22 replies to this topic

[Alwilson]

Hi my names Al
Im a newbie to this and would really appreciate anyone being able to help me.
Having read alot of postings im confidant that someone will be able to.
Many thanks in advance.

This computer is running extremely slowly.
AVG is installed
Im certain it has a trojan horse and many other nasties.

Here's the HJT Log.

Logfile of HijackThis v1.99.1
Scan saved at 6:03:09 p.m., on 6/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Compaq Connections\6750491\Program\Compaq Connections.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Owner\My Documents\downloads\hijackthis\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.nz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...a...&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.h...a...&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.h...a...&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.h...a...&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.h...a...&pf=desktop
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {8EF885C3-AB13-4DDB-953C-76EEE140F499} - C:\Program Files\Messenger\hokelo83122.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O2 - BHO: (no name) - {B613412C-CA09-42BA-B41D-4A9F1A99C60F} - C:\Program Files\Messenger\hokelo4444.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar1.01.2607.0\en-us\msntb.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\6750491\Program\Compaq Connections.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1124758260828
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D7AC582A-A8E9-4135-8141-7908B05CEA9B}: NameServer = 203.96.152.4 203.96.152.12
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

Edited by Alwilson, 06 November 2007 - 12:40 AM.

[bob4]

_________________________________
Welcome to the Forums.

The fixes we will use are specific to your problems and should only be used for this issue on this machine.

Please only use this topic to reply to. Do not start another thread.
If any other issues arise let me know.
The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear. So lets do this to the end!

• All hijackthis logs I ask for should be done in normal mode ( not safe mode)
  
• These logs should be done last after you have followed my instructions in the previous post.

Please if you decide to seek help at another forum let us know. There is a shortage of helpers and tying 2 of us up is a waste of time.
If you have any questions about any advice given here please STOP and ask!

______________________________
HJT
Run hijackthis and choose scan only and place a check by the following lines if present.
Close all other windows and browsers except HJT before clicking on Fix Checked

O2 - BHO: (no name) - {8EF885C3-AB13-4DDB-953C-76EEE140F499} - C:\Program Files\Messenger\hokelo83122.dll
O2 - BHO: (no name) - {B613412C-CA09-42BA-B41D-4A9F1A99C60F} - C:\Program Files\Messenger\hokelo4444.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar1.01.2607.0\en-us\msntb.dll (file missing)
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k


______________________________

Download and install CCleaner from here


If you use either the Firefox or Mozilla browsers, the box to uncheck for Cookies is on the Applications tab, under Firefox/Mozilla.

• Set Cookie Retention.
  Click on the Options block on the left, then choose Cookies.
  Under the Cookies to delete pane, highlight any cookies you would like to retain permanently (those companies or sites with which you regularly visit or do business), and click the right arrow > to move them to the Cookies to keep pane.
  
• Reset Temp File Removal for Regular Use.
  Click on the Options block on the left. Select the Advanced button.
  Check "Only delete files in Windows Temp folders older than 48 hours".
  
  
  Now run the program and click on Run Cleaner
  ( Do not use the Registry function to clean anything with this program. Having anything auto clean your regisrty is risky).

AVG Anti-Spyware: This is not the anti virus you already have.
________________________________________
Download the trial version of AVG Anti-Spyware from here and install it. When the program has been installed, and you click the Finish button, AVG Anti-Spyware will open. Do not run a scan yet.

If the program does not automatically update itself during installation, or you are unsure whether it has done so, please do the following:

• Click the Update icon at the top and under Manual Update click the Start update button.
• The program will either update or inform you that no update was available.
• It is essential that you get the update - keep trying until successful. (Note: If you have problems getting the update, you can download an installer for the full database from here (save it on your desktop). Once you have downloaded the installer, make sure that AVG Anti-Spyware is closed and then double-click on avgas-signatures-full-current.exe to install the database).
  
  
  
  Reboot your computer in Safe Mode.
• If the computer is running, shut down Windows, and then turn off the power.
• Wait 30 seconds, and then turn the computer on.
• Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
• Ensure that the Safe Mode option is selected.
• Press Enter. The computer then begins to start in Safe mode.
• Login on your usual account.
• Open up AVG anti Malware

Please set up the program as follows:

• Click the Shield icon at the top and under Resident shield is... click active. This should now change to inactive.
• Click the Update icon and untick the automatic update option.
• Click on Scanner on the toolbar.
• Click on the Settings tab.
• Under How to act? - make sure that Quarantine is selected.
• Under How to scan? - All checkboxes should be ticked.
• Under Possibly unwanted software - All checkboxes should be ticked.
• Under Reports - Select Do not automatically generate reports.
• Under What to scan? - Select Scan every file.

Close all open windows.

