What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

General Hijackthis Check Please

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hi

This system had a virus and plenty of spyware, I think I have managed to remove them all, but could do with a second opinion.

Also I've tried uninstalling msn messenger and the copy1 for the epson R320 printer, but they show up in the log? Can I let HiJackThis remove these?

Many thanks

Happy.



Logfile of HijackThis v1.99.1
Scan saved at 15:46:10, on 12/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9XE.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\Common Files\AOL\1181645405\ee\AOLSoftware.exe
C:\Program Files\AOL 8.0\aoltray.exe
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
c:\program files\common files\aol\1181645405\ee\services\antiSpywareApp\ver2_0_12\AOLSP Scheduler.exe
c:\program files\common files\aol\1181645405\ee\aolsoftware.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ww.google.co.uk/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EPSON Stylus Photo R320 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9XE.EXE /P30 "EPSON Stylus Photo R320 Series" /O6 "USB001" /M "Stylus Photo R320"
O4 - HKLM\..\Run: [EPSON Stylus Photo R320 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9XE.EXE /P39 "EPSON Stylus Photo R320 Series (Copy 1)" /O6 "USB002" /M "Stylus Photo R320"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1181645405\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - Startup: Cyber-shot Viewer Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: AOL 8.0 Tray Icon.lnk = C:\Program Files\AOL 8.0\aoltray.exe
O4 - Global Startup: NaturalColorLoad.lnk = ?
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1126260732623
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #2
Hi Happy100,

I can't see any malware in your HijackThis log, but that doesn't mean your machine is clean, so we'll do some scans to have a closer look. I'll help with uninstalling those programs after checking for malware:

Click Start->Run and type cleanmgr in the box and press OK
Ensure the boxes for Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
Press OK and Yes to confirm

Then do an online scan with Kaspersky:

Open Kaspersky Online Scanner in Internet Explorer

You will be prompted to install an ActiveX component from Kaspersky,
Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT and then Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
    Extended (if available otherwise Standard)
    • Scan Options:
    Scan Archives
    Scan Mail Bases
  • Click OK
  • Now under select a target to scan:Select My Computer
  • The program will start to scan your system.
  • Once the scan is complete, click on the Save as Text button and save the file to your desktop
Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the license, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license is accepted, reset to 100%.

Next, please download F-Secure Blacklight
  • Click I ACCEPT and download the graphical user interface version to your Desktop
  • Double click the file to run it, choose I accept the agreement then press Scan
  • It will create the fsbl-xxxxxxx.log on your desktop.
  • The log will have a list of all items found.
  • Do not choose to rename any yet! I want to see the log first because legitimate items can also be present.
  • Exit Blacklight and post the contents of the log in your next reply.
Then download Deckard's System Scanner (DSS)
  • Close all applications and windows.
  • Double-click on dss.exe to run it, and follow the prompts.
  • When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<-this one will be minimized
  • Make sure Format->Word Wrap is unchecked
  • Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and extra.txt in your reply
Once complete, please post the Kaspersky log, the Blacklight log and the DSS reports - you won't need a new HijackThis log as DSS produces one for you. The logs could be quite long so please check they aren't cut off and use multiple posts if necessary.
Post #3
Hi Silver

Many thanks for the help, I have done exactly as advised and here are the logs -

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Tuesday, June 19, 2007 1:46:57 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 19/06/2007
Kaspersky Anti-Virus database records: 349014
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 33338
Number of viruses found: 4
Number of infected objects: 7 / 0
Number of suspicious objects: 0
Duration of the scan process: 00:44:55

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\-\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\-\Local Settings\Application Data\AOL\UserProfiles\All Users\cls\common.cls Object is locked skipped
C:\Documents and Settings\-\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\-\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\-\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\-\Local Settings\Temp\dload.exe Infected: Trojan-Downloader.Win32.Small.mg skipped
C:\Documents and Settings\-\Local Settings\Temp\wnk5.exe Infected: not-a-virus:Dialer.Win32.gen skipped
C:\Documents and Settings\-\Local Settings\Temp\wnk6.exe Infected: not-a-virus:Dialer.Win32.gen skipped
C:\Documents and Settings\-\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\-\ntuser.dat Object is locked skipped
C:\Documents and Settings\-\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys06a2b0423ad7c7f62f77a062494406_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys11c3ccda3dbbff0224cb8f4f4958c7_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys32d9fb4fa8c79d1b276bd02f21434fa_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys44603de83548e24ec7b7744baf95f00_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys57aae9388c6b88942cd386cf1aa4e0e_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys8913e776af37746ff1bd83bbde07e45_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeysc709307d507262032b334e0fb5f91e0_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeysde6325438096d9ba0716cf0585b99dc_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeysf6e7f7371bb0f867460d83d2dd33603_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeysfaa171a67666aadd6b1855a47e07dc0_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\110543daa3be2887cfda3040d6affb8d_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\13179c011991bf9190d7ec1d90b0c50f_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1367375b4d0167730c65a95143ab20d2_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\137bd9c10157eacf4fd2ef2d48aa624d_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\14345ee729c5ef322c5d788e7c8ba352_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1c1a4010aa39b8338536bec61e6fafa1_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1cdb9a340f10ab1ce82fe22c40afbf39_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1d008c8693023168dc2dadfb72c00833_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1deccfdf2b64057c19185f7da9492eda_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1ec5d77615155725ab307bf79ac225bb_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1f0da5262bd0f7930d0d2222c5deaecc_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1fe11266cdf9f3dc5164059733ab02bb_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\205745129eaf30caf8e1720e9b76ded7_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\20cfe81f58aeece6dfae9d793c864b9c_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\21eec5efb713c6ef8a8aeb5a49c13af5_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\26d851f348751a8fa46efdbef7edfcbe_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\276df2dda76f70c3a49c32a37f766a8b_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\27ee0499c24c5e1143a7556d1c18ccdf_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2b971ef8ec4ed1fe4735bf4736476448_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2be32ecebdfa6da66d02d4a442cc035e_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2fafc1d6f2a5d06158a9f0895e2bdd01_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\363142937c37ece4378da4cacb2b9cc9_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\37926c30765e11b70edfff67dd84d701_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\398a89a50aba1946cba88f4ea72a02d3_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3a15873f3593ab8469ee2bf3c09a7250_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3b36e37afd51e28046fa2d9dc3c393cb_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3f35c41a7e4f4ff0444700152232645e_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3ff204ed4f109f92dd09fe1dc60d635a_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4257fd65a12a1c14ffab68dba541e5a4_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\434d6365e299f337f99f22dd4a0d8d3f_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4500873d487593e022dc90b9399ca706_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4599d8d5b9a45a47c36fb5484c9477f5_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\48fa5fed48b651fe045f6822c0a776ba_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4beffff2c2b867f27d7dd407def8402e_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4d8047c7058c97150268bc239f0b2e21_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4daf4898b6eb1b92a0a100b69c46e2b8_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4dafa82421aca1a58fb40eb42c0685aa_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4dddb402127314960272a0f70b3ee2d5_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4fef90683a3654926c102b631ef8ced5_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5302acce89275e1e4508e33318a6ce12_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\58c1cdb2a00011197a677c0bab5b075a_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5b465f2974ed9dc5b7ed0d91726ba49b_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5b6224c566d2abe2ddfd7e8432e4ef2c_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5c8bea784c99151ae65a91ddb313c1d7_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5d213ff0a0adb5f778b76a60c0e374ae_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5ff4f5b48be0a881a2027fe3e25acc18_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\65a5fdae51cef263ed9047eb6e866101_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6841929f9d7e4842e4c4ef2239fe37b8_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6a6008cd7a7c0cffa7f2317b30ee6d2a_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6b0e5eba47ee76cc8b56d20341c3ccd9_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6b2cbb3d6f06612c43303ce6edb08398_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6c54e1ec91b2943e9bcc1fa166ce4171_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6df7247fc568e7bcfa5fcd5578977fcc_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6f8a56763e602d2cc6a0f1fd08c264e3_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\70ac78bce623c00b642c9982a949730a_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\722dc336ce9373284c9bcff4af585665_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\732d189f403802ebb51afdc5dc7b5879_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\735871cc2709bad388cd029dc98ad19a_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\79035946bcb97a694b71b8fe039e6086_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\79345821a45f68009e853c8e482ca862_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7966dfb02f42c8cff938b18cbd86b70b_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7c5976382df6d73fa000e837ff331fbd_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7cb5728d5c914ac8cac156909aacdeff_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7d177deb7df2e60c50187d7d39c8ca97_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7d7f62b948e534747c1682c6bf2ec7de_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8133244fcc1b6246c01122e132840e5e_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\82ea811eecee600d233ed9415bd14ee1_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\86831ee1c6cc54f27ea0f655a541ef32_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\87c19897e1afa9c1bc41ee6067c69527_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8a0c9d321df28d2c4ddc602e136ef003_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8add0520f2d3d1078ba1d7d13a6fd5bb_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8d65b1f830a114ab330887cff9f40022_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8ecc94fd30bc7a6210aadc3e5ed426ee_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\90a46e314707fa6add10618f18e2442b_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\94bba27cddf815a1ceb6ae802c572c79_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\95c4dfa092d280c3ab7779e19d29cbdb_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\99bf4e1f8ac3dbe7d5b4e418885a8820_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9a261ddded10bb008fc7d430139250cd_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9ac6ef28afe301f6a75f6e9f30316d41_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9c78bfd4fa0c36836115afd1e87f3f26_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9cb38d624ad22c68031aaa2430995f06_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9d36ebd832d70e1b8b7996616194bace_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9e878bf9b85d08c3bd4b90ad66243b0a_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9f7666683b4706d1399ba09425fd0e08_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a0f9008d437a570767a256ff1e7a954d_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a26285e6f68412df44b1a47c9fa0840e_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ae4ba037d328626ac752a5f7109228f0_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\afb4ecadaed3078eb2e66e74073d78fc_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\afbddbbf74edb04e50e70b8c34b3289a_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b1203e207597ce25bab93efd3b47dae9_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b18558678ba7917d33dbeaffdfeee028_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b21b54692d8f7357097e3406a60a374e_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b36f03e8cfa96fad4034b36a9a10f726_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b3ce8aa3c5ec2f2a089e86c256192603_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b495a89f6d3ea1b7b396fe603b21ba4b_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b4faf19c3d957db44cdeb0bacb43c57c_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b539daebb067bae8fc98077594405029_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b59913b5c7761abffde4bf6c4d270cb9_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b815eac93791f72c5e230d65533537e6_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ba0f70ed89e49c8b44ae1804b9c35b89_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ba5ce792a10874ef437964b1f82e274f_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\badb84a4b1e171e60a43f915be9ac114_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bb6089dc3dc1e78d4149ebafc5f50068_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bb93f37d5a90d389aaf329d43d4d2d0c_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bbc78c7f598b0aa02b3e86c268d5d3de_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bcd9667e25c0f0d0952558dd57c31484_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\be6d6af73c30c5f565543699b4489013_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c08c4d6bd688c4eecbf517f983cdb10e_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c0b584384afb76a9c44da34768941c77_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c0b846b309335e6f1724c8395f1ee98d_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c55206fb2f8ab242559997c2e926270c_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c6840761e4e039ad6ef4ba8b80193e56_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c6b8b9fc2fafc32a73728dcfcf6dfe5c_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c6bdd84d70011c115c3855faa88beb35_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cbb3fa2b9519df3255e3a2fcd5ea64a0_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cdc758ee84560897916255eade1bb0dd_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cff0fd69b2ddffdc502594e771e546b3_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d2eb75872660ea991cb2fe2311c8d1de_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d3512b2bfcdd77fdff6f8a1c7a8ff5ef_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d427b9f84c8c5654cac176db39dab211_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d4e58f0d3ee99305883d71a4cf256ccc_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d63a64e6d33aa022683698dd3483e298_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d6abda9d09d138924af1dbc0dda345c8_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d6f712e793e963e9abef18d9e54de287_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d7bc1547739a0b7e797b60253aa298d4_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d9e5e91f49cc005aa4de9c11abb035a2_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\db2746c07e91858420000b2c64627f87_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\dc52f78ff8c137b544630ff60fb10f17_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\dcf5a0bf7c20b7b78ac16cd42b2cb951_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\dddacd50281d936bc9a31fe59d8b3407_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e06048b8c87da45e1c004a24a35f6a84_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e1c2de6295118d78e56a9450b2d9dbf6_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e253989ce50abd00f947f9f1a48fceae_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e4d15f204349a67eaa8fc87adb63b964_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e4eef05e93f56a7ad49d4dd99babb5d4_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e7de93be455fac23f4beabd1a2dd586e_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e8bf606b0a26c34998d4d0f981fafedd_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e8e879d115512ba27d9de371ddee5dd6_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e96c6b5ee216f9dceec7e9bec5ed8211_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e96d9c36906256a7ff9d10537e864f58_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ea3a1a5875c329b99b463077cd8f17cb_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\eacc36ba866db1a035b2f2a5d55b2ad1_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ee39cc43c78d56409596251c608e18df_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ef1e4034ebc6c2a7985f37b054af0b90_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ef3b0db9a2ff5ed8c859e430a82493f5_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f007010aacd666b031d074c490a7c159_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f0fb4c7bc6390f1634047b1d5c472e17_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f19dbfeb59b161de95b4530d91fd9144_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f3b184dfd24a2515f2b1416d5e7ba1c8_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f60f115c1e4e23f21614ff0c23069151_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f66cb822e0bac801f17baeabdfeaeff0_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f8d56a81f7277fb70c8e06fbcdf6daf5_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f8f052d4fb1152619470d556a12714b1_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f9e47770781d6b10ba06ffddffafdf8f_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\fa4badc5195f89987356a210f65662b9_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\fb04b0409c57d3ebf1f15d128b872d06_42b59f74-a9e4-41cf-9937-8f9d0e743d3f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\BOPDATA\_Date-20070619_Time-104826125_EnterceptExceptions.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\BOPDATA\_Date-20070619_Time-104826125_EnterceptRules.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Db\Agent_9ZA0TDJY4ZWXT2R.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Db\PrdMgr_9ZA0TDJY4ZWXT2R.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\AccessProtectionLog.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\BufferOverflowProtectionLog.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\OnAccessScanLog.txt Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{0E24BA01-1D3E-4BF3-AA30-B73FFFAAE545}\RP865\A0341166.exe Infected: not-a-virus:Porn-Dialer.Win32.PluginAccess skipped
C:\System Volume Information\_restore{0E24BA01-1D3E-4BF3-AA30-B73FFFAAE545}\RP866\A0341973.exe Infected: not-a-virus:Porn-Dialer.Win32.PluginAccess skipped
C:\System Volume Information\_restore{0E24BA01-1D3E-4BF3-AA30-B73FFFAAE545}\RP866\A0341974.exe Infected: not-a-virus:Porn-Dialer.Win32.PluginAccess.gen skipped
C:\System Volume Information\_restore{0E24BA01-1D3E-4BF3-AA30-B73FFFAAE545}\RP866\A0341975.exe Infected: not-a-virus:Porn-Dialer.Win32.PluginAccess skipped
C:\System Volume Information\_restore{0E24BA01-1D3E-4BF3-AA30-B73FFFAAE545}\RP869\change.log Object is locked skipped
C:\WINDOWS\$NtUninstallQ309521$\dxmasf.dll Object is locked skipped
C:\WINDOWS\$NtUninstallQ309521$\lsasrv.dll Object is locked skipped
C:\WINDOWS\$NtUninstallQ309521$\msdxm.ocx Object is locked skipped
C:\WINDOWS\$NtUninstallQ309521$\sfcfiles.dll Object is locked skipped
C:\WINDOWS\$NtUninstallQ309521$\spuninst\spuninst.exe Object is locked skipped
C:\WINDOWS\$NtUninstallQ309521$\spuninst\spuninst.inf Object is locked skipped
C:\WINDOWS\$NtUninstallQ314862$\qmgr.dll Object is locked skipped
C:\WINDOWS\$NtUninstallQ314862$\spuninst\spuninst.exe Object is locked skipped
C:\WINDOWS\$NtUninstallQ314862$\spuninst\spuninst.inf Object is locked skipped
C:\WINDOWS\$NtUninstallQ315000$\netsetup.exe Object is locked skipped
C:\WINDOWS\$NtUninstallQ315000$\spuninst\spuninst.exe Object is locked skipped
C:\WINDOWS\$NtUninstallQ315000$\spuninst\spuninst.inf Object is locked skipped
C:\WINDOWS\$NtUninstallQ315000$\ssdpapi.dll Object is locked skipped
C:\WINDOWS\$NtUninstallQ315000$\ssdpsrv.dll Object is locked skipped
C:\WINDOWS\$NtUninstallQ315000$\upnp.dll Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.



06/19/07 13:49:24 [Info]: BlackLight Engine 1.0.61 initialized
06/19/07 13:49:24 [Info]: OS: 5.1 build 2600 (Service Pack 2)
06/19/07 13:49:24 [Note]: 7019 4
06/19/07 13:49:24 [Note]: 7005 0
06/19/07 13:49:28 [Note]: 7006 0
06/19/07 13:49:28 [Note]: 7011 1100
06/19/07 13:49:29 [Note]: 7026 0
06/19/07 13:49:29 [Note]: 7026 0
06/19/07 13:49:32 [Note]: FSRAW library version 1.7.1021
06/19/07 13:56:49 [Note]: 2000 1012
06/19/07 13:56:49 [Note]: 2000 1012
06/19/07 14:05:35 [Note]: 7007 0



Deckard's System Scanner v20070611.50
Run by [removed] on 2007-06-19 at 14:06:52
Computer is in Normal Mode.
——————————————————————————–

– System Restore ————————————————————–

Successfully created a Deckard's System Scanner Restore Point.


– Last 5 Restore Point(s) –
58: 2007-06-19 13:06:56 UTC - RP871 - Deckard's System Scanner Restore Point
57: 2007-06-19 11:16:12 UTC - RP870 - System Checkpoint
56: 2007-06-12 12:47:47 UTC - RP869 - Made by Registry Mechanic
55: 2007-06-12 12:32:04 UTC - RP868 - Made by Registry Mechanic
54: 2007-06-12 12:00:08 UTC - RP867 - Software Distribution Service 2.0


– First Restore Point –
1: 2007-04-05 17:07:42 UTC - RP814 - System Checkpoint


Backed up registry hives.

Performed disk cleanup.


– HijackThis (run as -.exe) —————————————————

Logfile of HijackThis v1.99.1
Scan saved at 14:07:35, on 19/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9XE.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\Common Files\AOL\1181645405\ee\AOLSoftware.exe
C:\Program Files\AOL 8.0\aoltray.exe
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
c:\program files\common files\aol\1181645405\ee\services\antiSpywareApp\ver2_0_12\AOLSP Scheduler.exe
c:\program files\common files\aol\1181645405\ee\aolsoftware.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\-\Desktop\dss.exe
C:\PROGRA~1\HIJACK~1\-.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ww.google.co.uk/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EPSON Stylus Photo R320 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9XE.EXE /P30 "EPSON Stylus Photo R320 Series" /O6 "USB001" /M "Stylus Photo R320"
O4 - HKLM\..\Run: [EPSON Stylus Photo R320 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9XE.EXE /P39 "EPSON Stylus Photo R320 Series (Copy 1)" /O6 "USB002" /M "Stylus Photo R320"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1181645405\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - Startup: Cyber-shot Viewer Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: AOL 8.0 Tray Icon.lnk = C:\Program Files\AOL 8.0\aoltray.exe
O4 - Global Startup: NaturalColorLoad.lnk = ?
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1126260732623
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe


– File Associations ———————————————————–

All associations okay.


– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————

R1 NaiAvTdi1 - c:\windows\system32\drivers\mvstdi5x.sys
Post #4
Hi Happy100,

Those reports look pretty good, not too much to worry about here.

You have Viewpoint Media Player installed on your system. This program is not malware but it is foistware in that it is usually installed without the user's knowledge or approval, and for this reason I recommend you remove it. If you actually use this program, I recommend you try using alternatives such as VLC Player or Media Player Classic.
To remove, open Start->Control Panel->Add/Remove Programs find Viewpoint Media Player and select Remove

Make hidden/system files and folders visible:
Click Start -> My Computer
Select the Tools menu, click Folder Options and select the View tab
Under the Hidden files and folders heading SELECT Show hidden files and folders
UNCHECK the Hide protected operating system files (recommended) option
Click Yes to confirm and press OK

Use Windows Explorer to find and delete the following files (if present):
C:\Documents and Settings\-\Local Settings\Temp\dload.exe
C:\Documents and Settings\-\Local Settings\Temp\wnk5.exe
C:\Documents and Settings\-\Local Settings\Temp\wnk6.exe

Please let me know which were present and deleted in your next response.

Re-hide hidden/system files and folders:
Click Start -> My Computer
Select the Tools menu, click Folder Options and select the View tab
Under the Hidden files and folders heading SELECT Do not show hidden files and folders
CHECK the Hide protected operating system files (recommended) option
Press OK

Create a new, clean System Restore point which you can use in case of future system problems:
Press Start->All Programs->Accessories->System Tools->System Restore
Select Create a restore point, then Next, type a name like clean then press the Create button and once it's done press Close

Now remove old, infected System Restore points:
Next click Start->Run and type cleanmgr in the box and press OK
Ensure the boxes for Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
Select the More Options tab, under System Restore press Clean up… and say Yes to the prompt
Press OK and Yes to confirm

Next, re the uninstalls:
Have you already uninstalled/disabled Windows Messenger, or do you want assistance with this?
The Windows Messenger items in your HijackThis log are the Messenger toolbar button and the Tools menu item. Would you like these removed?
Please post what Epson software or related HJT entries you would like to remove.

Once complete, please let me know about the files you deleted, the information about the uninstalls and a new HijackThis log.
Post #5
Hi Siliver

I've uninstalled Viewpoint

None of those files found in C:\Documents and Settings\-\Local Settings\Temp\
wilh all the hidden files showing.

Create a new, clean System Restore point & ditched the old ones.

As for the Messenger bit in the log, I though it was something to do with MSN Messanger, which I had removed via the add/remove windows conponents.

This is the hijackthis part I want to remove -
O4 - HKLM\..\Run: [EPSON Stylus Photo R320 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9XE.EXE /P39 "EPSON Stylus Photo R320 Series (Copy 1)" /O6 "USB002" /M "Stylus Photo R320"

Some how the printer was installed twice, I've removed the copy1 from the printer and faxes folders, but wasn't sure as it was still showing in the log.

Many thanks

Happy.


Logfile of HijackThis v1.99.1
Scan saved at 20:49:58, on 20/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9XE.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\Common Files\AOL\1181645405\ee\AOLSoftware.exe
C:\Program Files\AOL 8.0\aoltray.exe
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
c:\program files\common files\aol\1181645405\ee\services\antiSpywareApp\ver2_0_12\AOLSP Scheduler.exe
c:\program files\common files\aol\1181645405\ee\aolsoftware.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ww.google.co.uk/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EPSON Stylus Photo R320 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9XE.EXE /P30 "EPSON Stylus Photo R320 Series" /O6 "USB001" /M "Stylus Photo R320"
O4 - HKLM\..\Run: [EPSON Stylus Photo R320 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9XE.EXE /P39 "EPSON Stylus Photo R320 Series (Copy 1)" /O6 "USB002" /M "Stylus Photo R320"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1181645405\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - Startup: Cyber-shot Viewer Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: AOL 8.0 Tray Icon.lnk = C:\Program Files\AOL 8.0\aoltray.exe
O4 - Global Startup: NaturalColorLoad.lnk = ?
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1126260732623
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #6
Hi Happy100,

MSN Messenger is a program which can be downloaded, installed and uninstalled as you have done. Windows Messenger is part of Windows, and is installed by default.

The IE toolbar button and Tools menu items you see in your HijackThis log:
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
are part of Windows Messenger and appear in Windows by default - they are not leftovers from your MSN Messenger installation.
If you would like more information on this let me know.

We can remove the second Epson entry with HijackThis:

Open HijackThis, choose Do a system scan only and place a checkmark next to the following line:
O4 - HKLM\..\Run: [EPSON Stylus Photo R320 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9XE.EXE /P39 "EPSON Stylus Photo R320 Series (Copy 1)" /O6 "USB002" /M "Stylus Photo R320"

Then close all open windows apart from HijackThis, press Fix checked, OK the prompt and close HijackThis.

Then please reboot and confirm your printer is working normally, post another HijackThis log and let me know if you have any further questions.
Post #7
Hi Silver

Question answered for messenger. no further information needed thanks.

Hijackthis has removed the copy1 part, printer seems ok after a restart.

Many thanks again for all your help with this.

Kind regards

Happy

Logfile of HijackThis v1.99.1
Scan saved at 10:52:59, on 21/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9XE.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\Common Files\AOL\1181645405\ee\AOLSoftware.exe
C:\Program Files\AOL 8.0\aoltray.exe
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
c:\program files\common files\aol\1181645405\ee\services\antiSpywareApp\ver2_0_12\AOLSP Scheduler.exe
c:\program files\common files\aol\1181645405\ee\aolsoftware.exe
C:\Documents and Settings\-\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ww.google.co.uk/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EPSON Stylus Photo R320 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9XE.EXE /P30 "EPSON Stylus Photo R320 Series" /O6 "USB001" /M "Stylus Photo R320"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1181645405\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - Startup: Cyber-shot Viewer Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: AOL 8.0 Tray Icon.lnk = C:\Program Files\AOL 8.0\aoltray.exe
O4 - Global Startup: NaturalColorLoad.lnk = ?
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1126260732623
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #8
Hi Happy100,

I note in your last HijackThis log you are running the program from your Desktop. This is not ideal because HijackThis makes backups of the changes it makes and they can easily be deleted if they are on the Desktop. The previous location was a subfolder of Program Files which was much better, if you are going to keep HijackThis on your system you should keep it there.

Your machine looks clean now, here are some tips to help keep it that way:

Operating system vulnerabilities can easily be exploited by malware so please ensure your operating system is automatically kept up to date by using Windows Update:
Go to Start->Control Panel->Automatic Updates
Select Automatic and select a suitable schedule
Also, check that your antivirus and antispyware programs are set to automatically update daily.

Spybot S&D is an excellent antispyware program, however I recommend you install antispyware software with real-time capabilities - this means it protects you from system changes and spyware while you are working, not removing malware after it has been installed. There are a range of paid-for and free packages available, a free one I can recommend is Windows Defender, available here:
http://www.microsoft.com/athome/security/s…re/default.mspx

You should also consider installing a Personal Firewall program. Even if you are behind a NAT router, I recommend you use firewall software as it will improve the security of your computer by monitoring and controlling outbound connections to the internet as well as inbound. There are various free packages available, such as Sunbelt Personal Firewall and Zone Alarm:
http://www.sunbelt-software.com/Home-Home-…sonal-Firewall/
http://www.zonelabs.com/

Spywareblaster is a free program which prevents the download and installation of Internet Explorer ActiveX based malware by immunizing your system against it. You can download Spywareblaster from here and a tutorial to help you get started is available here.

Please take care when downloading programs. One of the easiest ways to be infected is to download freeware/shareware programs which come laden with malware. Before downloading, it is crucial to check whether the source is reputable.
One way to check is to use McAfee SiteAdvisor. Copy the domain name into the space provided and SiteAdvisor will give you a report on the website which can help you decide if it is safe. They also have a toolbar for IE and Firefox which adds this functionality to your browser.

Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.

Find out more about how to prevent infection in the future
http://forum.malwareremoval.com/viewtopic.php?p=33687

Please post back to let me know that you have read this, and if there are any further issues.
Post #9
Hi Silver Read and understood! The links will be really useful for me and others using this forum. A really big thanks for all you help again! It has been very much appreciated. Happy. :-)
Post #10
You are very welcome and I'm glad we could be of assistance! Since this issue appears to be resolved, this topic has been closed. If you are the topic starter and need this topic reopened, please PM a staff member with a link to this thread and we will reopen it for you. Anyone else who needs assistance should begin a new topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI