How can I stop a file from changing my file permissions.

Avenger TXT Results:
 
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com
 
Platform: Windows XP
 
*******************
 
Script file opened successfully.
Script file read successfully.
 
Backups directory opened successfully at C:\Avenger
 
*******************
 
Beginning to process script file:
 
Rootkit scan active.
No rootkits found!
 
File move operation "C:\eventlog.dll|C:\WINDOWS\system32\eventlog.dll" completed successfully.
 
Completed script processing.
 
*******************
 
Finished! Terminate.
 
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
 
Win32kdiag.exe log.
 
Log file is located at: C:\Documents and Settings\fabdeen\Desktop\Win32kDiag.txt
 
Removing all found mount points.
 
Attempting to reset file permissions.
 
WARNING: Could not get backup privileges!
 
Searching 'C:\WINDOWS'...
 
 
 
Found mount point : C:\WINDOWS\addins\addins
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\addins\addins
 
Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP21A.tmp\ZAP21A.tmp
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP21A.tmp\ZAP21A.tmp
 
Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP31C.tmp\ZAP31C.tmp
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP31C.tmp\ZAP31C.tmp
 
Found mount point : C:\WINDOWS\assembly\temp\temp
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\assembly\temp\temp
 
Found mount point : C:\WINDOWS\assembly\tmp\tmp
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\assembly\tmp\tmp
 
Found mount point : C:\WINDOWS\Config\Config
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\Config\Config
 
Found mount point : C:\WINDOWS\Connection Wizard\Connection Wizard
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\Connection Wizard\Connection Wizard
 
Found mount point : C:\WINDOWS\CSC\d1\d1
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\CSC\d1\d1
 
Found mount point : C:\WINDOWS\CSC\d2\d2
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\CSC\d2\d2
 
Found mount point : C:\WINDOWS\CSC\d3\d3
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\CSC\d3\d3
 
Found mount point : C:\WINDOWS\CSC\d4\d4
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\CSC\d4\d4
 
Found mount point : C:\WINDOWS\CSC\d5\d5
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\CSC\d5\d5
 
Found mount point : C:\WINDOWS\CSC\d6\d6
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\CSC\d6\d6
 
Found mount point : C:\WINDOWS\CSC\d7\d7
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\CSC\d7\d7
 
Found mount point : C:\WINDOWS\CSC\d8\d8
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\CSC\d8\d8
 
Found mount point : C:\WINDOWS\ie7updates\ie7updates
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\ie7updates\ie7updates
 
Found mount point : C:\WINDOWS\ie8updates\ie8updates
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\ie8updates\ie8updates
 
Found mount point : C:\WINDOWS\ime\chsime\applets\applets
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\ime\chsime\applets\applets
 
Found mount point : C:\WINDOWS\ime\CHTIME\Applets\Applets
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\ime\CHTIME\Applets\Applets
 
Found mount point : C:\WINDOWS\ime\imejp\applets\applets
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\ime\imejp\applets\applets
 
Found mount point : C:\WINDOWS\ime\imejp98\imejp98
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\ime\imejp98\imejp98
 
Found mount point : C:\WINDOWS\ime\imjp8_1\applets\applets
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\ime\imjp8_1\applets\applets
 
Found mount point : C:\WINDOWS\ime\imkr6_1\applets\applets
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\ime\imkr6_1\applets\applets
 
Found mount point : C:\WINDOWS\ime\imkr6_1\dicts\dicts
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\ime\imkr6_1\dicts\dicts
 
Found mount point : C:\WINDOWS\ime\shared\res\res
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\ime\shared\res\res
 
Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\0DC1503A46F231838AD88BCDDC8E8F7C\3.2.30729\3.2.30729
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\0DC1503A46F231838AD88BCDDC8E8F7C\3.2.30729\3.2.30729
 
Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\DC3BF90CC0D3D2F398A9A6D1762F70F3\2.2.30729\2.2.30729
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\DC3BF90CC0D3D2F398A9A6D1762F70F3\2.2.30729\2.2.30729
 
Found mount point : C:\WINDOWS\java\classes\classes
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\java\classes\classes
 
Found mount point : C:\WINDOWS\java\trustlib\trustlib
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\java\trustlib\trustlib
 
Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\Bind Logs\Bind Logs
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\Bind Logs\Bind Logs
 
Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\Temporary ASP.NET Files
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\Temporary ASP.NET Files
 
Found mount point : C:\WINDOWS\ms\sms\sms
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\ms\sms\sms
 
Found mount point : C:\WINDOWS\msapps\msinfo\msinfo
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\msapps\msinfo\msinfo
 
Found mount point : C:\WINDOWS\pchealth\ERRORREP\QHEADLES\QHEADLES
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\pchealth\ERRORREP\QHEADLES\QHEADLES
 
Found mount point : C:\WINDOWS\pchealth\ERRORREP\QSIGNOFF\QSIGNOFF
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\pchealth\ERRORREP\QSIGNOFF\QSIGNOFF
 
Found mount point : C:\WINDOWS\pchealth\ERRORREP\UserDumps\UserDumps
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\pchealth\ERRORREP\UserDumps\UserDumps
 
Found mount point : C:\WINDOWS\pchealth\helpctr\BATCH\BATCH
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\pchealth\helpctr\BATCH\BATCH
 
Cannot access: C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe
 
Attempting to restore permissions of : C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe
 
[1] 2008-04-14 08:00:00 744448 C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe (Microsoft Corporation)
 
[1] 2008-04-14 08:00:00 744448 C:\WINDOWS\system32\dllcache\helpsvc.exe (Microsoft Corporation)
 
 
 
Found mount point : C:\WINDOWS\pchealth\helpctr\Config\CheckPoint\CheckPoint
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\pchealth\helpctr\Config\CheckPoint\CheckPoint
 
Found mount point : C:\WINDOWS\pchealth\helpctr\HelpFiles\HelpFiles
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\pchealth\helpctr\HelpFiles\HelpFiles
 
Found mount point : C:\WINDOWS\pchealth\helpctr\InstalledSKUs\InstalledSKUs
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\pchealth\helpctr\InstalledSKUs\InstalledSKUs
 
Found mount point : C:\WINDOWS\pchealth\helpctr\System_OEM\System_OEM
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\pchealth\helpctr\System_OEM\System_OEM
 
Found mount point : C:\WINDOWS\pchealth\helpctr\Temp\Temp
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\pchealth\helpctr\Temp\Temp
 
Found mount point : C:\WINDOWS\PIF\PIF
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\PIF\PIF
 
Found mount point : C:\WINDOWS\Registration\CRMLog\CRMLog
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\Registration\CRMLog\CRMLog
 
Found mount point : C:\WINDOWS\SoftwareDistribution\AuthCabs\Downloaded\Downloaded
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\SoftwareDistribution\AuthCabs\Downloaded\Downloaded
 
Found mount point : C:\WINDOWS\SoftwareDistribution\Download\dfd20fda6478d599fc1417f0319287a1\backup\backup
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\dfd20fda6478d599fc1417f0319287a1\backup\backup
 
Found mount point : C:\WINDOWS\Sun\Java\Deployment\Deployment
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\Sun\Java\Deployment\Deployment
 
Found mount point : C:\WINDOWS\SxsCaPendDel\SxsCaPendDel
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\SxsCaPendDel\SxsCaPendDel
 
Found mount point : C:\WINDOWS\system32\1025\1025
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\1025\1025
 
Found mount point : C:\WINDOWS\system32\1028\1028
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\1028\1028
 
Found mount point : C:\WINDOWS\system32\1031\1031
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\1031\1031
 
Found mount point : C:\WINDOWS\system32\1037\1037
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\1037\1037
 
Found mount point : C:\WINDOWS\system32\1041\1041
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\1041\1041
 
Found mount point : C:\WINDOWS\system32\1042\1042
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\1042\1042
 
Found mount point : C:\WINDOWS\system32\1054\1054
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\1054\1054
 
Found mount point : C:\WINDOWS\system32\2052\2052
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\2052\2052
 
Found mount point : C:\WINDOWS\system32\3076\3076
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\3076\3076
 
Found mount point : C:\WINDOWS\system32\3com_dmi\3com_dmi
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\3com_dmi\3com_dmi
 
Found mount point : C:\WINDOWS\system32\Adobe\Shockwave 11\Shockwave 11
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\Adobe\Shockwave 11\Shockwave 11
 
Found mount point : C:\WINDOWS\system32\appmgmt\MACHINE\MACHINE
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\appmgmt\MACHINE\MACHINE
 
Found mount point : C:\WINDOWS\system32\appmgmt\S-1-5-21-4150186171-3289678098-4216156773-1003\S-1-5-21-4150186171-3289678098-4216156773-1003
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\appmgmt\S-1-5-21-4150186171-3289678098-4216156773-1003\S-1-5-21-4150186171-3289678098-4216156773-1003
 
Found mount point : C:\WINDOWS\system32\appmgmt\S-1-5-21-448539723-1645522239-682003330-8837\S-1-5-21-448539723-1645522239-682003330-8837
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\appmgmt\S-1-5-21-448539723-1645522239-682003330-8837\S-1-5-21-448539723-1645522239-682003330-8837
 
Found mount point : C:\WINDOWS\system32\appmgmt\S-1-5-21-854245398-1788223648-682003330-500\S-1-5-21-854245398-1788223648-682003330-500
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\appmgmt\S-1-5-21-854245398-1788223648-682003330-500\S-1-5-21-854245398-1788223648-682003330-500
 
Found mount point : C:\WINDOWS\system32\CCM\Cache\GLN00080.3.System\GLN00080.3.System
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\CCM\Cache\GLN00080.3.System\GLN00080.3.System
 
Found mount point : C:\WINDOWS\system32\CCM\Inventory\idmifs\badmifs\badmifs
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\CCM\Inventory\idmifs\badmifs\badmifs
 
Found mount point : C:\WINDOWS\system32\CCM\Inventory\noidmifs\badmifs\badmifs
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\CCM\Inventory\noidmifs\badmifs\badmifs
 
Found mount point : C:\WINDOWS\system32\CCM\Inventory\Temp\FileColl\FileColl
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\CCM\Inventory\Temp\FileColl\FileColl
 
Found mount point : C:\WINDOWS\system32\CCM\Metering\Temp\Temp
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\CCM\Metering\Temp\Temp
 
Found mount point : C:\WINDOWS\system32\CCM\ServiceData\LocalPayload\LocalPayload
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\CCM\ServiceData\LocalPayload\LocalPayload
 
Found mount point : C:\WINDOWS\system32\CCM\ServiceData\Temp\Temp
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\CCM\ServiceData\Temp\Temp
 
Found mount point : C:\WINDOWS\system32\CCM\Temp\Temp
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\CCM\Temp\Temp
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Acrobat\9.0\Collab\Collab
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Acrobat\9.0\Collab\Collab
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Acrobat\9.0\Forms\Forms
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Acrobat\9.0\Forms\Forms
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Flash Player\AssetCache\TDEPNDF2\TDEPNDF2
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Flash Player\AssetCache\TDEPNDF2\TDEPNDF2
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\all\all
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\all\all
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brt\brt
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brt\brt
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brz\brz
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brz\brz
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\bul\bul
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\bul\bul
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\can\can
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\can\can
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\cfr\cfr
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\cfr\cfr
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\ctl\ctl
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\ctl\ctl
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\dan\dan
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\dan\dan
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\dut\dut
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\dut\dut
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\eng\eng
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\eng\eng
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\fin\fin
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\fin\fin
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\frn\frn
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\frn\frn
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\grm\grm
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\grm\grm
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\itl\itl
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\itl\itl
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\nrw\nrw
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\nrw\nrw
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\nyn\nyn
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\nyn\nyn
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\prt\prt
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\prt\prt
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\rus\rus
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\rus\rus
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\sgr\sgr
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\sgr\sgr
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\spn\spn
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\spn\spn
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\swd\swd
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\swd\swd
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Shockwave Player 11\DswMedia\DswMedia
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Shockwave Player 11\DswMedia\DswMedia
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Shockwave Player 11\Prefs\73LVAKZ4\73LVAKZ4
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Adobe\Shockwave Player 11\Prefs\73LVAKZ4\73LVAKZ4
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Identities\{3E8A0FEF-E2BD-462A-B35B-6A9625FEB350}\{3E8A0FEF-E2BD-462A-B35B-6A9625FEB350}
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Identities\{3E8A0FEF-E2BD-462A-B35B-6A9625FEB350}\{3E8A0FEF-E2BD-462A-B35B-6A9625FEB350}
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\InstallShield\ISEngine12.0\ISEngine12.0
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\InstallShield\ISEngine12.0\ISEngine12.0
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Macromedia\Flash Player\#SharedObjects\SKM83ZFS\SKM83ZFS
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Macromedia\Flash Player\#SharedObjects\SKM83ZFS\SKM83ZFS
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\AddIns\AddIns
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\AddIns\AddIns
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Crypto\RSA\RSA
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Crypto\RSA\RSA
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Media Player\Media Player
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Media Player\Media Player
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\MMC\MMC
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\MMC\MMC
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Protect\S-1-5-21-1026265181-1076296641-2814362281-500\S-1-5-21-1026265181-1076296641-2814362281-500
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Protect\S-1-5-21-1026265181-1076296641-2814362281-500\S-1-5-21-1026265181-1076296641-2814362281-500
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Protect\S-1-5-21-546664207-4165063253-1268107934-500\S-1-5-21-546664207-4165063253-1268107934-500
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Protect\S-1-5-21-546664207-4165063253-1268107934-500\S-1-5-21-546664207-4165063253-1268107934-500
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\Certificates\Certificates
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\Certificates\Certificates
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CRLs\CRLs
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CRLs\CRLs
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CTLs\CTLs
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CTLs\CTLs
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\0\0
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\0\0
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\1\1
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\1\1
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\12\12
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\12\12
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\13\13
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\13\13
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\14\14
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\14\14
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\15\15
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\15\15
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\16\16
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\16\16
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\17\17
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\17\17
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\18\18
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\18\18
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\19\19
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\19\19
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\20\20
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\20\20
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\21\21
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\21\21
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\22\22
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\22\22
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\23\23
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\23\23
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\25\25
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\25\25
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\27\27
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\27\27
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\29\29
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\29\29
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\3\3
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\3\3
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\31\31
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\31\31
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\34\34
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\34\34
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\35\35
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\35\35
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\36\36
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\36\36
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\37\37
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\37\37
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\4\4
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\4\4
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\40\40
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\40\40
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\41\41
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\41\41
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\43\43
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\43\43
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\44\44
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\44\44
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\45\45
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\45\45
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\46\46
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\46\46
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\47\47
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\47\47
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\49\49
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\49\49
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\5\5
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\5\5
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\50\50
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\50\50
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\51\51
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\51\51
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\52\52
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\52\52
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\54\54
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\54\54
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\57\57
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\57\57
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\58\58
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\58\58
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\60\60
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\60\60
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\61\61
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\61\61
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\62\62
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\62\62
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\63\63
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\63\63
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\7\7
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\7\7
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\8\8
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\8\8
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\9\9
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\9\9
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\host\host
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\host\host
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\muffin\muffin
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\muffin\muffin
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\tmp\tmp
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\tmp\tmp
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\ext\ext
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\ext\ext
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\log\log
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\log\log
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\security\security
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\security\security
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\tmp\si\si
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\tmp\si\si
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Bluetooth Software\sync\sync
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Bluetooth Software\sync\sync
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Desktop\Desktop
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Desktop\Desktop
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\OFFICE\OFFICE
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\OFFICE\OFFICE
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8GLGG1ZW\8GLGG1ZW
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8GLGG1ZW\8GLGG1ZW
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\F5TD8B3H\F5TD8B3H
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\F5TD8B3H\F5TD8B3H
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HUVWCNX5\HUVWCNX5
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HUVWCNX5\HUVWCNX5
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\SQAYLG8U\SQAYLG8U
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\SQAYLG8U\SQAYLG8U
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\My Documents\Bluetooth Exchange Folder\Bluetooth Exchange Folder
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\My Documents\Bluetooth Exchange Folder\Bluetooth Exchange Folder
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\NetHood\NetHood
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\NetHood\NetHood
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\PrintHood\PrintHood
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\PrintHood\PrintHood
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\UserData\6B6J8DYP\6B6J8DYP
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\UserData\6B6J8DYP\6B6J8DYP
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\UserData\C94JCN4J\C94JCN4J
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\UserData\C94JCN4J\C94JCN4J
 
Found mount point : C:\WINDOWS\system32\config\systemprofile\UserData\ER8DKBAR\ER8DKBAR
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\config\systemprofile\UserData\ER8DKBAR\ER8DKBAR
 
Found mount point : C:\WINDOWS\system32\dhcp\dhcp
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\dhcp\dhcp
 
Found mount point : C:\WINDOWS\system32\drivers\disdn\disdn
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\drivers\disdn\disdn
 
Found mount point : C:\WINDOWS\system32\export\export
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\export\export
 
Found mount point : C:\WINDOWS\system32\IME\CINTLGNT\CINTLGNT
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\IME\CINTLGNT\CINTLGNT
 
Found mount point : C:\WINDOWS\system32\IME\PINTLGNT\PINTLGNT
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\IME\PINTLGNT\PINTLGNT
 
Found mount point : C:\WINDOWS\system32\IME\TINTLGNT\TINTLGNT
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\IME\TINTLGNT\TINTLGNT
 
Found mount point : C:\WINDOWS\system32\inetsrv\inetsrv
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\inetsrv\inetsrv
 
Found mount point : C:\WINDOWS\system32\LogFiles\WUDF\WUDF
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\LogFiles\WUDF\WUDF
 
Found mount point : C:\WINDOWS\system32\Macromed\Macromed
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\Macromed\Macromed
 
Found mount point : C:\WINDOWS\system32\Microsoft\Crypto\RSA\MachineKeys\MachineKeys
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\Microsoft\Crypto\RSA\MachineKeys\MachineKeys
 
Cannot access: C:\WINDOWS\system32\MRT.exe
 
Attempting to restore permissions of : C:\WINDOWS\system32\MRT.exe
 
[1] 2009-07-29 20:49:14 24281536 C:\WINDOWS\system32\MRT.exe (Microsoft Corporation)
 
 
 
Found mount point : C:\WINDOWS\system32\mui\dispspec\dispspec
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\mui\dispspec\dispspec
 
Found mount point : C:\WINDOWS\system32\oobe\html\ispsgnup\ispsgnup
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\oobe\html\ispsgnup\ispsgnup
 
Found mount point : C:\WINDOWS\system32\oobe\html\oemcust\oemcust
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\oobe\html\oemcust\oemcust
 
Found mount point : C:\WINDOWS\system32\oobe\html\oemhw\oemhw
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\oobe\html\oemhw\oemhw
 
Found mount point : C:\WINDOWS\system32\oobe\html\oemreg\oemreg
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\oobe\html\oemreg\oemreg
 
Found mount point : C:\WINDOWS\system32\oobe\sample\sample
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\oobe\sample\sample
 
Found mount point : C:\WINDOWS\system32\ShellExt\ShellExt
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\ShellExt\ShellExt
 
Found mount point : C:\WINDOWS\system32\spool\drivers\WIN40\WIN40
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\spool\drivers\WIN40\WIN40
 
Found mount point : C:\WINDOWS\system32\spool\PRINTERS\PRINTERS
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\spool\PRINTERS\PRINTERS
 
Found mount point : C:\WINDOWS\system32\wbem\mof\bad\bad
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\wbem\mof\bad\bad
 
Found mount point : C:\WINDOWS\system32\wbem\mof\good\good
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\wbem\mof\good\good
 
Found mount point : C:\WINDOWS\system32\wbem\snmp\snmp
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\wbem\snmp\snmp
 
Found mount point : C:\WINDOWS\system32\wins\wins
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\wins\wins
 
Found mount point : C:\WINDOWS\system32\xircom\xircom
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\system32\xircom\xircom
 
Found mount point : C:\WINDOWS\Temp\BTN%Copy%1\BTN%Copy%2\BTN%Copy%2
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\Temp\BTN%Copy%1\BTN%Copy%2\BTN%Copy%2
 
Found mount point : C:\WINDOWS\Temp\QTENWBDB\Cache\Cache
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\Temp\QTENWBDB\Cache\Cache
 
Found mount point : C:\WINDOWS\Temp\QTENWBDB\CmcPolicies\CmcPolicies
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\Temp\QTENWBDB\CmcPolicies\CmcPolicies
 
Found mount point : C:\WINDOWS\Temp\QTENWBDB\CmcSettings\CmcSettings
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\Temp\QTENWBDB\CmcSettings\CmcSettings
 
Found mount point : C:\WINDOWS\Temp\QTENWBDB\IPSDefs\IPSDefs
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\Temp\QTENWBDB\IPSDefs\IPSDefs
 
Found mount point : C:\WINDOWS\Temp\QTENWBDB\LiveUpdate\LiveUpdate
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\Temp\QTENWBDB\LiveUpdate\LiveUpdate
 
Found mount point : C:\WINDOWS\Temp\QTENWBDB\VirDefs\VirDefs
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\Temp\QTENWBDB\VirDefs\VirDefs
 
Found mount point : C:\WINDOWS\Temp\SETUP496CF0CE9C\SETUP496CF0CE9C
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\Temp\SETUP496CF0CE9C\SETUP496CF0CE9C
 
Found mount point : C:\WINDOWS\Temp\SiteAdvisor\SiteAdvisor
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\Temp\SiteAdvisor\SiteAdvisor
 
Found mount point : C:\WINDOWS\Temp\TestEngDat64\TestEngDat64
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\Temp\TestEngDat64\TestEngDat64
 
Found mount point : C:\WINDOWS\Temp\_avast4_\_avast4_
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\Temp\_avast4_\_avast4_
 
Found mount point : C:\WINDOWS\TIREMOTE\Data\Data
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\TIREMOTE\Data\Data
 
Found mount point : C:\WINDOWS\WBEM\WBEM
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\WBEM\WBEM
 
Found mount point : C:\WINDOWS\WinSxS\InstallTemp\InstallTemp
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\WinSxS\InstallTemp\InstallTemp
 
Found mount point : C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2
 
Mount point destination : \Device\__max++>\^
 
Removing mount point : C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2
 
 
 
Finished!
 
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
 
Running Combo Fix and Malwarebytesw now.
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:
167:
168:
169:
170:
171:
172:
173:
174:
175:
176:
177:
178:
179:
180:
181:
182:
183:
184:
185:
186:
187:
188:
189:
190:
191:
192:
193:
194:
195:
196:
197:
198:
199:
200:
201:
202:
203:
204:
205:
206:
207:
208:
209:
210:
211:
212:
213:
214:
215:
216:
217:
218:
219:
220:
221:
222:
223:
224:
225:
226:
227:
228:
229:
230:
231:
232:
233:
234:
235:
236:
237:
238:
239:
240:
241:
242:
243:
244:
245:
246:
247:
248:
249:
250:
251:
252:
253:
254:
255:
256:
257:
258:
259:
260:
261:
262:
263:
264:
265:
266:
267:
268:
269:
270:
271:
272:
273:
274:
275:
276:
277:
278:
279:
280:
281:
282:
283:
284:
285:
286:
287:
288:
289:
290:
291:
292:
293:
294:
295:
296:
297:
298:
299:
300:
301:
302:
303:
304:
305:
306:
307:
308:
309:
310:
311:
312:
313:
314:
315:
316:
317:
318:
319:
320:
321:
322:
323:
324:
325:
326:
327:
328:
329:
330:
331:
332:
333:
334:
335:
336:
337:
338:
339:
340:
341:
342:
343:
344:
345:
346:
347:
348:
349:
350:
351:
352:
353:
354:
355:
356:
357:
358:
359:
360:
361:
362:
363:
364:
365:
366:
367:
368:
369:
370:
371:
372:
373:
374:
375:
376:
377:
378:
379:
380:
381:
382:
383:
384:
385:
386:
387:
388:
389:
390:
391:
392:
393:
394:
395:
396:
397:
398:
399:
400:
401:
402:
403:
404:
405:
406:
407:
408:
409:
410:
411:
412:
413:
414:
415:
416:
417:
418:
419:
420:
421:
422:
423:
424:
425:
426:
427:
428:
429:
430:
431:
432:
433:
434:
435:
436:
437:
438:
439:
440:
441:
442:
443:
444:
445:
446:
447:
448:
449:
450:
451:
452:
453:
454:
455:
456:
457:
458:
459:
460:
461:
462:
463:
464:
465:
466:
467:
468:
469:
470:
471:
472:
473:
474:
475:
476:
477:
478:
479:
480:
481:
482:
483:
484:
485:
486:
487:
488:
489:
490:
491:
492:
493:
494:
495:
496:
497:
498:
499:
500:
501:
502:
503:
504:
505:
506:
507:
508:
509:
510:
511:
512:
513:
514:
515:
516:
517:
518:
519:
520:
521:
522:
523:
524:
525:
526:
527:
528:
529:
530:
531:
532:
533:
534:
535:
536:
537:
538:
539:
540:
541:
542:
543:
544:
545:
546:
547:
548:
549:
550:
551:
552:
553:
554:
555:
556:
557:
558:
559:
560:
561:
562:
563:
564:
565:
566:
567:
568:
569:
570:
571:
572:
573:
574:
575:
576:
577:
578:
579:
580:
581:
582:
583:
584:
585:
586:
587:
588:
589:
590:
591:
592:
593:
594:
595:
596:
597:
598:
599:
600:
601:
602:
603:
604:
605:
606:
607:
608:
609:
610:
611:
612:
613:
614:
615:
616:
617:
618:
619:
620:
621:
622:
623:
624:
625:
626:
627:
628:
629:
630:
631:
632:
633:
634:
635:
636:
637:
638:
639:
640:
641:
642:
643:
644:
645:
646:
647:
648:
649:
650:
651:
652:
653:
654:
655:
656:
657:
658:
659:
660:
661:
662:
663:
664:
665:
666:
667:
668:
669:
670:
671:
672:
673:
674:
675:
676:
677:
678:
679:
680:
681:
682:
683:
684:
685:
686:
687:
688:
689:
690:
691:
692:
693:
694:
695:
696:
697:
698:
699:
700:
701:
702:
703:
704:
705:
706:
707:
708:
709:
710:
711:
712:
713:
714:
715:
716:
717:
718:
719:
720:
721:
722:
723:
724:
725:
726:
727:
728:
729:
730:
731:
732:
733:
734:
735:
736:
737:
738:
739:
740:
741:
742:
743:
744:
745:
746:
747:
748:
749:
750:
751:
752:
753:
754:
755:
756:
757:
758:
759:
760:
761:
762:
763:
764:
765:
766:
767:
768:
769:
770:
771:
772:
773:
774:
775:
776:
777:
778:
779:
780:
781:
782:
783:
784:
785:
786:
787:
788:
789:
790:
791:
792:
793:
794:
795:
796:
797:
798:
799:
800:
801:
802:
803:
804:
805:
806:
807:
808:
809:
810:
811:
812:
813:
814:
815:
816:
817:
818:
819:
820:
821:
822:
823:
824:
825:
826:
827:
828:
829:
830:
831:
832:
833:
834:
835:
836:
837:
838:
839:
840:
841:
842:
843:
844:
845:
846:
847:
848:
849:
850:
851:
852:
853:
854:
855:
856:
857:
858:
859:
860:
861:
862:
863:
864:
865:
866:
867:
868:
869:
870:
871:
872:
873:
874:
875:
876:
877:
878:
879:
880:
881:
882:
883:
884:
885:
886:
887:
888:
889:
890:
891:
892:
893:
894:
895:
896:
897:
898:
899:
900:
901:
902:
903:
904:
905:
906:
907:
908:
909:
910:
911:
912:
913:
914:
915:
916:
917:
918:
919:
920:
921:
922:
923:
924:
925:
926:
927:
928:
929:
930:
931:
932:
933:
934:
935:
936:
937:
938:
939:
940:
941:
942:
943:
944:
945:
946:
947:
948:
949:
950:
951:
952:
953:
954:
955:
956:
957:
958:
959:
960:
961:
962:
963:
964:
965:
966:
967:
968:
969:
970:
971:
972:
973:
974:
975:
976:
977:
978:
979:
980:
981:
982:
983:
984:
985:
986:
987:
988:
989:
990:
991:
992:
993:
994:
995:
996:
997:
998:
999:
1000:
1001:
1002:
1003:
1004:
1005:
1006:
1007:
1008:
1009:
1010:
1011:
1012:
1013:
1014:
1015:
1016:
1017:
1018:
1019:
1020:
1021:
1022:
1023:
1024:
1025:
1026:
1027:
1028:
1029:
1030:
1031:
1032:
1033:
1034:
1035:
1036:
1037:
1038:
1039:
1040:
1041:
1042:
1043:
1044:
1045:
1046:
1047:
1048:
1049:
1050:
1051:
1052:
1053:
1054:
1055:
1056:
1057:
1058:
1059:
1060:
1061:
1062:
1063:
1064:
1065:
1066:
1067:
1068:
1069:
1070:
1071:
1072:
1073:
1074:
1075:
1076:
1077:
1078:
1079:
1080:
1081:
1082:
1083:
1084:
1085:
1086:
1087:
1088:
1089:
1090:
1091:
1092:
1093:
1094:
1095:
1096:
1097:
1098:
1099:
1100:
1101:
1102:
1103:
1104:
1105:
1106:
1107:
1108:
1109:
1110:
1111:
1112:
1113:
1114:
1115:
1116:
1117:
1118:
1119:
1120:
1121:
1122:
1123:
1124:
1125:
1126:
1127:
1128:
1129:
1130:
1131:
1132:
1133:
1134:
1135:
1136:
1137:
1138:
1139:
1140:
1141:
1142:
1143:
1144:
1145:
1146:
1147:
1148:
1149:
1150:
1151:
1152:
1153:
1154:
1155:
1156:
1157:
1158:
1159:
1160:
1161:
1162:
1163:
1164:
1165:
1166:
1167:
1168:
1169:
1170:
1171:
1172:
1173:
1174:
1175:
1176:
1177:
1178:
1179:
1180:
1181:
1182:
1183:
1184:
1185:
1186:
1187:
1188:
1189:
1190:
1191:
1192:
1193:
1194:
1195:
1196:
1197:
1198:
1199:
1200:
1201:
1202:
1203:
1204:
1205:
1206:
1207:
1208:
1209:
1210:
1211:
1212:
1213:
1214:
1215:
1216:
1217:
1218:
1219:
1220:
1221:
1222:
1223:
1224:
1225:
1226:
1227:
1228:
1229:
1230:
1231:
1232:
1233:
1234:
1235:
1236:
1237:
1238:
1239:
1240:
1241:
1242:
1243:
1244:
1245:
1246:
1247:
1248:
1249:
1250:
1251:
1252:
1253:
1254:
1255:
1256:
1257:
1258:
1259:
1260:
1261:
1262:
1263:
1264:
1265:
1266:
1267:
1268:
1269:
1270:
1271:
1272:
1273:
1274:
1275:
1276:
1277:
1278:
1279:
1280:
1281:
1282:
1283:
1284:
1285:
1286:
1287:
1288:
1289:
1290:
1291:
1292:
1293:
1294:
1295:
1296:
1297:
1298:
1299:
1300:
1301:
1302:
1303:
1304:
1305:
1306:
1307:
1308:
1309:
1310:
1311:
1312:
1313:
1314:
1315:
1316:
1317:
1318:
1319:
1320:
1321:
1322:
1323:
1324:
1325:
1326:
1327:
1328:
1329:
1330:
1331:
1332:
1333:
1334:
1335:
1336:
1337:
1338:
1339:
1340:
1341:
1342:
1343:
1344:
1345:
1346:
1347:
1348:
1349:
1350:
1351:
1352:
1353:
1354:

ComboFix 09-09-05.02 - fabdeen 09/05/2009 22:29.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1976.1318 [GMT -4:00]
Running from: c:\documents and settings\fabdeen\Desktop\cbrf.exe
AV: avast! antivirus 4.8.1351 [VPS 090817-0] *On-access scanning enabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
 
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\program files\Adware Professional
c:\program files\Adware Professional\noadware4_090109.na
c:\program files\Adware Professional\nutilities.dll
c:\recycler\S-1-5-21-1026265181-1076296641-2814362281-1003
c:\recycler\S-1-5-21-1026265181-1076296641-2814362281-500
c:\recycler\S-1-5-21-546664207-4165063253-1268107934-500
c:\recycler\S-1-5-21-854245398-1788223648-682003330-500
c:\windows\Installer\1125fce.msi
 
----- BITS: Possible infected sites -----
 
hxxp://GLN-PS-APP-10:80
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}
-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE}
 
 
((((((((((((((((((((((((( Files Created from 2009-08-06 to 2009-09-06 )))))))))))))))))))))))))))))))
.
 
2009-09-06 02:06 . 2008-04-14 12:00 56320 ----a-w- C:\eventlog.dll
2009-09-06 00:25 . 2009-09-06 00:27 -------- d-----w- c:\program files\Windows Live Safety Center
2009-09-06 00:23 . 2009-09-06 00:23 -------- d-----w- c:\documents and settings\fabdeen\Application Data\Malwarebytes
2009-09-06 00:23 . 2009-08-03 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-06 00:23 . 2009-09-06 00:23 -------- d-----w- c:\program files\MB
2009-09-06 00:23 . 2009-09-06 00:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-06 00:23 . 2009-08-03 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-06 00:12 . 2009-09-06 00:12 -------- d-----w- c:\windows\system32\wbem\Repository
2009-09-05 07:11 . 2009-09-05 23:35 1484832 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-09-05 04:23 . 2009-09-06 00:12 -------- d-----w- c:\program files\Norton Support
2009-09-04 18:18 . 2009-09-06 00:20 153104 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2009-09-04 14:45 . 2009-09-04 18:45 -------- d-----w- c:\documents and settings\fabdeen\.housecall6.6
2009-09-04 13:40 . 2009-09-04 13:40 -------- d-----w- c:\program files\Alwil Software
2009-09-04 04:30 . 2009-09-04 04:30 -------- d-----w- c:\documents and settings\fabdeen\Application Data\PCToolsFirewallPlus
2009-09-04 04:30 . 2009-09-04 04:30 -------- d-----w- c:\documents and settings\fabdeen\Application Data\PCToolsSpamMonitorPlus
2009-09-04 04:28 . 2009-09-04 13:28 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-04 04:28 . 2009-09-04 13:28 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2009-09-04 04:16 . 2009-09-04 04:16 -------- d-----w- c:\program files\Enigma Software Group
2009-09-04 02:19 . 2009-09-04 02:19 -------- d-----w- c:\program files\GEAR Software
2009-09-04 02:19 . 2009-09-04 02:19 -------- d-----w- c:\documents and settings\All Users\Application Data\{1C6FDDD8-FC9E-4C12-9FA5-1AAD377097B3}
2009-09-04 02:18 . 2007-02-23 04:50 170408 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2009-09-04 02:18 . 2006-11-30 16:50 72264 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2009-09-04 02:18 . 2006-11-30 16:50 64360 ----a-w- c:\windows\system32\drivers\mfeapfk.sys
2009-09-04 02:18 . 2006-11-30 16:50 52136 ----a-w- c:\windows\system32\drivers\mfetdik.sys
2009-09-04 02:18 . 2006-11-30 16:50 34152 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2009-09-04 02:06 . 2009-09-04 02:06 36400 ----a-r- c:\windows\system32\drivers\SymIM.sys
2009-09-04 02:06 . 2009-09-04 02:06 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2009-09-04 02:06 . 2009-09-04 02:06 124464 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-09-04 02:06 . 2009-09-04 02:06 -------- d-----w- c:\program files\Symantec
2009-09-04 02:05 . 2009-09-04 02:05 -------- d-----w- c:\windows\system32\drivers\NAV
2009-09-04 02:05 . 2009-09-04 02:05 -------- d-----w- c:\program files\Norton AntiVirus
2009-09-03 21:13 . 2009-09-03 21:13 -------- d-----w- c:\windows\35C03C043F1F42C2A989A757EE691F65.TMP
2009-09-03 21:11 . 2009-09-04 02:05 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-09-03 12:07 . 2009-09-03 12:08 -------- d-----w- c:\program files\Lexmark
2009-09-01 20:03 . 2009-09-01 20:25 -------- d-----w- c:\program files\WinClear
2009-09-01 17:48 . 2009-09-01 17:48 -------- d-----w- C:\swshare
2009-09-01 17:29 . 2009-09-01 17:29 0 ----a-w- c:\windows\nsreg.dat
2009-09-01 17:29 . 2009-09-01 17:29 -------- d-----w- c:\documents and settings\fabdeen\Local Settings\Application Data\Mozilla
2009-09-01 16:15 . 2009-09-03 21:52 -------- d-----w- c:\documents and settings\fabdeen\Local Settings\Application Data\Symantec
2009-09-01 16:14 . 2007-03-22 00:39 1060864 ----a-w- c:\windows\system32\MFC71.DLL
2009-09-01 16:14 . 2009-09-04 02:06 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-09-01 16:14 . 2009-09-03 21:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2009-09-01 15:46 . 2009-09-06 02:14 -------- d--h--w- c:\windows\PIF
2009-09-01 15:32 . 2009-09-06 02:26 -------- d-----w- c:\documents and settings\fabdeen\Application Data\U3
2009-09-01 15:17 . 2009-09-01 15:17 -------- d-----w- c:\documents and settings\PSUser\Local Settings\Application Data\Google
2009-09-01 15:06 . 2009-09-01 15:06 -------- d-----w- c:\documents and settings\fabdeen\Local Settings\Application Data\Help
2009-09-01 14:03 . 2009-09-01 17:08 -------- d-----w- c:\program files\Google
2009-09-01 01:03 . 2009-08-07 08:48 100352 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-09-01 01:00 . 2009-09-01 14:02 -------- d-----w- c:\program files\Microsoft Silverlight
2009-08-29 22:26 . 2009-08-31 01:46 -------- d-----w- c:\program files\PersonalAV
2009-08-28 02:49 . 2009-08-28 02:50 -------- d-----w- c:\documents and settings\fabdeen\Local Settings\Application Data\Temp
2009-08-18 20:58 . 2009-08-18 20:58 -------- d-----w- c:\documents and settings\fabdeen\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-08-14 17:51 . 2009-08-14 17:51 35828 ---ha-w- c:\windows\system32\mlfcache.dat
2009-08-12 01:54 . 2009-08-20 01:34 -------- d-----w- c:\program files\Carbonite
2009-08-08 03:54 . 2009-08-08 03:54 -------- d-----w- c:\documents and settings\fabdeen\Local Settings\Application Data\Graboid_Inc
2009-08-08 03:54 . 2009-08-08 03:54 -------- d-----w- c:\documents and settings\fabdeen\Application Data\MozillaControl
2009-08-08 03:54 . 2009-08-08 03:54 -------- d-----w- c:\documents and settings\fabdeen\Local Settings\Application Data\Graboid
2009-08-08 03:53 . 2009-08-08 03:53 -------- d-----w- c:\program files\Mozilla ActiveX Control v1.7.12
2009-08-08 03:53 . 2009-08-08 03:53 -------- d-----w- c:\program files\VideoLAN
2009-08-08 03:52 . 2009-08-08 04:55 -------- d-----w- c:\program files\Graboid
2009-08-08 03:49 . 2009-08-08 03:49 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2009-08-08 03:39 . 2009-08-08 03:39 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-08-08 03:39 . 2009-08-28 02:31 -------- d-----w- c:\documents and settings\fabdeen\Local Settings\Application Data\Google
2009-08-08 03:39 . 2009-08-08 04:54 -------- d-----w- c:\program files\DivX
2009-08-08 03:24 . 2009-08-08 03:24 -------- d-sh--w- c:\documents and settings\fabdeen\IECompatCache
2009-08-07 12:36 . 2009-08-07 12:36 -------- d-----w- c:\windows\system32\XPSViewer
2009-08-07 12:36 . 2009-08-07 12:36 -------- d-----w- c:\program files\MSBuild
2009-08-07 12:36 . 2009-08-07 12:36 -------- d-----w- c:\program files\Reference Assemblies
2009-08-07 12:36 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-07 12:36 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-07 12:36 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-08-07 12:36 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-08-07 12:36 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-07 12:36 . 2009-08-07 12:36 -------- d-----w- C:\93bb788778edcbfb3d2bab56
2009-08-07 12:36 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-08-07 12:36 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-08-07 12:36 . 2009-09-06 02:14 -------- d-----w- c:\windows\SxsCaPendDel
 
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-05 23:34 . 2009-09-05 07:11 18452 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-09-05 13:13 . 2009-09-05 13:13 114688 ----a-w- c:\windows\~DF6E4B.tmp
2009-09-05 13:09 . 2009-09-05 13:09 114688 ----a-w- c:\windows\~DF1F7.tmp
2009-09-05 13:04 . 2009-09-05 13:04 114688 ----a-w- c:\windows\~DFE540.tmp
2009-09-05 12:53 . 2009-09-05 12:53 114688 ----a-w- c:\windows\~DF7E34.tmp
2009-09-05 12:52 . 2009-09-05 12:52 114688 ----a-w- c:\windows\~DF6617.tmp
2009-09-05 12:50 . 2009-09-05 12:50 114688 ----a-w- c:\windows\~DFE3F4.tmp
2009-09-04 18:42 . 2009-01-13 19:35 -------- d-----w- c:\program files\Java
2009-09-04 02:06 . 2009-09-04 02:06 805 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-09-04 02:06 . 2009-09-04 02:06 7386 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-09-04 02:05 . 2009-09-04 02:05 -------- d-----w- c:\program files\Windows Sidebar
2009-09-04 02:05 . 2009-09-03 21:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2009-09-04 02:05 . 2009-09-04 02:05 -------- d-----w- c:\program files\NortonInstaller
2009-09-03 21:37 . 2009-06-30 22:55 60520 ----a-w- c:\documents and settings\fabdeen\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-01 17:36 . 2009-06-29 18:47 -------- d-----w- c:\documents and settings\fabdeen\Application Data\Aventail
2009-09-01 17:35 . 2009-01-13 19:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Aventail
2009-09-01 15:38 . 2009-06-29 20:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-09-01 15:34 . 2009-08-03 02:07 -------- d-----w- c:\program files\Yahoo!
2009-09-01 15:13 . 2009-07-28 15:53 -------- d-----w- c:\documents and settings\PSUser\Application Data\LimeWire
2009-08-31 16:47 . 2009-06-29 20:25 -------- d-----w- c:\program files\Lx_cats
2009-08-19 17:39 . 2009-01-16 20:46 -------- d-----w- c:\documents and settings\PSUser\Application Data\Aventail
2009-08-12 23:28 . 2009-01-13 19:00 -------- d-----w- c:\program files\Common Files\Lenovo
2009-08-12 23:28 . 2009-01-13 18:55 -------- d-----w- c:\program files\Lenovo
2009-08-08 04:56 . 2009-08-03 02:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-08-08 04:56 . 2009-08-03 02:08 -------- d-----w- c:\documents and settings\fabdeen\Application Data\Yahoo!
2009-08-05 09:01 . 2008-04-14 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-03 02:08 . 2009-08-03 02:08 262144 ----a-w- C:\ntuser.dat
2009-07-29 00:03 . 2009-07-29 00:03 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore
2009-07-28 16:33 . 2009-01-15 22:46 -------- d-----w- c:\program files\McAfee
2009-07-25 09:23 . 2009-01-13 19:35 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-23 19:50 . 2009-07-23 19:51 94208 ----a-w- c:\windows\TIRHService.exe
2009-07-21 12:32 . 2009-07-21 12:32 -------- d-----w- c:\documents and settings\NetworkService\Application Data\SACore
2009-07-21 12:31 . 2009-07-21 12:31 -------- d-----w- c:\documents and settings\All Users\Application Data\SiteAdvisor
2009-07-21 12:31 . 2009-01-15 22:47 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2009-07-21 12:31 . 2009-01-15 22:46 -------- d-----w- c:\program files\Common Files\McAfee
2009-07-19 22:48 . 2009-03-08 08:39 11067392 ----a-w- c:\windows\system32\ieframe(2).dll
2009-07-17 19:01 . 2008-04-14 12:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 03:43 . 2008-04-14 12:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 2008-04-14 12:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-07-03 17:09 . 2008-04-14 12:00 915456 ----a-w- c:\windows\system32\wininet(2).dll
2009-07-03 17:09 . 2008-04-14 12:00 1208832 ----a-w- c:\windows\system32\urlmon(2).dll
2009-07-03 17:09 . 2009-03-08 08:32 1985536 ----a-w- c:\windows\system32\iertutil(2).dll
2009-06-29 20:36 . 2009-06-29 20:36 45056 ----a-w- c:\windows\NCUNINST.EXE
2009-06-26 16:50 . 2008-04-14 12:00 666624 ----a-w- c:\windows\system32\wininet(3).dll
2009-06-26 16:50 . 2008-04-14 12:00 620032 ----a-w- c:\windows\system32\urlmon(3).dll
2009-06-25 08:25 . 2008-04-14 12:00 730112 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 2008-04-14 12:00 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 2008-04-14 12:00 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2008-04-14 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-25 08:25 . 2008-04-14 12:00 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 2008-04-14 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-24 11:18 . 2008-04-14 12:00 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:36 . 2008-04-14 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2008-04-14 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-12 12:31 . 2008-04-14 12:00 80896 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2008-04-14 12:00 76288 ----a-w- c:\windows\system32\telnet.exe
2009-06-10 14:13 . 2008-04-14 12:00 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 13:19 . 2009-01-13 17:51 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 2008-04-14 12:00 132096 ----a-w- c:\windows\system32\wkssvc.dll
.
 
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinVNC"="c:\program files\UltraVNC\WinVNC.exe" [2005-08-07 974848]
"TVT Scheduler Proxy"="c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2008-08-21 487424]
"Track-It! Workstation Manager Service Monitor"="c:\windows\TIREMOTE\TIServiceMonitor.exe" [2008-11-13 166912]
"TPKMAPHELPER"="c:\program files\ThinkPad\Utilities\TpKmapAp.exe" [2007-01-10 868352]
"TPHOTKEY"="c:\program files\Lenovo\HOTKEY\TPOSDSVC.exe" [2008-10-01 68976]
"TPFNF7"="c:\program files\Lenovo\NPDIRECT\TPFNF7SP.exe" [2008-07-31 60192]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-07-04 1323008]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2007-02-23 112216]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-10-31 150040]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2006-12-19 136768]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-10-31 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-10-31 178712]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 169984]
"TpShocks"="TpShocks.exe" - c:\windows\system32\TpShocks.exe [2008-08-02 181536]
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
2006-09-07 00:37 34344 ----a-w- c:\program files\Lenovo\HOTKEY\notifyf2.dll
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2008-08-09 03:14 28672 ----a-w- c:\program files\Lenovo\HOTKEY\tphklock.dll
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"
 
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
 
R0 Shockprf;Shockprf;c:\windows\system32\drivers\ApsX86.sys [6/10/2008 8:39 PM 116264]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1005000.086\SymEFA.sys [9/3/2009 10:06 PM 310320]
R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [6/10/2008 8:39 PM 19496]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NAV\1005000.086\BHDrvx86.sys [9/3/2009 10:06 PM 258608]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NAV\1005000.086\cchpx86.sys [9/3/2009 10:06 PM 482352]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090206.001\IDSxpx86.sys [9/3/2009 10:06 PM 276344]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [7/21/2009 8:31 AM 210216]
R2 NgVpnMgr;Aventail VPN Client;c:\windows\system32\ngvpnmgr.exe [4/10/2006 1:15 PM 309829]
R2 TIRmtSvc;Track-It! Workstation Manager;c:\windows\TIREMOTE\TIRemoteService.exe [7/23/2009 3:51 PM 214016]
R2 UNS;Intel(R) Active Management Technology User Notification Service;c:\program files\Common Files\Intel\Privacy Icon\UNS\UNS.exe [1/13/2009 8:19 PM 2058776]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [6/13/2008 8:42 PM 243856]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [9/3/2009 10:06 PM 101936]
R3 NgLog;Aventail VPN Logging;c:\windows\system32\drivers\nglog.sys [4/10/2006 1:13 PM 18432]
R3 NgVpn;Aventail VPN Adapter;c:\windows\system32\drivers\NgVpn.sys [4/10/2006 1:14 PM 68096]
S2 Norton AntiVirus;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe [9/3/2009 10:06 PM 115560]
S3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\Drivers\ATSwpWDF.sys --> c:\windows\system32\Drivers\ATSwpWDF.sys [?]
S3 NgFilter;Aventail VPN Filter;c:\windows\system32\drivers\ngfilter.sys [4/10/2006 1:14 PM 15360]
 
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
 
2009-01-16 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\PCDR5\pcdr5cuiw32.exe [2008-10-31 18:14]
.
- - - - ORPHANS REMOVED - - - -
 
Toolbar-Locked - (no file)
WebBrowser-{A26503FE-B3B8-4910-A9DC-9CBD25C6B8D6} - (no file)
 
 
.
------- Supplementary Scan -------
.
uLocal Page = \blank.htm
uStart Page = www.google.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
Trusted Zone: ps.com
Trusted Zone: ps.com\psweb
Trusted Zone: ps.com\webchamp
Trusted Zone: ps.com\webstaffing
Trusted Zone: psportal.net\dmhome
DPF: {ED324F9E-715D-4BE2-B6DF-44FCB674AADF} - hxxp://dmhome.psportal.net/dmportal/Portal/resources/msddsc.cab
.
 
**************************************************************************
 
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-05 22:34
Windows 5.1.2600 Service Pack 3 NTFS
 
scanning hidden processes ...
 
scanning hidden autostart entries ...
 
scanning hidden files ...
 
scan completed successfully
hidden files: 0
 
**************************************************************************
 
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Norton AntiVirus]
"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe\" /s \"Norton AntiVirus\" /m \"c:\program files\Norton AntiVirus\Engine\16.5.0.134\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
 
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
 
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
 
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"
 
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
 
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
 
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
 
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
 
- - - - - - - > 'winlogon.exe'(1612)
c:\program files\Lenovo\HOTKEY\tphklock.dll
 
- - - - - - - > 'explorer.exe'(2896)
c:\windows\system32\WININET.dll
c:\program files\McAfee\SiteAdvisor\saHook.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ibmpmsvc.exe
c:\program files\Intel\WiFi\bin\S24EvMon.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\program files\Lenovo\HOTKEY\TPONSCR.exe
c:\program files\Lenovo\ZOOM\TpScrex.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Synaptics\SynTP\SynTPLpr.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\program files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
c:\windows\system32\TPHDEXLG.exe
c:\windows\system32\TpKmpSvc.exe
c:\program files\Common Files\Lenovo\Scheduler\tvtsched.exe
c:\windows\system32\CCM\clicomp\RemCtrl\Wuser32.exe
c:\windows\system32\CCM\CcmExec.exe
c:\program files\McAfee\Common Framework\Mctray.exe
c:\program files\Lenovo\System Update\SUService.exe
c:\program files\ThinkPad\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\msiexec.exe
c:\windows\system32\LMabcoms.exe
.
**************************************************************************
.
Completion time: 2009-09-06 22:36 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-06 02:35
 
Pre-Run: 143,582,810,112 bytes free
Post-Run: 144,460,582,912 bytes free
 
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
 
325 --- E O F --- 2009-08-27 10:

                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:
167:
168:
169:
170:
171:
172:
173:
174:
175:
176:
177:
178:
179:
180:
181:
182:
183:
184:
185:
186:
187:
188:
189:
190:
191:
192:
193:
194:
195:
196:
197:
198:
199:
200:
201:
202:
203:
204:
205:
206:
207:
208:
209:
210:
211:
212:
213:
214:
215:
216:
217:
218:
219:
220:
221:
222:
223:
224:
225:
226:
227:
228:
229:
230:
231:
232:
233:
234:
235:
236:
237:
238:
239:
240:
241:
242:
243:
244:
245:
246:
247:
248:
249:
250:
251:
252:
253:
254:
255:
256:
257:
258:
259:
260:
261:
262:
263:
264:
265:
266:
267:
268:
269:
270:
271:
272:
273:
274:
275:
276:
277:
278:
279:
280:
281:
282:
283:
284:
285:
286:
287:
288:
289:
290:
291:
292:
293:
294:
295:
296:
297:
298:
299:
300:
301:
302:
303:
304:
305:
306:
307:
308:
309:
310:
311:
312:
313:
314:
315:
316:
317:
318:
319:
320:
321:
322:
323:
324:
325:
326:
327:
328:
329:
330:
331:
332:
333:
334:
335:
336:
337:
338:
339:
340:
341:
342:
343:
344:
345:
346:
347:
348:
349:
350:
351:
352:
353:
354:
355:
356:
357:
358:
359:
360:
361:
362:
363:
364:
365:
366:
367:
368:
369:
370: