application Data\Lenovo 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M.000\Application Data\Lenovo\Client Security Solution 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M.000\Application Data\Microsoft 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M.000\Application Data\Microsoft\Crypto 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M.000\Application Data\Microsoft\Crypto\RSA 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M.000\Application Data\Microsoft\Protect 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M.000\Application Data\Microsoft\Protect\CREDHIST 24 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M.000\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M.000\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\70ceb0a1-00c1-4ae4-9a21-f9fdb7446739 388 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M.000\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M.000\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M.000\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\c330d5b5-275f-4755-a305-a8f45c3f4b54 388 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M.000\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M.000\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M.000\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\9912b362-06d8-40b1-a1b4-5bd61e408a03 388 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M.000\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M.000\Application Data\Microsoft\SystemCertificates 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M.000\Application Data\Microsoft\SystemCertificates\My 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M.000\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M.000\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes
File C:\RRbackups\Documents and Settings\Administrator.SAMCOL137M.000\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes
File C:\RRbackups\Documents and Settings\All Users 0 bytes
File C:\RRbackups\Documents and Settings\All Users\Application Data 0 bytes
File C:\RRbackups\Documents and Settings\All Users\Application Data\Lenovo 0 bytes
File C:\RRbackups\Documents and Settings\All Users\Application Data\Lenovo\Client Security Solution 0 bytes
File C:\RRbackups\Documents and Settings\All Users\Application Data\Lenovo\Client Security Solution\PreloadInstall.ini 26 bytes
File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft 0 bytes
File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto 0 bytes
File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA 0 bytes
File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys 0 bytes
File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18 0 bytes
File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\42e7e898003fbdeb9585806ee1664b51_2d152889-fd39-45c6-86ae-ec5a0b1805bf 57 bytes
File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\8f71098770f72c7a67cd8f1151619865_2d152889-fd39-45c6-86ae-ec5a0b1805bf 54 bytes
File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\d42cc0c3858a58db2db37658219e6400_2d152889-fd39-45c6-86ae-ec5a0b1805bf 893 bytes
File C:\RRbackups\Documents and Settings\apolite 0 bytes
File C:\RRbackups\Documents and Settings\apolite\Application Data 0 bytes
File C:\RRbackups\Documents and Settings\apolite\Application Data\Lenovo 0 bytes
File C:\RRbackups\Documents and Settings\apolite\Application Data\Lenovo\Client Security Solution 0 bytes
File C:\RRbackups\Documents and Settings\apolite\Application Data\Microsoft 0 bytes
File C:\RRbackups\Documents and Settings\apolite\Application Data\Microsoft\Crypto 0 bytes
File C:\RRbackups\Documents and Settings\apolite\Application Data\Microsoft\Crypto\RSA 0 bytes
File C:\RRbackups\Documents and Settings\apolite\Application Data\Microsoft\Protect 0 bytes
File C:\RRbackups\Documents and Settings\apolite\Application Data\Microsoft\Protect\CREDHIST 24 bytes
File C:\RRbackups\Documents and Settings\apolite\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500 0 bytes
File C:\RRbackups\Documents and Settings\apolite\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\70ceb0a1-00c1-4ae4-9a21-f9fdb7446739 388 bytes
File C:\RRbackups\Documents and Settings\apolite\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\apolite\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500 0 bytes
File C:\RRbackups\Documents and Settings\apolite\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\c330d5b5-275f-4755-a305-a8f45c3f4b54 388 bytes
File C:\RRbackups\Documents and Settings\apolite\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\apolite\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500 0 bytes
File C:\RRbackups\Documents and Settings\apolite\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\9912b362-06d8-40b1-a1b4-5bd61e408a03 388 bytes
File C:\RRbackups\Documents and Settings\apolite\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\apolite\Application Data\Microsoft\SystemCertificates 0 bytes
File C:\RRbackups\Documents and Settings\apolite\Application Data\Microsoft\SystemCertificates\My 0 bytes
File C:\RRbackups\Documents and Settings\apolite\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes
File C:\RRbackups\Documents and Settings\apolite\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes
File C:\RRbackups\Documents and Settings\apolite\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes
File C:\RRbackups\Documents and Settings\Default User 0 bytes
File C:\RRbackups\Documents and Settings\Default User\Application Data 0 bytes
File C:\RRbackups\Documents and Settings\Default User\Application Data\Lenovo 0 bytes
File C:\RRbackups\Documents and Settings\Default User\Application Data\Lenovo\Client Security Solution 0 bytes
File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft 0 bytes
File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Crypto 0 bytes
File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Crypto\RSA 0 bytes
File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect 0 bytes
File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\CREDHIST 24 bytes
File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500 0 bytes
File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\70ceb0a1-00c1-4ae4-9a21-f9fdb7446739 388 bytes
File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500 0 bytes
File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\c330d5b5-275f-4755-a305-a8f45c3f4b54 388 bytes
File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500 0 bytes
File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\9912b362-06d8-40b1-a1b4-5bd61e408a03 388 bytes
File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates 0 bytes
File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My 0 bytes
File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes
File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes
File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd 0 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data 0 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Lenovo 0 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Lenovo\Client Security Solution 0 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Lenovo\Client Security Solution\encobject.dat 0 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Lenovo\Client Security Solution\hibernation.dat 4 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Microsoft 0 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Microsoft\Crypto 0 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Microsoft\Crypto\RSA 0 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Microsoft\Crypto\RSA\S-1-5-21-2830379330-2618101235-829512762-1008 0 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Microsoft\Crypto\RSA\S-1-5-21-2830379330-2618101235-829512762-1008\8f71098770f72c7a67cd8f1151619865_2d152889-fd39-45c6-86ae-ec5a0b1805bf 54 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Microsoft\Protect 0 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Microsoft\Protect\CREDHIST 24 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500 0 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\70ceb0a1-00c1-4ae4-9a21-f9fdb7446739 388 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Microsoft\Protect\S-1-5-21-2830379330-2618101235-829512762-1008 0 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Microsoft\Protect\S-1-5-21-2830379330-2618101235-829512762-1008\237a06c3-799b-42ce-8bb8-646c9e3a4f20 388 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Microsoft\Protect\S-1-5-21-2830379330-2618101235-829512762-1008\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500 0 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\c330d5b5-275f-4755-a305-a8f45c3f4b54 388 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500 0 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\9912b362-06d8-40b1-a1b4-5bd61e408a03 388 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Microsoft\SystemCertificates 0 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Microsoft\SystemCertificates\My 0 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes
File C:\RRbackups\Documents and Settings\Gail Byrd\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes
File C:\RRbackups\Documents and Settings\gbyrd 0 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data 0 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Lenovo 0 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Lenovo\Client Security Solution 0 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft 0 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\Crypto 0 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\Crypto\RSA 0 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1292428093-1647877149-682003330-1361 0 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1292428093-1647877149-682003330-1361\6b29ae44e85efac3c72ff4d1865d73f1_2d152889-fd39-45c6-86ae-ec5a0b1805bf 53 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1292428093-1647877149-682003330-1361\83aa4cc77f591dfc2374580bbd95f6ba_2d152889-fd39-45c6-86ae-ec5a0b1805bf 45 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\Protect 0 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\Protect\CREDHIST 24 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\Protect\S-1-5-21-1292428093-1647877149-682003330-1361 0 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\Protect\S-1-5-21-1292428093-1647877149-682003330-1361\1096e638-0668-4019-8de6-d696dee9c1cc 664 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\Protect\S-1-5-21-1292428093-1647877149-682003330-1361\7099838e-5273-4fd4-960e-b25e42ff5641 664 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\Protect\S-1-5-21-1292428093-1647877149-682003330-1361\80ec3634-bc80-4163-b951-d4d0c1118a97 664 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\Protect\S-1-5-21-1292428093-1647877149-682003330-1361\a6077165-a3ae-4db2-b9c3-07355c0d85d7 664 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\Protect\S-1-5-21-1292428093-1647877149-682003330-1361\b22c6d46-1f36-4671-962f-b8b7aabba86a 664 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\Protect\S-1-5-21-1292428093-1647877149-682003330-1361\c9f21943-f026-4a65-902d-6c6b30742814 664 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\Protect\S-1-5-21-1292428093-1647877149-682003330-1361\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500 0 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\70ceb0a1-00c1-4ae4-9a21-f9fdb7446739 388 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500 0 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\c330d5b5-275f-4755-a305-a8f45c3f4b54 388 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500 0 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\9912b362-06d8-40b1-a1b4-5bd61e408a03 388 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\SystemCertificates 0 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\SystemCertificates\My 0 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes
File C:\RRbackups\Documents and Settings\gbyrd\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes
File C:\RRbackups\Documents and Settings\kfields 0 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data 0 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Lenovo 0 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Lenovo\Client Security Solution 0 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft 0 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft\Crypto 0 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft\Crypto\RSA 0 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1292428093-1647877149-682003330-2623 0 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1292428093-1647877149-682003330-2623\6b29ae44e85efac3c72ff4d1865d73f1_2d152889-fd39-45c6-86ae-ec5a0b1805bf 53 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1292428093-1647877149-682003330-2623\83aa4cc77f591dfc2374580bbd95f6ba_2d152889-fd39-45c6-86ae-ec5a0b1805bf 45 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft\Protect 0 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft\Protect\CREDHIST 24 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft\Protect\S-1-5-21-1292428093-1647877149-682003330-2623 0 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft\Protect\S-1-5-21-1292428093-1647877149-682003330-2623\19aee6b6-a1a2-4740-b9c6-3c55d5e5f482 664 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft\Protect\S-1-5-21-1292428093-1647877149-682003330-2623\cf68a464-66d1-47a9-853e-2dcc3dbed2b0 664 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft\Protect\S-1-5-21-1292428093-1647877149-682003330-2623\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500 0 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\70ceb0a1-00c1-4ae4-9a21-f9fdb7446739 388 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500 0 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\c330d5b5-275f-4755-a305-a8f45c3f4b54 388 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500 0 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\9912b362-06d8-40b1-a1b4-5bd61e408a03 388 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft\SystemCertificates 0 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft\SystemCertificates\My 0 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes
File C:\RRbackups\Documents and Settings\kfields\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes
File C:\RRbackups\Documents and Settings\LocalService 0 bytes
File C:\RRbackups\Documents and Settings\LocalService\Application Data 0 bytes
File C:\RRbackups\Documents and Settings\LocalService\Application Data\Microsoft 0 bytes
File C:\RRbackups\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates 0 bytes
File C:\RRbackups\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My 0 bytes
File C:\RRbackups\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes
File C:\RRbackups\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes
File C:\RRbackups\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes
File C:\RRbackups\Documents and Settings\NetworkService 0 bytes
File C:\RRbackups\Documents and Settings\NetworkService\Application Data 0 bytes
File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft 0 bytes
File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\Crypto 0 bytes
File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\Crypto\RSA 0 bytes
File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\Protect 0 bytes
File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\Protect\CREDHIST 24 bytes
File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\Protect\S-1-5-20 0 bytes
File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\Protect\S-1-5-20\6b667c0b-d7a3-4f9d-8071-009cb7a7f00e 388 bytes
File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\Protect\S-1-5-20\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates 0 bytes
File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My 0 bytes
File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes
File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes
File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes
File C:\RRbackups\Documents and Settings\rborzaga 0 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data 0 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data\Lenovo 0 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data\Lenovo\Client Security Solution 0 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data\Microsoft 0 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data\Microsoft\Crypto 0 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data\Microsoft\Crypto\RSA 0 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data\Microsoft\Protect 0 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data\Microsoft\Protect\CREDHIST 24 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data\Microsoft\Protect\S-1-5-21-1292428093-1647877149-682003330-1184 0 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data\Microsoft\Protect\S-1-5-21-1292428093-1647877149-682003330-1184\700a2a49-50fe-4bd4-8f79-800742078825 664 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data\Microsoft\Protect\S-1-5-21-1292428093-1647877149-682003330-1184\88690865-6d0b-4d03-a007-dbe63f8f5234 664 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data\Microsoft\Protect\S-1-5-21-1292428093-1647877149-682003330-1184\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500 0 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\70ceb0a1-00c1-4ae4-9a21-f9fdb7446739 388 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500 0 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\c330d5b5-275f-4755-a305-a8f45c3f4b54 388 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500 0 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\9912b362-06d8-40b1-a1b4-5bd61e408a03 388 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data\Microsoft\SystemCertificates 0 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data\Microsoft\SystemCertificates\My 0 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes
File C:\RRbackups\Documents and Settings\rborzaga\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes
File C:\RRbackups\Documents and Settings\sbyrd 0 bytes
File C:\RRbackups\Documents and Settings\sbyrd\Application Data 0 bytes
File C:\RRbackups\Documents and Settings\sbyrd\Application Data\Lenovo 0 bytes
File C:\RRbackups\Documents and Settings\sbyrd\Application Data\Lenovo\Client Security Solution 0 bytes
File C:\RRbackups\Documents and Settings\sbyrd\Application Data\Microsoft 0 bytes
File C:\RRbackups\Documents and Settings\sbyrd\Application Data\Microsoft\Crypto 0 bytes
File C:\RRbackups\Documents and Settings\sbyrd\Application Data\Microsoft\Crypto\RSA 0 bytes
File C:\RRbackups\Documents and Settings\sbyrd\Application Data\Microsoft\Protect 0 bytes
File C:\RRbackups\Documents and Settings\sbyrd\Application Data\Microsoft\Protect\CREDHIST 24 bytes
File C:\RRbackups\Documents and Settings\sbyrd\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500 0 bytes
File C:\RRbackups\Documents and Settings\sbyrd\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\70ceb0a1-00c1-4ae4-9a21-f9fdb7446739 388 bytes
File C:\RRbackups\Documents and Settings\sbyrd\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\sbyrd\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500 0 bytes
File C:\RRbackups\Documents and Settings\sbyrd\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\c330d5b5-275f-4755-a305-a8f45c3f4b54 388 bytes
File C:\RRbackups\Documents and Settings\sbyrd\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\sbyrd\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500 0 bytes
File C:\RRbackups\Documents and Settings\sbyrd\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\9912b362-06d8-40b1-a1b4-5bd61e408a03 388 bytes
File C:\RRbackups\Documents and Settings\sbyrd\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\sbyrd\Application Data\Microsoft\SystemCertificates 0 bytes
File C:\RRbackups\Documents and Settings\sbyrd\Application Data\Microsoft\SystemCertificates\My 0 bytes
File C:\RRbackups\Documents and Settings\sbyrd\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes
File C:\RRbackups\Documents and Settings\sbyrd\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes
File C:\RRbackups\Documents and Settings\sbyrd\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes
File C:\RRbackups\Documents and Settings\workforce1 0 bytes
File C:\RRbackups\Documents and Settings\workforce1\Application Data 0 bytes
File C:\RRbackups\Documents and Settings\workforce1\Application Data\Lenovo 0 bytes
File C:\RRbackups\Documents and Settings\workforce1\Application Data\Lenovo\Client Security Solution 0 bytes
File C:\RRbackups\Documents and Settings\workforce1\Application Data\Microsoft 0 bytes
File C:\RRbackups\Documents and Settings\workforce1\Application Data\Microsoft\Crypto 0 bytes
File C:\RRbackups\Documents and Settings\workforce1\Application Data\Microsoft\Crypto\RSA 0 bytes
File C:\RRbackups\Documents and Settings\workforce1\Application Data\Microsoft\Protect 0 bytes
File C:\RRbackups\Documents and Settings\workforce1\Application Data\Microsoft\Protect\CREDHIST 24 bytes
File C:\RRbackups\Documents and Settings\workforce1\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500 0 bytes
File C:\RRbackups\Documents and Settings\workforce1\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\70ceb0a1-00c1-4ae4-9a21-f9fdb7446739 388 bytes
File C:\RRbackups\Documents and Settings\workforce1\Application Data\Microsoft\Protect\S-1-5-21-1800071308-641124195-4088148676-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\workforce1\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500 0 bytes
File C:\RRbackups\Documents and Settings\workforce1\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\c330d5b5-275f-4755-a305-a8f45c3f4b54 388 bytes
File C:\RRbackups\Documents and Settings\workforce1\Application Data\Microsoft\Protect\S-1-5-21-3427491156-2269384602-655476414-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\workforce1\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500 0 bytes
File C:\RRbackups\Documents and Settings\workforce1\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\9912b362-06d8-40b1-a1b4-5bd61e408a03 388 bytes
File C:\RRbackups\Documents and Settings\workforce1\Application Data\Microsoft\Protect\S-1-5-21-956439149-3673379388-1557081040-500\Preferred 24 bytes
File C:\RRbackups\Documents and Settings\workforce1\Application Data\Microsoft\SystemCertificates 0 bytes
File C:\RRbackups\Documents and Settings\workforce1\Application Data\Microsoft\SystemCertificates\My 0 bytes
File C:\RRbackups\Documents and Settings\workforce1\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes
File C:\RRbackups\Documents and Settings\workforce1\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes
File C:\RRbackups\Documents and Settings\workforce1\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes
File C:\RRbackups\SIS 0 bytes
File C:\RRbackups\SIS\C 0 bytes
File C:\RRbackups\SIS\C\0 0 bytes
File C:\RRbackups\SIS\C\0\Data0 94 bytes
File C:\RRbackups\SIS\C\0\Data1 50003968 bytes
File C:\RRbackups\SIS\C\0\Data2 16500502 bytes
File C:\RRbackups\SIS\C\0\Data3 18315 bytes
File C:\RRbackups\SIS\C\0\Data4 21034128 bytes
File C:\RRbackups\SIS\C\0\HashFile 24 bytes
File C:\RRbackups\SIS\C\0\TOCFile 2440 bytes

