This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

I cant stop the pop ups

41 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

I am having trouble as the above title says with pops ups, I have created a hijack this log as follows:

Logfile of HijackThis v1.99.1
Scan saved at 18:36:24, on 23/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9IE.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\CNYHKey.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
C:\Program Files\HP DVD\Umbrella\DVDTray.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\BitTorrent\bittorrent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Documents and Settings\Alan\Local Settings\Temp\HijackThis.exe
C:\Program Files\MSN Messenger\msnmsgr.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo RX700 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9IE.EXE /P31 "EPSON Stylus Photo RX700 Series" /O6 "USB003" /M "Stylus Photo RX700"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP DVD\Umbrella\DVDTray.exe"
O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP DVD\Umbrella\DVDBitSet.exe" /NOUI
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [exit active soft stop] C:\Documents and Settings\All Users\Application Data\link mapi exit active\Softatom.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Browse Seek] C:\DOCUME~1\Alan\APPLIC~1\LONGBA~1\pop ball comp.exe
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com
O16 - DPF: {22E5D91F-89E6-4405-AD9C-0AF27BA6F06B} (HidInputMonitorX Control) - file://F:\components\hidinputmonitorx.ocx
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.co.uk/SnapfishUKActivia.cab
O16 - DPF: {4F63D44B-6274-4D60-8AB1-CAA7116B8AF3} (A9Helper.A9) - file://F:\components\A9.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1093109310562
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1135982120828
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - https://www-secure.symantec.com/techsupp/as…rl/SymAData.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe


I hope you can help me with this problem.

Krysia
Hi! :wavey: and welcome to the Tom Coyote forums.
My name is John Brouwer - if it helps, you can call me John for short. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.

Please be patient and I'd be grateful if you would note the following:
  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for this issue on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
Greets, John.
Hi,

You've got the malware called LOP. There's a special tool to remove it.

Step 1: Move HijackThis
You currently are running HijackThis from here:
C:\Documents and Settings\Alan\Local Settings\Temp

Please (redownload Hijackthis if you can't find the old one and) make a folder here:
c:\HJT
and place HijackThis in that folder.

DO NOT follow the steps below until you have moved HijackThis.

Step 2: Download and Run NoLop
Download NoLop.exe to your Desktop.
  • First close any other programs you have running as this will require a reboot
  • Double click NoLop.exe to run it.
  • Now click the button labelled "Search and Destroy"
    <>
  • When scanning is finished you will be prompted to reboot only if infected, Click OK
  • Now click the "REBOOT" Button.
  • A Message should popup from NoLop. If not, double click the program again and it will finish.
  • Please post the contents of C:\NoLop.log later.
NOTE :
  • If you receive an error, "mscomctl.ocx or one of its dependencies are not correctly registered," please download mscomctl.ocx to C:\WINDOWS\system32\ folder then rerun the program.
Step 3: Post C:\NoLop.log together with a new HijackThis log.

Greets, John.
Hi John did as requested, log files as below, noticed a box open like a pop up, but just blank, any ideas ? thanks for the help

NoLop! Log by Skate_Punk_21

Fix running from: C:\Documents and Settings\[removed]\Desktop
[23/01/2007]
[20:52:56]

—Infection Files Found/Removed—
C:\WINDOWS\tasks\A8F5C432909A7F86.job

Beginning Removal…
Rebooting…
Removing Lop's Leftover Files/Folders…
Editing Registry…
**Fix Complete!**