• Click on Scanner on the toolbar.
• Click on Complete System Scan to start the scan process.
• Let the program scan your computer.
• When the scan has finished, follow the instructions below:
• Make sure that Set all elements to: shows Quarantine
• Important: Click on the Apply all Actions button (*** This must done before saving the report ***)
• When the program has finished, it will display the message All actions have been applied.
• Then click the Save Scan Report button.
• Click the Save Report as button.
• Save the report to your Desktop.
• Right-click the AVG Tray Icon and select Exit.
  
• Reboot in normal mode.

_________________________



In your next reply I would like to see:

• A new HJT log
• The report from AVG Anti Spyware

[bob4]

It's been a few days. Will you still be needing help ?

[Alwilson]

test

[Alwilson]

Hi Bob,

Today is the first day i have had a chance to coplete all the instructions in your reply.
By the way thanks so much for what you all are doing for people like us. It is very appreciated.
Ok so i have succsefuly compled all the tasks and here are the logs you need.

cheers

Al Wilson.

HJT -

Logfile of HijackThis v1.99.1
Scan saved at 5:52:02 p.m., on 10/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.nz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...a...&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.h...a...&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.h...a...&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.h...a...&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.h...a...&pf=desktop
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1124758260828
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D7AC582A-A8E9-4135-8141-7908B05CEA9B}: NameServer = 203.96.152.4 203.96.152.12
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

AVG -

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 5:36:21 p.m. 10/11/2007

+ Scan result:



HKLM\SOFTWARE\Classes\WR -> Adware.Generic : Cleaned with backup (quarantined).
C:\Documents and Settings\Loren\Cookies\loren@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@adtech[2].txt -> TrackingCookie.Adtech : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@clickbank[1].txt -> TrackingCookie.Clickbank : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@as-us.falkag[1].txt -> TrackingCookie.Falkag : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@ehg-idgentertainment.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@searchportal.information[2].txt -> TrackingCookie.Information : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@auto.search.msn[1].txt -> TrackingCookie.Msn : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@search.msn[1].txt -> TrackingCookie.Msn : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@data2.perf.overture[2].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@data3.perf.overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@perf.overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@ads.pointroll[1].txt -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@qksrv[2].txt -> TrackingCookie.Qksrv : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@guide.real[1].txt -> TrackingCookie.Real : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@real[1].txt -> TrackingCookie.Real : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@www.real[1].txt -> TrackingCookie.Real : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@realmedia[2].txt -> TrackingCookie.Realmedia : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@revenue[2].txt -> TrackingCookie.Revenue : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@revsci[1].txt -> TrackingCookie.Revsci : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@statse.webtrendslive[1].txt -> TrackingCookie.Webtrendslive : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@c4.zedo[2].txt -> TrackingCookie.Zedo : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@c5.zedo[1].txt -> TrackingCookie.Zedo : Cleaned.
C:\Documents and Settings\Loren\Cookies\loren@zedo[2].txt -> TrackingCookie.Zedo : Cleaned.


::Report end

[bob4]

Looks a bit better now..


You need to update SunJava for security reasons.
Updating Java:
Download the latest version of
Java Runtime Environment (JRE) 6 Update 3

• Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 3
  ... allows end-users to run Java applications".
  
• Click the "Download" button to the right.
  
• Check the box that says: "Accept License Agreement".
  
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  
• Close any programs you may have running - especially your web browser.
  
• Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  
• Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the icon next to it.
  
• Click the Remove or Change/Remove button.
  
• Repeat as many times as necessary to remove each Java versions.
  
• Reboot your computer once all Java components are removed.
  
• Then from your desktop double-click on jre-6u3-windows-i586-p.exe
  to install the newest version.

[/list]


Using internet explorer
_________________________________
Please do an online scan with Kaspersky Online Scanner

Click on Kaspersky Online Scanner
You will be promted to install an ActiveX component from Kaspersky, Click Yes.
The program will launch and then start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings
In the scan settings make sure that the following are selected:
Scan using the following Anti-Virus database:

Extended (If available otherwise Standard)
Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan select My Computer


Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.



The scan will take a while so be patient and let it run. Go have lunch, breakfast or something .

Once the scan is complete it will display if your system has been infected.

Now click on the Save as Text button:

Save the file to your desktop.

Copy and paste that information in your next post.



_________________________
In your next reply I would like to see:

• A new HJT log
• The report from Kasperskys

[Alwilson]

Hi Bob,

I have completed all avtions from your last post with no problems on the way.
However when i tried to upload the two logs together they were too big, so im sending them seperate posts

cheers.

Al.

HJT -

Logfile of HijackThis v1.99.1
Scan saved at 7:51:20 p.m., on 11/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Documents and Settings\Owner\My Documents\downloads\hijackthis\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.nz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...a...&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.h...a...&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.h...a...&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.h...a...&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.h...a...&pf=desktop
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1124758260828
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

[Alwilson]

unfortunatley the Kasperskys report is 2613kb notepad file and i dont know how to cut such a large file into a post... so still working on that problem now. cheers Al

[Alwilson]

So the problem here is that this computer belongs to my giirlfriend who has a teenage son with a profile log on for his user account on this computer as well. would it help to log on under his username and delete all temporary internet files etc, and then run another Kasperskys scan to try and reduce the report log file size..? Here is about 10% of the top of the whole Kasperskys log for example... KASPERSKY ONLINE SCANNER REPORT Sunday, November 11, 2007 7:17:13 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 11/11/2007 Kaspersky Anti-Virus database records: 456222 Scan Settings Scan using the following antivirus database extended Scan Archives true Scan Mail Bases true Scan Target My Computer A:\ C:\ D:\ Scan Statistics Total number of scanned objects 94362 Number of viruses found 3 Number of infected objects 22 Number of suspicious objects 0 Duration of the scan process 01:36:37 Infected Object Name Virus Name Last Action C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Nathan\.limewire\.NetworkShare\Incomplete\LimeWireWinInstaller.exe.info Object is locked skipped C:\Documents and Settings\Nathan\.limewire\.NetworkShare\Incomplete\LimeWireWinInstaller.exe.part Object is locked skipped C:\Documents and Settings\Nathan\.limewire\.NetworkShare\LimeWireWin4.14.10.exe Object is locked skipped C:\Documents and Settings\Nathan\.limewire\410splashfree.png Object is locked skipped C:\Documents and Settings\Nathan\.limewire\412splashfree.png Object is locked skipped C:\Documents and Settings\Nathan\.limewire\414splashfree.png Object is locked skipped C:\Documents and Settings\Nathan\.limewire\createtimes.cache Object is locked skipped C:\Documents and Settings\Nathan\.limewire\data.ser Object is locked skipped C:\Documents and Settings\Nathan\.limewire\fileurns.bak Object is locked skipped C:\Documents and Settings\Nathan\.limewire\fileurns.cache Object is locked skipped C:\Documents and Settings\Nathan\.limewire\filters.props Object is locked skipped C:\Documents and Settings\Nathan\.limewire\gnutella.net Object is locked skipped C:\Documents and Settings\Nathan\.limewire\installation.props Object is locked skipped C:\Documents and Settings\Nathan\.limewire\library.dat Object is locked skipped C:\Documents and Settings\Nathan\.limewire\limewire.props Object is locked skipped C:\Documents and Settings\Nathan\.limewire\mojito.props Object is locked skipped C:\Documents and Settings\Nathan\.limewire\pub1.key Object is locked skipped C:\Documents and Settings\Nathan\.limewire\public.key Object is locked skipped C:\Documents and Settings\Nathan\.limewire\questions.props Object is locked skipped C:\Documents and Settings\Nathan\.limewire\responses.cache Object is locked skipped C:\Documents and Settings\Nathan\.limewire\secureMessage.key Object is locked skipped C:\Documents and Settings\Nathan\.limewire\simpp.xml Object is locked skipped C:\Documents and Settings\Nathan\.limewire\spam.dat Object is locked skipped C:\Documents and Settings\Nathan\.limewire\tables.props Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme1_star.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme2_star.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme3_star.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme4_star.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme5_star.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme\chat.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme\dir_closed.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme\dir_open.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme\forward_dn.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme\forward_up.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme\kill.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme\kill_on.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme\lime.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme\logo.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme\notsearching.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme\pause_dn.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme\pause_up.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme\play_dn.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme\play_up.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme\question.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme\rewind_dn.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme\rewind_up.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme\searching.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme\splash.png Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme\splashpro.png Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme\stop_dn.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme\stop_up.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme\theme.txt Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme\version.txt Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme\warning.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\black_theme.lwtp Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme1_star.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme2_star.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme3_star.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme4_star.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme5_star.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme\chat.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme\dir_closed.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme\dir_open.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme\forward_dn.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme\forward_up.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme\kill.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme\logo.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme\notsearching.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme\pause_dn.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme\pause_up.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme\play_dn.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme\play_up.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme\question.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme\rewind_dn.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme\rewind_up.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme\search.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme\searching.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme\splash.png Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme\splashpro.png Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme\stop_dn.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme\stop_up.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme\theme.txt Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme\warning.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\classic_theme.lwtp Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme1_star.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme2_star.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme3_star.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme4_star.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme5_star.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme\chat.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme\dir_closed.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme\dir_open.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme\forward_dn.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme\forward_up.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme\kill.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme\kill_on.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme\lime.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme\logo.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme\notsearching.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme\pause_dn.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme\pause_up.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme\play_dn.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme\play_up.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme\question.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme\rewind_dn.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme\rewind_up.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme\searching.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme\splash.png Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme\splashpro.png Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme\stop_dn.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme\stop_up.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme\theme.txt Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme\warning.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\limewire_theme.lwtp Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme1_star.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme2_star.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme3_star.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme4_star.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme5_star.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme\chat.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme\forward_dn.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme\forward_up.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme\kill.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme\kill_on.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme\logo.png Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme\name.txt Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme\notsearching.png Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme\pause_dn.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme\pause_up.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme\play_dn.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme\play_up.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme\question.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme\rewind_dn.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme\rewind_up.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme\searching.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme\splash.png Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme\splashpro.png Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme\stop_dn.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme\stop_up.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme\theme.txt Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme\warning.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\other_theme.lwtp Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme1_star.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme2_star.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme3_star.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme4_star.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme5_star.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme\chat.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme\forward_dn.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme\forward_up.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme\kill.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme\kill_on.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme\logo.png Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme\notsearching.png Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme\pause_dn.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme\pause_up.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme\play_dn.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme\play_up.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme\question.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme\rewind_dn.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme\rewind_up.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme\searching.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme\splash.png Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme\splashpro.png Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme\stop_dn.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme\stop_up.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme\theme.txt Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme\warning.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\themes\windows_theme.lwtp Object is locked skipped C:\Documents and Settings\Nathan\.limewire\ttree.cache Object is locked skipped C:\Documents and Settings\Nathan\.limewire\update.xml Object is locked skipped C:\Documents and Settings\Nathan\.limewire\version.key Object is locked skipped C:\Documents and Settings\Nathan\.limewire\version.xml Object is locked skipped C:\Documents and Settings\Nathan\.limewire\xml\data\application.sxml Object is locked skipped C:\Documents and Settings\Nathan\.limewire\xml\data\audio.sxml Object is locked skipped C:\Documents and Settings\Nathan\.limewire\xml\data\delete_me Object is locked skipped C:\Documents and Settings\Nathan\.limewire\xml\data\image.sxml Object is locked skipped C:\Documents and Settings\Nathan\.limewire\xml\data\video.sxml Object is locked skipped C:\Documents and Settings\Nathan\.limewire\xml\misc\application.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\xml\misc\audio.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\xml\misc\document.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\xml\misc\image.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\xml\misc\video.gif Object is locked skipped C:\Documents and Settings\Nathan\.limewire\xml\schemas\application.xsd Object is locked skipped C:\Documents and Settings\Nathan\.limewire\xml\schemas\audio.xsd Object is locked skipped C:\Documents and Settings\Nathan\.limewire\xml\schemas\document.xsd Object is locked skipped C:\Documents and Settings\Nathan\.limewire\xml\schemas\image.xsd Object is locked skipped C:\Documents and Settings\Nathan\.limewire\xml\schemas\video.xsd Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Acrobat\6.0\AcroForm\MRUFormsList Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Acrobat\6.0\AdobeComFnt06.lst Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Acrobat\6.0\AdobeSysFnt06.lst Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Acrobat\6.0\Collab\OfflineDocs Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Acrobat\6.0\Collab\Reviews Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Acrobat\6.0\JSADM.exv Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Acrobat\6.0\Preferences\AutoFillDefaults.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Acrobat\6.0\Preferences\defaultHeuristics.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Acrobat\6.0\TMGrpPrm.sav Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Acrobat\6.0\Updater\udstore.js Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\Photoshop7\AAAAAAAA2 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\Photoshop7\AAAAAAAA2M Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\Photoshop7\BAAAAAAA2 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\Photoshop7\BAAAAAAA2M Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\Photoshop7\CAAAAAAA2 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\Photoshop7\CAAAAAAA2M Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\Photoshop7\DAAAAAAA2 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\Photoshop7\DAAAAAAA2M Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\Photoshop7\EAAAAAAA2 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\Photoshop7\EAAAAAAA2M Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\Photoshop7\FAAAAAAA2 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\Photoshop7\FAAAAAAA2M Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\Photoshop7\GAAAAAAA2 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\Photoshop7\GAAAAAAA2M Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\Photoshop7\HAAAAAAA2 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\Photoshop7\HAAAAAAA2M Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\Photoshop7\IAAAAAAA2 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\Photoshop7\IAAAAAAA2M Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\Photoshop7\index.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\Photoshop7\JAAAAAAA2 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\Photoshop7\JAAAAAAA2M Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\PhotoshopElement2\AAAAAAAA2 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\PhotoshopElement2\AAAAAAAA2M Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\PhotoshopElement2\BAAAAAAA2 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\PhotoshopElement2\BAAAAAAA2M Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\PhotoshopElement2\CAAAAAAA2 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\PhotoshopElement2\CAAAAAAA2M Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\PhotoshopElement2\DAAAAAAA2 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\PhotoshopElement2\DAAAAAAA2M Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\PhotoshopElement2\EAAAAAAA2 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\PhotoshopElement2\EAAAAAAA2M Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\FileBrowser\PhotoshopElement2\index.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Photoshop\7.0\Adobe Photoshop 7.0 Settings\Actions Palette.psp Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Photoshop\7.0\Adobe Photoshop 7.0 Settings\Adobe Photoshop 7.0 Prefs.psp Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Photoshop\7.0\Adobe Photoshop 7.0 Settings\Brushes.psp Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Photoshop\7.0\Adobe Photoshop 7.0 Settings\Color Settings.csf Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Photoshop\7.0\Adobe Photoshop 7.0 Settings\Contours.psp Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Photoshop\7.0\Adobe Photoshop 7.0 Settings\CustomShapes.psp Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Photoshop\7.0\Adobe Photoshop 7.0 Settings\Gradients.psp Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Photoshop\7.0\Adobe Photoshop 7.0 Settings\Patterns.psp Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Photoshop\7.0\Adobe Photoshop 7.0 Settings\PluginCache.psp Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Photoshop\7.0\Adobe Photoshop 7.0 Settings\Styles.psp Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Photoshop\7.0\Adobe Photoshop 7.0 Settings\Swatches.psp Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Photoshop\7.0\Adobe Photoshop 7.0 Settings\ToolPresets.psp Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Photoshop\Elements\Photoshop Elements 2.0 Prefs\Adobe Photoshop Elements 2.0 Prefs.psp Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Photoshop\Elements\Photoshop Elements 2.0 Prefs\Brushes.psp Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Photoshop\Elements\Photoshop Elements 2.0 Prefs\Color Settings.csf Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Photoshop\Elements\Photoshop Elements 2.0 Prefs\Contours.psp Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Photoshop\Elements\Photoshop Elements 2.0 Prefs\Gradients.psp Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Photoshop\Elements\Photoshop Elements 2.0 Prefs\Patterns.psp Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Photoshop\Elements\Photoshop Elements 2.0 Prefs\PluginCache.psp Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Photoshop\Elements\Photoshop Elements 2.0 Prefs\Styles.psp Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Photoshop\Elements\Photoshop Elements 2.0 Prefs\Swatches.psp Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Adobe\Workflow\Options.txt Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Apple Computer\iTunes\iTunes.pref Object is locked skipped C:\Documents and Settings\Nathan\Application Data\AVG7\log.idx Object is locked skipped C:\Documents and Settings\Nathan\Application Data\AVG7\l_000101.log Object is locked skipped C:\Documents and Settings\Nathan\Application Data\AVG7\l_000102.log Object is locked skipped C:\Documents and Settings\Nathan\Application Data\AVG7\l_000103.log Object is locked skipped C:\Documents and Settings\Nathan\Application Data\AVG7\l_000104.log Object is locked skipped C:\Documents and Settings\Nathan\Application Data\AVG7\l_000105.log Object is locked skipped C:\Documents and Settings\Nathan\Application Data\AVG7\l_000106.log Object is locked skipped C:\Documents and Settings\Nathan\Application Data\AVG7\test-0012.cfg Object is locked skipped C:\Documents and Settings\Nathan\Application Data\AVG7\test-0013.cfg Object is locked skipped C:\Documents and Settings\Nathan\Application Data\desktop.ini Object is locked skipped C:\Documents and Settings\Nathan\Application Data\GDIPFONTCACHEV1.DAT Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\bin.clearspring.com\clearspring.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\crazymonkeygames.com\swf\thing-thing-3.swf\userData.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\crazymonkeygames.com\swf\tta2.swf\userData.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\flash.ngfiles.com\bytesize\bytesize_viewer.swf\bytesize.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\l.yimg.com\cosmos.bcst.yahoo.com\ver\234\embed-2007-06-19-1259\swf\yup_embed_module.swf\TestMovie_Config_Info.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\l.yimg.com\LCOMMENGINEMGR.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\login.yahoo.com\loginCache.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\m1.2mdn.net\ft720-6.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\media.ign.com\shareObj.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\mediaonenetwork.net\MediaOne.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\mochibot.com\com.mochibot.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\static.userplane.com\presence\presence.swf\presence_1.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\ungrounded.net\userassets\388000\388305\dronline_f7.swf\DragRacerOnlineData.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\update.videoegg.com\flash\player\player.swf\VE_Cookie.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\update.videoegg.com\flash\player8.swf\vePlayer.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\update.videoegg.com\flash\player8ad.swf\vePlayer.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\uploads.ungrounded.net\218000\218014_DAbuddy_latest.swf\daBud.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\uploads.ungrounded.net\284000\284474_True_Darkness_Eats_Crunchy.swf\insultsave4.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\urban.musicnation.com\pervol2.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\video.google.com\googleplayer.swf\mediaPlayerUserSettings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\widgets.clearspring.com\clearspring.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\www.crazymonkeygames.com\swf\wone2.swf\WONE2_1324_1.1_DEFAULT.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\www.ea.com\nfsc_factionVote_05.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\www.shufuni.com\com.jeroenwijering.players.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\www.soundclick.com\player\userSettings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\www.yourpsp.co.nz\psp_brand\components\yourpsp.swf\_locale.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\www.youtube.com\soundData.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\yieldmanager.com\tclu4000intl782006.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\yieldmanager.edgesuite.net\edgerestintl2022007.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\yieldmanager.edgesuite.net\ideaturnintl2622007.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\yieldmanager.edgesuite.net\induringintl342007.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\yieldmanager.edgesuite.net\m0ve60rnintl1552007.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\#SharedObjects\MPH2E588\yieldmanager.edgesuite.net\num6eri5intl1452007.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#crazymonkeygames.com\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#flash.ngfiles.com\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#l.yimg.com\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#letsbeef.com\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#login.yahoo.com\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#m1.2mdn.net\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#media.ign.com\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#mediaonenetwork.net\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#mochibot.com\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.userplane.com\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#ungrounded.net\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#update.videoegg.com\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#uploads.ungrounded.net\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#urban.musicnation.com\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#userplane.com\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#video.google.com\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#widgets.clearspring.com\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.crazymonkeygames.com\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.ea.com\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.shufuni.com\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.soundclick.com\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.yourpsp.co.nz\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.youtube.com\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#yieldmanager.com\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#yieldmanager.edgesuite.net\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\Address Book\Nathan.wab Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\Address Book\Nathan.wab~ Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CLR Security Config\v1.1.4322\security.config Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CLR Security Config\v1.1.4322\security.config.cch Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\Content\303572DF538EDD8B1D606185F1D559B8 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\Content\486CC6AFD08942336C61FCD401C4A1D1 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\Content\71644221AC231DBD2359C18EBB2118DC Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\Content\79841F8EF00FBA86D33CC5A47696F165 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\Content\7C8A03C4580C6B04FDF34357F3474EDC Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\Content\A44F4E7CB3133FF765C39A53AD8FCFDD Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\Content\A8FABA189DB7D25FBA7CAC806625FD30 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\Content\B2F4B1D39F0694C6CDB433BC3CCF1418 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\Content\B82262A5D5DA4DDACE9EDA7F787D0DEB Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\Content\C571B417AAF1F617555A0486AB3F5361 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\Content\CFC456E7E410D69E2C6F3E2DB75C7DB3 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\Content\E6024EAC88E6B6165D49FE3C95ADD735 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\MetaData\303572DF538EDD8B1D606185F1D559B8 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\MetaData\486CC6AFD08942336C61FCD401C4A1D1 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\MetaData\71644221AC231DBD2359C18EBB2118DC Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\MetaData\79841F8EF00FBA86D33CC5A47696F165 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\MetaData\7C8A03C4580C6B04FDF34357F3474EDC Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\MetaData\A44F4E7CB3133FF765C39A53AD8FCFDD Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\MetaData\A8FABA189DB7D25FBA7CAC806625FD30 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\MetaData\B2F4B1D39F0694C6CDB433BC3CCF1418 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\MetaData\B82262A5D5DA4DDACE9EDA7F787D0DEB Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\MetaData\C571B417AAF1F617555A0486AB3F5361 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\MetaData\CFC456E7E410D69E2C6F3E2DB75C7DB3 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\CryptnetUrlCache\MetaData\E6024EAC88E6B6165D49FE3C95ADD735 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\Crypto\RSA\S-1-5-21-3913312356-3347108499-2230506287-1009b6e87d0fec0c19f58bd968c202b4157_3cbd3337-9eb7-4830-b63a-b199ed5f7ed9 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\Crypto\RSA\S-1-5-21-3913312356-3347108499-2230506287-1009\83aa4cc77f591dfc2374580bbd95f6ba_3cbd3337-9eb7-4830-b63a-b199ed5f7ed9 Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\HTML Help\hh.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\IMJP8_1\imjp81u.dic Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\Internet Explorer\brndlog.bak Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\Internet Explorer\brndlog.txt Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\Internet Explorer\Desktop.htt Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\Internet Explorer\Quick Launch\RealPlayer.lnk Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\Media PlayerBEBAF7.wpl Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\Backgrounds\map.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\Backgrounds\TFR29.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\Backgrounds\TFR2A.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\Backgrounds\TFR2B.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\Backgrounds\TFR2C.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\Backgrounds\TFR2D.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\DynamicBackgrounds\map.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\DynamicBackgrounds\TFR31.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\DynamicBackgrounds\TFR3C.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\DynamicBackgrounds\TFR47.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\DynamicBackgrounds\TFR52.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\ListCache.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\MapFile\TFR28.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\MapFile\TFR5A.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\MapFile\TFR5B.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\MapFile\TFR7A.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\UserTile\map.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\UserTile\TFR1D.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\UserTile\TFR1E.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\UserTile\TFR1F.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\UserTile\TFR20.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\UserTile\TFR21.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\UserTile\TFR22.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\UserTile\TFR23.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\UserTile\TFR24.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\UserTile\TFR25.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\UserTile\TFR26.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\UserTile\TFR27.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\Winks3\map.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\Winks3\TFR5D.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\Winks3\TFR5F.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\Winks3\TFR61.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\Winks3\TFR63.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\Winks3\TFR65.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\Winks3\TFR67.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\Winks3\TFR69.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\Winks3\TFR6B.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\Winks3\TFR6D.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\Winks3\TFR6F.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\Winks3\TFR71.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\Winks3\TFR73.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\Winks3\TFR75.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\Winks3\TFR77.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2267547097\Winks3\TFR79.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2518444876\sqmdata00.sqm Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2518444876\sqmdata01.sqm Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2518444876\sqmnoopt00.sqm Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\2518444876\sqmnoopt01.sqm Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\Backgrounds\map.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\Backgrounds\TFR15.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\Backgrounds\TFR16.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\Backgrounds\TFR17.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\Backgrounds\TFR18.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\Backgrounds\TFR19.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\DynamicBackgrounds\map.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\DynamicBackgrounds\TFR5A.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\DynamicBackgrounds\TFR66.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\DynamicBackgrounds\TFR74.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\DynamicBackgrounds\TFR7F.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\ListCache.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\MapFile\TFR14.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\MapFile\TFR87.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\MapFile\TFR88.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\MapFile\TFRA7.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\sqmdata00.sqm Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\sqmdata01.sqm Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\sqmdata02.sqm Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\sqmdata03.sqm Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\sqmdata04.sqm Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\sqmdata05.sqm Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\sqmnoopt00.sqm Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\sqmnoopt01.sqm Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\sqmnoopt02.sqm Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\sqmnoopt03.sqm Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\sqmnoopt04.sqm Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\sqmnoopt05.sqm Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\UserTile\map.dat Object is locked skipped C:\Documents and Settings\Nathan\Application Data\Microsoft\MSN Messenger\3524519271\UserTile\TFR10.dat Object is locked skipped

[bob4]

Please download fixedit.exe
Save it to your desktop.

• Now open the Kaspersky file.txt you saved for me.
  
• copy all of it into fixedit by:
  
  1. High lighting all of it with your mouse cntrl a
  
  2. copy it by right clicking while it's highlighted ( cntrl c)
  
  3. Now click on fix edit.exe to open it.
  
  4. click the edit button on top and choose paste (cntrl B)
  
• Click the Make Global Changes tab,
  and type infected in the Test Key text.
  
• In the top green block, tick on the button labeled "Contains the Test key anywhere".
  {Third box down in this version}
  
• Then at the bottom of the page, check the box labeled "Retain only lines that pass the test parameter, discard the rest".
  Hit GO.
  
• Now click on the show/edit current text tab.
  This should dramatically reduce the size of the file.
  
• Highlight everything using your mouse ("cntrl a")
  
• Then right clcik and choose copy (cntrl c')
  
• And past that in your next post.

[Alwilson]

Hi, ok ive done that and wow it certainly reduced the file.. to this.. Number of infected objects 22 Infected Object Name Virus Name Last Action hope ive not done anything wrong... cheers al

[bob4]

Yes something didn't go correct. It should have removed any lines that didn't contain infected in them.
Leaving things like this:
You were to copy the scan from the file you saved. Not what you had posted here. It shows 22 infected files. Those are what I need to see.
Please try again.

C:\Documents and Settings\Robert Cartlidge\Local Settings\Application Data\Mozilla\Firefox\Profiles\p8447ant.default\Cache(2).Trash\Trash(2)\Cache(2)\79E26723d01 Infected: Trojan-Downloader.HTML.Agent.fl skipped
C:\Documents and Settings\Robert Cartlidge\Local Settings\Temporary Internet Files\Content.IE51K5IT6X\www[1].htm Infected: Trojan-Downloader.HTML.Agent.fl skipped
C:\Documents and Settings\Robert Cartlidge\Local Settings\Temporary Internet Files\Content.IE51K5IT6X\www[2].htm Infected: Trojan-Downloader.HTML.Agent.fl skipped
C:\Documents and Settings\Robert Cartlidge\Local Settings\Temporary Internet Files\Content.IE5\67I3CDQX\banner[1].htm Infected: Trojan-Downloader.HTML.Agent.fl skipped
C:\Documents and Settings\Robert Cartlidge\Local Settings\Temporary Internet Files\Content.IE5\67I3CDQX\google.co[1].htm Infected: Trojan-Downloader.HTML.Agent.fl skipped

[Alwilson]

Hi, I have followed the instructions again and am still getting the exact same result in the text editor... What to do? al

[Alwilson]

Hi, I think i may have made a mistake by saving the Kaspersky report has an html instead of notepad file in the first instance. however i have created a notepad file using the original html file, and then opened it directly (file open) using the fixedit program. Im wondering as well if i should run the kaspersky again and this time save it properly as notepad file in the first instance... This is the result - Number of infected objects 22 Infected Object Name Virus Name Last Action C:\Documents and Settings\Owner\Desktop\backups\backup-20071110-142842-585.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\Documents and Settings\Owner\Desktop\backups\backup-20071110-142842-945.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\Program Files\MSN\profsysyhdu.html Infected: Trojan-Clicker.HTML.IFrame.dn skipped C:\System Volume Information\_restore{2E708D09-E34D-4058-8999-08C5891B82C2}\RP493\A0044018.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{2E708D09-E34D-4058-8999-08C5891B82C2}\RP493\A0044018.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{2E708D09-E34D-4058-8999-08C5891B82C2}\RP493\A0044045.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{2E708D09-E34D-4058-8999-08C5891B82C2}\RP493\A0044063.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{2E708D09-E34D-4058-8999-08C5891B82C2}\RP493\A0044063.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{2E708D09-E34D-4058-8999-08C5891B82C2}\RP493\A0044067.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{2E708D09-E34D-4058-8999-08C5891B82C2}\RP493\A0044090.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{2E708D09-E34D-4058-8999-08C5891B82C2}\RP493\A0044090.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{2E708D09-E34D-4058-8999-08C5891B82C2}\RP493\A0045084.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{2E708D09-E34D-4058-8999-08C5891B82C2}\RP493\A0045103.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{2E708D09-E34D-4058-8999-08C5891B82C2}\RP493\A0045103.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{2E708D09-E34D-4058-8999-08C5891B82C2}\RP493\A0045107.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{2E708D09-E34D-4058-8999-08C5891B82C2}\RP494\A0045681.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{2E708D09-E34D-4058-8999-08C5891B82C2}\RP494\A0045682.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\WINDOWS\system32\v4\caws83122.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\WINDOWS\system32\v4\caws83122.exe NSIS: infected - 1 skipped C:\WINDOWS\TTC-4444.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\WINDOWS\TTC-4444.exe NSIS: infected - 1 skipped C:\z.exe Infected: not-a-virus:PSWTool.Win32.ProtectStorage.b skipped

[bob4]

No reason to run Kasperskys again. It found 22 infected files.
And I see 22 listed to me so your OK.
It is important to read directions carefully.
The html added thousands of lines. Possibly.

___________________________________
Please download the OTMoveIt by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt.exe to run it.
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
  
  C:\Documents and Settings\Owner\Desktop\backups\backup-20071110-142842-585.dll
  C:\Documents and Settings\Owner\Desktop\backups\backup-20071110-142842-945.dll
  C:\Program Files\MSN\profsysyhdu.html
  C:\WINDOWS\system32\v4\caws83122.exe/data0002
  C:\WINDOWS\system32\v4\caws83122.exe
  C:\WINDOWS\TTC-4444.exe/data0002
  C:\WINDOWS\TTC-4444.exe
  C:\z.exe
  
  
• Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
• Click the red Moveit! button.
• Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply.

*If a file or folder cannot be moved immediately, you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine, choose Yes.

• Close OTMoveIt

**If a reboot was necessary or you needed to Exit before posting the log, you will find a copy of the log at the root of the drive where OTMoveIt is installed, usually at :
C:\_OTMoveIt\MovedFiles\********_******.log
(where "********_******" is the "date_time")




_______________________________________________
1. Download Combo fix from one of these locations. ( Please save it to your desktop )
http://www.techsuppo...Bs/ComboFix.exe
http://download.blee...Bs/ComboFix.exe

combofix.exe

2.Close all open windows
3. Double click combofix.exe & follow the prompts.
4. When finished, it shall produce a log for you. Post that log in your next reply . (c:\comboFix.txt)

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall



_________________________
In your next reply I would like to see:

• A new HJT log
• The report from OT move it
• The report from Combofix.
• Let me know how things are running