—- EOF - GMER 1.0.15 —-

LDTate

Post #2January 28, 2010, 11:14 PM UTC

[external image: Posted Image]

DO NOT use any TOOLS such as Combofix, Vundofix, or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

XP Users

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.

Please do not delete anything unless instructed to.

We've been seeing some Java infections lately.
Go here and follow the instructions to clear your Java Cache

Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download ComboFix from one of these locations:

Link 1
Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.

Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.

Note: If you have SP3, use the SP2 package.If Vista or Windows 7, skip the Recovery Console part
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Also please describe how your computer behaves at the moment.

billoak

Post #3January 29, 2010, 2:24 PM UTC

When I tried to access my control panel either through start or my computer, I am getting a BSOD. I did note that ATF has a java cache botton on it and it did run successfully. Combo fix aslo ran successfully and here is the log: ComboFix 10-01-28.05 - Administrator 01/29/2010 8:54.3.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.653 [GMT -5:00] Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} . ((((((((((((((((((((((((( Files Created from 2009-12-28 to 2010-01-29 ))))))))))))))))))))))))))))))) . 2010-01-29 13:51 . 2010-01-29 13:51 ——– d—–w- c:\documents and settings\Admin\Local Settings\Application Data\WMTools Downloaded Files 2010-01-28 22:39 . 2010-01-28 22:39 ——– d—–w- c:\documents and settings\Admin\Application Data\Malwarebytes 2010-01-28 18:26 . 2010-01-28 20:29 ——– d—–w- C:\SAV32CLI 2010-01-28 17:24 . 2010-01-28 17:24 ——– d-sh–w- c:\documents and settings\Admin\PrivacIE 2010-01-27 22:04 . 2010-01-27 22:04 ——– d-sh–w- c:\documents and settings\Admin\IETldCache 2010-01-27 15:04 . 2010-01-27 15:04 ——– d—–w- c:\program files\Trend Micro 2010-01-27 14:10 . 2010-01-27 14:10 ——– d—–w- c:\program files\Enigma Software Group 2010-01-27 14:03 . 2010-01-27 14:03 ——– d—–w- c:\program files\CCleaner 2010-01-26 19:59 . 2010-01-26 19:59 ——– d—–w- C:\found.000 2010-01-26 13:49 . 2010-01-26 13:49 ——– d—–w- c:\documents and settings\Administrator.SAMCOL137M.000\Local Settings\Application Data\Mozilla 2010-01-25 19:41 . 2010-01-25 19:41 ——– d-sh–w- c:\documents and settings\Administrator.SAMCOL137M\IETldCache 2010-01-25 18:59 . 2010-01-25 19:11 ——– d—–w- c:\program files\Windows Live Safety Center 2010-01-25 18:16 . 2010-01-25 18:16 ——– d—–w- c:\documents and settings\kfields\Application Data\GlarySoft 2010-01-25 18:14 . 2010-01-25 18:14 ——– d—–w- c:\program files\Glary Registry Repair 2010-01-25 16:17 . 2010-01-25 16:17 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes 2010-01-25 16:16 . 2010-01-25 16:16 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache 2010-01-25 15:48 . 2010-01-25 15:48 ——– d—–w- C:\cd748601febe8789e8d3b1e2e22f 2010-01-21 20:30 . 2010-01-21 20:30 5115823 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe 2010-01-21 20:29 . 2010-01-21 20:29 ——– d—–w- c:\documents and settings\kfields\Application Data\Malwarebytes 2010-01-21 20:29 . 2010-01-07 21:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-01-21 20:29 . 2010-01-07 21:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-01-21 20:29 . 2010-01-21 20:29 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-01-21 20:29 . 2010-01-27 14:58 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-01-21 20:28 . 2009-11-21 15:51 471552 ——w- c:\windows\system32\dllcache\aclayers.dll 2010-01-20 17:11 . 2010-01-21 20:31 24240 —-a-w- c:\windows\fs1235.dat 2010-01-20 16:56 . 2010-01-20 16:56 ——– d—–w- c:\documents and settings\kfields\Application Data\MSNInstaller . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-01-26 16:47 . 2009-09-10 10:53 806 —-a-w- c:\windows\system32\drivers\SYMEVENT.INF 2010-01-26 16:47 . 2009-09-10 10:53 8014 —-a-w- c:\windows\system32\drivers\SYMEVENT.CAT 2010-01-26 16:47 . 2009-09-10 10:53 48776 —-a-w- c:\windows\system32\S32EVNT1.DLL 2010-01-26 16:47 . 2009-09-10 10:53 115000 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS 2010-01-26 14:03 . 2009-01-21 21:09 ——– d—–w- c:\program files\ESET 2010-01-20 16:58 . 2009-04-29 17:27 ——– d—–w- c:\program files\Zylom Games 2010-01-03 23:50 . 2009-12-02 12:32 79488 —-a-w- c:\documents and settings\kfields\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll 2009-12-21 19:14 . 2006-04-30 06:56 916480 ——w- c:\windows\system32\wininet.dll 2009-11-21 15:51 . 2006-04-30 06:55 471552 —-a-w- c:\windows\AppPatch\aclayers.dll . ((((((((((((((((((((((((((((( SnapShot@2010-01-26_17.04.04 ))))))))))))))))))))))))))))))))))))))))) . + 2010-01-28 20:35 . 2010-01-28 20:35 16384 c:\windows\Temp\Perflib_Perfdata_2fc.dat + 2004-12-07 14:11 . 2004-12-07 14:11 258352 c:\windows\system32\unicows.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2] 2006-09-06 07:37 34344 ——w- c:\program files\Lenovo\HOTKEY\notifyf2.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey] 2006-12-14 02:06 28672 ——w- c:\program files\Lenovo\HOTKEY\tphklock.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk] backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] c:\windows\system32\dumprep 0 -k [X] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2008-10-15 05:04 39792 ——w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] 2008-04-14 00:12 15360 ——w- c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA] 2006-02-02 12:20 122940 ——w- c:\windows\system32\DLA\DLACTRLW.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\egui] 2008-10-25 01:50 1451264 ——w- c:\program files\ESET\ESET NOD32 Antivirus\egui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GoBoingo] 2007-10-02 21:51 324912 ——w- c:\program files\Alltel\GoBoingo\AlltelWifi.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] 2007-09-07 01:27 162328 ——w- c:\windows\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] 2007-09-07 01:27 141848 ——w- c:\windows\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] 2004-07-27 23:50 221184 ——w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] 2004-07-27 23:50 81920 ——w- c:\program files\Common Files\Installshield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] 2008-04-14 00:12 1695232 ——w- c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence] 2007-09-07 01:27 137752 ——w- c:\windows\system32\igfxpers.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2009-05-20 14:50 148888 ——w- c:\program files\Java\jre6\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPHOTKEY] 2007-03-09 05:49 66176 ——w- c:\program files\Lenovo\HOTKEY\TPOSDSVC.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrackPointSrv] 2007-04-26 12:14 91184 ——w- c:\windows\system32\tp4serv.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TVT Scheduler Proxy] 2007-07-12 03:53 540672 ——w- c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [3/13/2008 4:52 PM 34824] R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [10/24/2008 8:51 PM 468224] R2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\Lenovo\Rescue and Recovery\rrpservice.exe [7/11/2007 10:38 PM 569344] R3 Tp4Track;PS/2 TrackPoint Driver;c:\windows\system32\drivers\tp4track.sys [5/10/2007 11:34 AM 22832] R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [5/22/2007 5:59 PM 30336] S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [1/21/2010 3:29 PM 38224] S3 PTDLBus;PANTECH UM175AL Composite Device Driver;c:\windows\system32\drivers\PTDLBus.sys [9/10/2009 6:58 AM 32256] S3 PTDLMdm;PANTECH UM175AL Drivers;c:\windows\system32\drivers\PTDLMdm.sys [9/10/2009 6:58 AM 41344] S3 PTDLVsp;PANTECH UM175AL Diagnostic Port;c:\windows\system32\drivers\PTDLVsp.sys [9/10/2009 6:58 AM 39936] S3 PTDLWWAN;PANTECH UM175AL WWAN Driver;c:\windows\system32\drivers\PTDLWWAN.sys [9/10/2009 6:58 AM 59776] — Other Services/Drivers In Memory — *NewlyCreated* - COMHOST [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 . Contents of the 'Scheduled Tasks' folder 2010-01-29 c:\windows\Tasks\User_Feed_Synchronization-{74E11EEF-E49E-4282-8BB5-DC6449E706E3}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 08:31] . . ——- Supplementary Scan ——- . uStart Page = hxxp://lenovo.live.com FF - ProfilePath - c:\documents and settings\Administrator.SAMCOL137M.000\Application Data\Mozilla\Firefox\Profiles\15haekp5.default\ FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ . ************************************************************************** scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: ************************************************************************** . ——————— DLLs Loaded Under Running Processes ——————— - - - - - - - > 'winlogon.exe'(1288) c:\program files\Lenovo\HOTKEY\tphklock.dll - - - - - - - > 'explorer.exe'(1876) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll . Completion time: 2010-01-29 09:01:29 ComboFix-quarantined-files.txt 2010-01-29 14:01 ComboFix2.txt 2010-01-26 21:29 ComboFix3.txt 2010-01-26 17:07 Pre-Run: 40,810,344,448 bytes free Post-Run: 40,781,369,344 bytes free - - End Of File - - C25C20521BFF8DE92692AB4F11CDA76E I presume I have the same BSOD problem from control panel, but I wanted to respond while things were good. I will manipulate a few things and post again any changes I note. Thank you.

billoak

Post #4January 30, 2010, 2:14 AM UTC

I continue to have BSOD's What's next? No substantive change to date.

LDTate

Post #5January 31, 2010, 9:50 PM UTC

I would suggest you get rid of some of those daily backups or your hard drive will be full from all the backups. That has to be one of the dumbest things I've ever seen. if you run RnR from Start –> Programs –> ThinkVantage –> Rescue and Recovery, you will have a user interface in the advanced menu that will allow you to set the number of backups to keep, and delete backups. If you reduce the number of backups in "Preferences" and take a new backup, RnR will automatically do the deletes for you.

billoak

Post #6February 1, 2010, 12:23 AM UTC

OK so I've eliminated them. I am still trying to get rid of this virus. I ran exehelper and got Malwarebytes to run a little better. It showed three infections then I got a BSOD after scanning 50,000 files. I didn't get a log so I am sure I am still infected.

LDTate

Post #7February 1, 2010, 12:31 AM UTC

Do you have your windows CD? I'd keep try to run MBAM until it finishes.

billoak

Post #8February 1, 2010, 1:39 AM UTC

Any tools besides exehelper you might suggest?

LDTate

Post #9February 1, 2010, 1:47 AM UTC

The infection might have corrupted some windows files causing the BSOD.
exeHelper only repairs the usage of exe files.

Try this

You can use windows sfc (system file checker) You'd need your XP CD to make this work.
Click Start> Run> type sfc /scannow Note the space.
(Note that there is a space between sfc and /scannow)

LDTate

Post #10February 2, 2010, 8:03 PM UTC

Do you still need help with this?

billoak

Post #11February 3, 2010, 9:24 PM UTC

Please close this topic. We are going to do a rebuild. The SFC generated a BSOD and I have lost patience with it.

LDTate

Post #12February 3, 2010, 9:32 PM UTC

Thanks for posting back and letting us know

Peace be with you

✨ Ask AI

Ask AI