—Listing AppData sub directories—

C:\Documents and Settings\Alan\Application Data\Adobe
C:\Documents and Settings\Alan\Application Data\Adobeum – EMPTY Directory
C:\Documents and Settings\Alan\Application Data\Ahead
C:\Documents and Settings\Alan\Application Data\Apple Computer
C:\Documents and Settings\Alan\Application Data\Arcsoft
C:\Documents and Settings\Alan\Application Data\Bittorrent
C:\Documents and Settings\Alan\Application Data\Canon
C:\Documents and Settings\Alan\Application Data\Cyberlink
C:\Documents and Settings\Alan\Application Data\Epson
C:\Documents and Settings\Alan\Application Data\Ftw
C:\Documents and Settings\Alan\Application Data\Google
C:\Documents and Settings\Alan\Application Data\Help – EMPTY Directory
C:\Documents and Settings\Alan\Application Data\Identities
C:\Documents and Settings\Alan\Application Data\Jasc Software Inc
C:\Documents and Settings\Alan\Application Data\Lavasoft
C:\Documents and Settings\Alan\Application Data\Leadertech
C:\Documents and Settings\Alan\Application Data\Longbarbeggs
C:\Documents and Settings\Alan\Application Data\Macromedia
C:\Documents and Settings\Alan\Application Data\Microsoft
C:\Documents and Settings\Alan\Application Data\Microsoft Web Folders – EMPTY Directory
C:\Documents and Settings\Alan\Application Data\Msn6
C:\Documents and Settings\Alan\Application Data\Od2
C:\Documents and Settings\Alan\Application Data\Real
C:\Documents and Settings\Alan\Application Data\Skype
C:\Documents and Settings\Alan\Application Data\Snapfish
C:\Documents and Settings\Alan\Application Data\Sonic
C:\Documents and Settings\Alan\Application Data\Sun
C:\Documents and Settings\Alan\Application Data\Symantec
C:\Documents and Settings\Alan\Application Data\Torrent101
C:\Documents and Settings\Alan\Application Data\Vlc
C:\Documents and Settings\Alan\Application Data\Yahoo!
C:\Documents and Settings\All Users\Application Data\Adobe
C:\Documents and Settings\All Users\Application Data\Ahead
C:\Documents and Settings\All Users\Application Data\Apple Computer
C:\Documents and Settings\All Users\Application Data\Cyberlink
C:\Documents and Settings\All Users\Application Data\Dvd Shrink
C:\Documents and Settings\All Users\Application Data\Link Mapi Exit Active
C:\Documents and Settings\All Users\Application Data\Microsoft
C:\Documents and Settings\All Users\Application Data\Msn6
C:\Documents and Settings\All Users\Application Data\Muvee Technologies
C:\Documents and Settings\All Users\Application Data\Od2
C:\Documents and Settings\All Users\Application Data\Quicktime
C:\Documents and Settings\All Users\Application Data\Skype – EMPTY Directory
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
C:\Documents and Settings\All Users\Application Data\Symantec
C:\Documents and Settings\All Users\Application Data\Udl
C:\Documents and Settings\All Users\Application Data\Viewpoint
C:\Documents and Settings\All Users\Application Data\Whitecap (holiday Edition)
C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
C:\Documents and Settings\All Users\Application Data\Yahoo!
C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
C:\Documents and Settings\Default User\Application Data\Adobe
C:\Documents and Settings\Default User\Application Data\Adobeum – EMPTY Directory
C:\Documents and Settings\Default User\Application Data\Ahead
C:\Documents and Settings\Default User\Application Data\Cyberlink
C:\Documents and Settings\Default User\Application Data\Help – EMPTY Directory
C:\Documents and Settings\Default User\Application Data\Identities
C:\Documents and Settings\Default User\Application Data\Macromedia
C:\Documents and Settings\Default User\Application Data\Microsoft
C:\Documents and Settings\Default User\Application Data\Real
C:\Documents and Settings\Localservice\Application Data\Microsoft
C:\Documents and Settings\Localservice\Application Data\X10 Commander
C:\Documents and Settings\Networkservice\Application Data\Microsoft
C:\Documents and Settings\Owner\Application Data\Real

Logfile of HijackThis v1.99.1
Scan saved at 21:12:04, on 23/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9IE.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\CNYHKey.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
C:\Program Files\HP DVD\Umbrella\DVDTray.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo RX700 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9IE.EXE /P31 "EPSON Stylus Photo RX700 Series" /O6 "USB003" /M "Stylus Photo RX700"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP DVD\Umbrella\DVDTray.exe"
O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP DVD\Umbrella\DVDBitSet.exe" /NOUI
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [exit active soft stop] C:\Documents and Settings\All Users\Application Data\link mapi exit active\Softatom.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Browse Seek] C:\DOCUME~1\Alan\APPLIC~1\LONGBA~1\pop ball comp.exe
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com
O16 - DPF: {22E5D91F-89E6-4405-AD9C-0AF27BA6F06B} (HidInputMonitorX Control) - file://F:\components\hidinputmonitorx.ocx
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.co.uk/SnapfishUKActivia.cab
O16 - DPF: {4F63D44B-6274-4D60-8AB1-CAA7116B8AF3} (A9Helper.A9) - file://F:\components\A9.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1093109310562
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1135982120828
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - https://www-secure.symantec.com/techsupp/as…rl/SymAData.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
Hi,

Step 1: Remove bad HijackThis entries
  • Run HijackThis
  • Click on the Scan button
  • Put a check beside all of the items listed below (if present):

    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [exit active soft stop] C:\Documents and Settings\All Users\Application Data\link mapi exit active\Softatom.exe
    O4 - HKCU\..\Run: [Browse Seek] C:\DOCUME~1\Alan\APPLIC~1\LONGBA~1\pop ball comp.exe

  • Close all open windows and browsers/email, etc…
  • Click on the "Fix Checked" button
  • When completed, close the application.
Step 2: Show your hidden files
To enable the viewing of Hidden files follow these steps:
  • Close all programs so that you are at your desktop.
  • Double-click on the My Computer icon (or click Start, then select My Computer)
  • Select the Tools menu and click Folder Options.
  • After the new window appears select the View tab.
  • Put a checkmark in the checkbox labeled Display the contents of system folders.
  • Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
  • Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
  • Remove the checkmark from the checkbox labeled Hide protected operating system files.
  • Press the Apply button and then the OK button and shutdown My Computer.
    Now your computer is configured to show all hidden files.
Step 3: Delete bad folders
Use Explorer to navigate to and delete the following folders (if present):

C:\Documents and Settings\Alan\Application Data\Longbarbeggs
C:\Documents and Settings\All Users\Application Data\Link Mapi Exit Active

Now just exit Explorer.

Step 4: Update Java
Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java™ SE Runtime Environment 6.
  • Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement".
  • The page will refresh.
  • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on the download to install the newest version.
Step 5: Post a new HijackThis log
Also tell me if you're still having any problems.

Greets, John.
John, have done as suggested, except step 3, wont let me delete the link mapi exit active folder, tells me the the two files are active or in use by another these arecalled Eachhtmcurb and Softatom.exe, so i have stopped at that point, and also still getting the pop ups K
After removing java and restarting and installing new jr2e was able to remove the mapi folder mentioned before, so here is the newest log:


Logfile of HijackThis v1.99.1
Scan saved at 23:09:55, on 24/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9IE.EXE
C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\CNYHKey.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
C:\Program Files\HP DVD\Umbrella\DVDTray.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo RX700 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9IE.EXE /P31 "EPSON Stylus Photo RX700 Series" /O6 "USB003" /M "Stylus Photo RX700"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP DVD\Umbrella\DVDTray.exe"
O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP DVD\Umbrella\DVDBitSet.exe" /NOUI
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Browse Seek] C:\DOCUME~1\Alan\APPLIC~1\LONGBA~1\pop ball comp.exe
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com
O16 - DPF: {22E5D91F-89E6-4405-AD9C-0AF27BA6F06B} (HidInputMonitorX Control) - file://F:\components\hidinputmonitorx.ocx
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.co.uk/SnapfishUKActivia.cab
O16 - DPF: {4F63D44B-6274-4D60-8AB1-CAA7116B8AF3} (A9Helper.A9) - file://F:\components\A9.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1093109310562
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1135982120828
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - https://www-secure.symantec.com/techsupp/as…rl/SymAData.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
Hi,

I think you've forgotten some lines.

Step 1: Remove bad HijackThis entries
  • Run HijackThis
  • Click on the Scan button
  • Put a check beside all of the items listed below (if present):

    O4 - HKCU\..\Run: [Browse Seek] C:\DOCUME~1\Alan\APPLIC~1\LONGBA~1\pop ball comp.exe
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

  • Close all open windows and browsers/email, etc…
  • Click on the "Fix Checked" button
  • When completed, close the application.
Step 2: Update Adobe Acrobat Reader
If you don't have to reboot in this process please do it manually.

Step 3: Delete bad folder
Use Explorer to navigate to and delete the following folder (if present):

C:\Documents and Settings\Alan\Application Data\Longbarbeggs

Now just exit Explorer.

Step 4: Post another HijackThis log

Greets, John.
Hi John, followed the instructions, so heres the latest log


Logfile of HijackThis v1.99.1
Scan saved at 21:58:48, on 27/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\CNYHKey.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
C:\Program Files\HP DVD\Umbrella\DVDTray.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\BitTorrent\bittorrent.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo RX700 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9IE.EXE /P31 "EPSON Stylus Photo RX700 Series" /O6 "USB003" /M "Stylus Photo RX700"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP DVD\Umbrella\DVDTray.exe"
O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP DVD\Umbrella\DVDBitSet.exe" /NOUI
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com
O16 - DPF: {22E5D91F-89E6-4405-AD9C-0AF27BA6F06B} (HidInputMonitorX Control) - file://F:\components\hidinputmonitorx.ocx
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.co.uk/SnapfishUKActivia.cab
O16 - DPF: {4F63D44B-6274-4D60-8AB1-CAA7116B8AF3} (A9Helper.A9) - file://F:\components\A9.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1093109310562
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1135982120828
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - https://www-secure.symantec.com/techsupp/as…rl/SymAData.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
Hi,

Lets do a last check to see if everything is clean.

Step 1: Update Adobe Reader
It looks like your version of Adobe Reader is still out of date and you're vulnarable for infections.
Please download the newest version here:
http://www.adobe.com/uk/products/reader/

Install it, then go to Add Remove Programs and remove any older versions that may remain.

Step 2: Download and Run ATF Cleaner
Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it.

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache

*The other boxes are optional*
Then click the Empty Selected button.

Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

Step 3: Run Panda Online Scan
Run Panda's ActiveScan from here and perform a full system scan.
- Once you are on the Panda site click the "Scan your PC" button
- A new window will open…click the big "Check Now" button
- Enter your Country
- Enter your State/Province
- Enter your e-mail address and click send
- Select either Home User or Company
- Click the big Scan Now button
- If it wants to install an ActiveX component allow it
- It will start downloading the files it requires for the scan (Note: It will take a couple minutes)
- Click on "Local Disks" to start the scan
- Save the log file to your desktop

Step 4: Run Kaspersky Online Scan
Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky,
Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
    Extended (if available otherwise Standard)
    • Scan Options:
    Scan Archives Scan Mail Bases
  • Click OK
  • Now under select a target to scan:Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
    • Now click on the Save as Text button:
  • Save the file to your desktop.
Step 5: Post logs
* Panda log
* Kaspersky log
Also tell me if you're still having problems.

Greets, John.
Hi John, have so far done everything upto and including the panda scan, still to do the kapersky scan, when i ran the atf, was unable to run the firefox and opera option as they were greyed out, i will post again when i have done the kapersky scan, thanks
Hi John here is the kapersky scan results, i will post the panda one later KASPERSKY ONLINE SCANNER REPORT Friday, February 02, 2007 10:06:10 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 2/02/2007 Kaspersky Anti-Virus database records: 264247 Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ K:\ L:\ Scan Statistics: Total number of scanned objects: 78395 Number of viruses found: 7 Number of infected objects: 156 / 0 Number of suspicious objects: 4 Duration of the scan process: 01:38:46 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\Alan\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Alan\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\Alan\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Alan\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Alan\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Alan\Local Settings\History\History.IE5\MSHist012007020220070203\index.dat Object is locked skipped C:\Documents and Settings\Alan\Local Settings\Temp\Perflib_Perfdata_63c.dat Object is locked skipped C:\Documents and Settings\Alan\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Alan\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Alan\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Alan\UserData\index.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\muvee Technologies\030625\0203\0200\values Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Confid.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Content.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Privacy.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Restrict.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\WebHist.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2007-02-02_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0C3B65A6.tmp Infected: Worm.Win32.VB.an skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\13CD79DA.htm Infected: Trojan-Downloader.HTML.Agent.aq skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\16821974.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\16821974.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\16821974.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\27D46A70.tmp Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\28093215.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\28093215.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\28093215.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\28153228.tmp/[From [removed]][Date Tue, 13 Dec 2005 11:27:26 +0000]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\28153228.tmp/[From [removed]][Date Tue, 13 Dec 2005 11:27:26 +0000]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\28153228.tmp Mail: suspicious - 2 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\28153228.tmp CryptFF: suspicious - 2 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\283A27DF.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\283A27DF.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\283A27DF.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\285477C2.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\285477C2.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\285477C2.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\286873AD.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\286873AD.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\286873AD.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\287B6F97.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\287B6F97.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\287B6F97.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2A1448DB.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2A1448DB.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2A1448DB.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2A6D367A.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2A6D367A.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2A6D367A.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2A835C61.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2A835C61.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2A835C61.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2A97584B.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2A97584B.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2A97584B.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\31846572.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\31846572.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\31846572.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\338706B3.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\338706B3.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\338706B3.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3D0A61A1.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3D0A61A1.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3D0A61A1.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3D1E2502.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3D1E2502.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3D1E2502.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3D3E0168.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3D3E0168.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3D3E0168.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3D487F5D.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3D487F5D.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3D487F5D.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3D527D52.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3D527D52.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3D527D52.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3D764B2B.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3D764B2B.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3D764B2B.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3FBE517E.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3FBE517E.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3FBE517E.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3FEB1D4B.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3FEB1D4B.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3FEB1D4B.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3FF51B41.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3FF51B41.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3FF51B41.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3FFF1936.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3FFF1936.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3FFF1936.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4009172B.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4009172B.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4009172B.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\40F06BED.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\40F06BED.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\40F06BED.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\41F934CA.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\41F934CA.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\41F934CA.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\420C30B5.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\420C30B5.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\420C30B5.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\422D5491.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\422D5491.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\422D5491.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\42544C66.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\42544C66.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\42544C66.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\454F363B.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\454F363B.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\454F363B.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\46235F52.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\46235F52.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\46235F52.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\46300743.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\46300743.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\46300743.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\463A0539.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\463A0539.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\463A0539.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\47275F1C.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\47275F1C.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\47275F1C.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\537D4902.tmp/details.txt .pif Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\537D4902.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\537D4902.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\54062C6B.tmp/data.rtf .scr Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\54062C6B.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\54062C6B.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\542E2440.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\542E2440.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\542E2440.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\54900FD4.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\54900FD4.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\54900FD4.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\61C95985.tmp/data.rtf .scr Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\61C95985.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\61C95985.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\69EB1362.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\69EB1362.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\69EB1362.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6A805C5D.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6A805C5D.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6A805C5D.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6ABF3C78.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6ABF3C78.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6ABF3C78.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6AD51FFF.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6AD51FFF.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6AD51FFF.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6C5D2F0D.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6C5D2F0D.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6C5D2F0D.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6CCC4293.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6CCC4293.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6CCC4293.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\744F524C.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\744F524C.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\744F524C.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\793A3402.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\793A3402.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\793A3402.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\798579B0.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\798579B0.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\798579B0.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\79A3738F.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\79A3738F.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\79A3738F.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\79C3176B.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\79C3176B.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\79C3176B.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\79D85BDC.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\79D85BDC.tmp ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\79D85BDC.tmp CryptFF: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBConfig.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDebug.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDetect.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBNotify.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBRefr.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg2.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetDev.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetLoc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetUsr.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBStHash.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBValid.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPPolicy.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStart.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStop.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtErEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\94F3A63D.TMP Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\F622715B.TMP Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtMoEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtNvEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtScEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtTxFEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtViEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SubEng\submissions.idx Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Common Files\Symantec Shared\AntiSpam\Log\Spam.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped C:\Program Files\Common Files\Symantec Shared\NFWEVT.LOG Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\AVApp.log Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\AVError.log Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\AVVirus.log Object is locked skipped C:\RECYCLER\NPROTECT\00000923.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00000924.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00000929.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00000930.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00000931.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00000932.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00000942.edb Object is locked skipped C:\RECYCLER\NPROTECT\00000958.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00000959.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001028.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001029.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001038.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00001039.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00001045.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001046.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001048.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001049.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001051.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001052.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001053.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001054.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001055.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001056.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001057.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001058.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001059.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001060.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001062.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001063.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001064.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001065.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001066.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001067.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001068.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001069.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001071.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001072.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001074.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001075.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001076.edb Object is locked skipped C:\RECYCLER\NPROTECT\00001077.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001078.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001079.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001080.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001081.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001082.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001084.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001085.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001087.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001088.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001089.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001090.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001091.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001092.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001093.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001094.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001096.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001097.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001098.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001099.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001100.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001101.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001105.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001106.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001108.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001109.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001110.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001111.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001112.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001113.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001115.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001116.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001118.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001119.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001120.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001121.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001122.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001123.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001124.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001125.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001126.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001127.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001129.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001130.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001131.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001132.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001133.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001134.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001135.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001136.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001138.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001139.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001140.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001141.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001142.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001143.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001145.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001146.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001148.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001149.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001150.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001151.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001152.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001153.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001154.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001155.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001160.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001161.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001162.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001163.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001164.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001165.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001166.xls Object is locked skipped C:\RECYCLER\NPROTECT\00001167.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001168.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001171.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001172.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001173.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001174.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001175.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001176.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001177.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001178.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001179.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001180.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001182.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001183.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001184.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001185.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001186.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001187.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001188.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001189.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001194.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001195.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001196.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001197.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001199.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001200.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001201.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001202.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001203.xls Object is locked skipped C:\RECYCLER\NPROTECT\00001204.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001205.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001207.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001208.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001212.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001213.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001214.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001215.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001216.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001217.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001219.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001220.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001222.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001223.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001224.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001225.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001226.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001227.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001228.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001229.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001231.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001232.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001233.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001234.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001235.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001236.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001237.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001238.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001240.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001241.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001242.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001243.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001244.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001245.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001246.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001247.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001249.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001250.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001252.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001253.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001254.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001255.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001256.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001257.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001258.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001259.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001260.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001261.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001263.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001264.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001265.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001266.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001267.xls Object is locked skipped C:\RECYCLER\NPROTECT\00001268.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001269.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001270.xls Object is locked skipped C:\RECYCLER\NPROTECT\00001271.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001272.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001277.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001278.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001279.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001280.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001281.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001282.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001284.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001285.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001287.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001288.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001289.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001290.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001291.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001292.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001293.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001294.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001296.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001297.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001298.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001299.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001300.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001301.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001302.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001303.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001305.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001306.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001308.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001309.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001310.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001311.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001312.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001313.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001315.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001316.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001317.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001318.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001319.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001320.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001321.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001322.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001327.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001328.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001329.xls Object is locked skipped C:\RECYCLER\NPROTECT\00001330.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001331.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001332.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001333.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001334.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001335.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001336.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001337.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001340.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001341.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001342.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001343.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001344.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001345.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001346.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001347.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001349.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001350.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001351.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001352.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001353.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001354.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001355.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001356.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001357.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001358.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001360.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001361.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001363.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001364.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001365.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001366.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001367.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001368.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001370.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001371.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001372.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001373.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001374.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001375.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001376.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001377.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001381.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001382.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001384.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001385.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001386.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001387.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001388.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001389.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001390.xls Object is locked skipped C:\RECYCLER\NPROTECT\00001391.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001392.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001394.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001395.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001396.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001397.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001398.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001399.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001401.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001402.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001403.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001404.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001406.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001407.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001408.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001409.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001410.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001411.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001413.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001414.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001415.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001416.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001417.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001418.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001419.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001420.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001425.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001426.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001427.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001428.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001429.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001430.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001431.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001432.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001433.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001434.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00001436.MAP Object is locked skipped
Kapersky scan continued: wouldnt take it in one post C:\RECYCLER\NPROTECT\00002348.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002349.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002350.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002351.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002352.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002353.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002354.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002355.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002357.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002358.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002359.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002360.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002361.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002362.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002363.edb Object is locked skipped C:\RECYCLER\NPROTECT\00002364.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002365.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002368.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002369.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002371.edb Object is locked skipped C:\RECYCLER\NPROTECT\00002372.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002373.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002374.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002375.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002376.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002377.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002379.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002380.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002382.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002383.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002384.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002385.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002386.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002387.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002389.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002390.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002391.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002392.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002393.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002394.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002398 Object is locked skipped C:\RECYCLER\NPROTECT\00002399.1 Object is locked skipped C:\RECYCLER\NPROTECT\00002400.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002401.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002403.2 Object is locked skipped C:\RECYCLER\NPROTECT\00002404.3 Object is locked skipped C:\RECYCLER\NPROTECT\00002405.4 Object is locked skipped C:\RECYCLER\NPROTECT\00002406.5 Object is locked skipped C:\RECYCLER\NPROTECT\00002407.6 Object is locked skipped C:\RECYCLER\NPROTECT\00002408.7 Object is locked skipped C:\RECYCLER\NPROTECT\00002410.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002411.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002413.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002414.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002416.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002417.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002418.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002419.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002420.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002421.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002425.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002426.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002427.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002428.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002429.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002430.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002431.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002432.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002433.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002434.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002435.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002436.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002438.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002439.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002440.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002441.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002442.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002443.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002444.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002445.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002446.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002447.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002448.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002449.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002450.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002451.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002452.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002453.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002454.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002455.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002456.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002457.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002460.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002461.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002462.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002463.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002464.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002465.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002468.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002469.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002471.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002472.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002475.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002476.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002477.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002478.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002479.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002480.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002481.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002482.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002483.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002484.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002486.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002487.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002488.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002489.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002491.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002492.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002493.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002494.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002495.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002496.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002497.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002498.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002499.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002500.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002502.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002503.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002508.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002509.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002510.lo_ Object is locked skipped C:\RECYCLER\NPROTECT\00002511.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002512.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002513.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002514.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002516.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002517.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002518.edb Object is locked skipped C:\RECYCLER\NPROTECT\00002519.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002520.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002522.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002523.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002524.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002525.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002530.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002531.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002533.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002534.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002535.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002536.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002537.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002538.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002539.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002540.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002541.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002542.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002543.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002544.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002549.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002550.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002555.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002556.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002558.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002559.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002560.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002561.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002562.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002563.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002567.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002568.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002576.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002577.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002581.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002582.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002583.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002584.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002587.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00002591.dat Object is locked skipped C:\RECYCLER\NPROTECT\00002592.DIC Object is locked skipped C:\RECYCLER\NPROTECT\00002593.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00002595.DOC Object is locked skipped C:\RECYCLER\NPROTECT\00002596.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00002597.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00002598.dot Object is locked skipped C:\RECYCLER\NPROTECT\00002602.dat Object is locked skipped C:\RECYCLER\NPROTECT\00002604.dat Object is locked skipped C:\RECYCLER\NPROTECT\00002605.DIC Object is locked skipped C:\RECYCLER\NPROTECT\00002606.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00002608.DOC Object is locked skipped C:\RECYCLER\NPROTECT\00002609.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00002610.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00002611.dot Object is locked skipped C:\RECYCLER\NPROTECT\00002615.dat Object is locked skipped C:\RECYCLER\NPROTECT\00002621.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002622.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002624.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002625.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002626.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002627.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002630.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002631.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002632.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002633.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002634.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002635.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002636.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002637.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002639.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002640.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002642.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002643.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002645.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002646.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002648.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002649.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002650.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002651.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002652.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002653.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002654.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002655.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002657.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002658.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002659.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002660.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002661.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002662.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002663.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002664.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002665.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002666.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002667.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002668.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002670.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002671.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002672.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002673.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002674.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002675.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002678.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002679.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002681.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002682.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002684.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002685.MAP Object is locked skipped C:\RECYCLER\NPROTECT\00002698.DLL Object is locked skipped C:\RECYCLER\NPROTECT\00002699.SYS Object is locked skipped C:\RECYCLER\NPROTECT\00002700.INF Object is locked skipped C:\RECYCLER\NPROTECT\00002701.CAT Object is locked skipped C:\RECYCLER\NPROTECT\00002704.dat Object is locked skipped C:\RECYCLER\NPROTECT\00002705.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00002706.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00002707.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00002713.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00002714.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00002715.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00002716.isu Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{A64DEAED-BE8F-4F64-A460-DA3A545C4F5A}\RP196\A0018239.exe Infected: Trojan.Win32.Obfuscated.cg skipped C:\System Volume Information\_restore{A64DEAED-BE8F-4F64-A460-DA3A545C4F5A}\RP196\A0018240.exe Infected: Trojan.Win32.Inject.au skipped C:\System Volume Information\_restore{A64DEAED-BE8F-4F64-A460-DA3A545C4F5A}\RP199\A0018470.exe Infected: Trojan.Win32.Inject.au skipped C:\System Volume Information\_restore{A64DEAED-BE8F-4F64-A460-DA3A545C4F5A}\RP207\change.log Object is locked skipped C:\WINDOWS\$NtUninstallKB824141$\user32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB824141$\win32k.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\accwiz.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\crypt32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\cryptsvc.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\hh.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\hhctrl.ocx Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\hhsetup.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\html32.cnv Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\itss.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\locator.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\magnify.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\migwiz.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\mrxsmb.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\msconv97.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\narrator.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\newdev.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\ntdll.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\ntkrnlpa.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\ntoskrnl.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\osk.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\pchshell.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\raspptp.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\shell32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\shmedia.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\srrstr.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\srv.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\sysmain.sdb Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\user32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\win32k.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\winsrv.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\zipfldr.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826942$\dhcpcsvc.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826942$\ndis.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826942$\ndisuio.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826942$\netshell.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826942$\wzcdlg.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826942$\wzcsapi.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826942$\wzcsvc.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826942$\xpsp2res.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828028$\msasn1.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828035$\msgsvc.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828035$\wkssvc.dll Object is locked skipped C:\WINDOWS\$NtUninstallQ828026$\msdxm.ocx Object is locked skipped C:\WINDOWS\$NtUninstallQ828026$\wmp.dll Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{55E741A4-B3AB-4AE2-BA16-C652A27C837C}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\drivers\etc\Hosts.bak Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped D:\System Volume Information\_restore{A64DEAED-BE8F-4F64-A460-DA3A545C4F5A}\RP207\change.log Object is locked skipped E:\System Volume Information\_restore{A64DEAED-BE8F-4F64-A460-DA3A545C4F5A}\RP207\change.log Object is locked skipped Scan process completed.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI