Options
Unknown Problem
Hi, I'm sure i have a virus or trojan that I cannot seem to remove, i've tried scanning with adaware and avast before I found this site. I notice my computer runs slower than usual and it resets for no apparent reason (there were some times where it resets when avast was booting up or scanning).
I've tried the steps on this forum except for the panda scan which avast said was a trojan.
Here is hijackthis log file
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:16:35 AM, on 20/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
D:\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
D:\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\Rainlendar\Rainlendar.exe
C:\Downloads\yzdock0083\YzDock.exe
C:\Program Files\Antiy Labs\Alive\ALiveCenter_.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
D:\Alwil Software\Avast4\ashMaiSv.exe
D:\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Winamp\winamp.exe
C:\TopazChat\TopazChat.exe
C:\Program Files\mIRC\mirc.exe
C:\Downloads\HiJackThis.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Antiy Auto Update] C:\Program Files\Antiy Labs\Alive\ALiveCenter.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [avast!] D:\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Rainlendar.lnk = C:\Program Files\Rainlendar\Rainlendar.exe
O4 - Startup: YzDock.lnk = C:\Downloads\yzdock0083\YzDock.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-AU/a-UNO1/GAME_UNO1.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C6F83508-E7BD-4B83-B29F-24478B86BEC0}: NameServer = 203.12.160.35,203.12.160.36
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
--
End of file - 6872 bytes
Here is the Kaspersky logfile
KASPERSKY ONLINE SCANNER REPORT
Saturday, October 20, 2007 1:09:26 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 19/10/2007
Kaspersky Anti-Virus database records: 439796
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
J:\
Scan Statistics:
Total number of scanned objects: 70440
Number of viruses found: 1
Number of infected objects: 7
Number of suspicious objects: 0
Duration of the scan process: 01:04:50
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\enso\Application Data\Mozilla\Firefox\Profiles\499y8dd5.default\cert8.db Object is locked skipped
C:\Documents and Settings\enso\Application Data\Mozilla\Firefox\Profiles\499y8dd5.default\history.dat Object is locked skipped
C:\Documents and Settings\enso\Application Data\Mozilla\Firefox\Profiles\499y8dd5.default\key3.db Object is locked skipped
C:\Documents and Settings\enso\Application Data\Mozilla\Firefox\Profiles\499y8dd5.default\parent.lock Object is locked skipped
C:\Documents and Settings\enso\Application Data\Mozilla\Firefox\Profiles\499y8dd5.default\search.sqlite Object is locked skipped
C:\Documents and Settings\enso\Application Data\Mozilla\Firefox\Profiles\499y8dd5.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\enso\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Application Data\Microsoft\Windows Live Contacts\ic_blue@hotmail.com\real\members.stg Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Application Data\Microsoft\Windows Live Contacts\ic_blue@hotmail.com\shadow\members.stg Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Application Data\Mozilla\Firefox\Profiles\499y8dd5.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Application Data\Mozilla\Firefox\Profiles\499y8dd5.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Application Data\Mozilla\Firefox\Profiles\499y8dd5.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Application Data\Mozilla\Firefox\Profiles\499y8dd5.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\enso\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Temp\~DFF010.tmp Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Temp\~DFF01C.tmp Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Temp\~DFF861.tmp Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Temp\~DFF915.tmp Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Temp\~ROMFN_00000F7C Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\enso\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\enso\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\logs\starwind.2007-10-19.23-26-06.log Object is locked skipped
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped
C:\Program Files\Winamp\Plugins\AudioScrobbler.log.txt Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{54B26B70-7618-4A34-9D29-D571DCBFBD8B}\RP297\A0057332.exe/stream/data0008 Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped
C:\System Volume Information\_restore{54B26B70-7618-4A34-9D29-D571DCBFBD8B}\RP297\A0057332.exe/stream Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped
C:\System Volume Information\_restore{54B26B70-7618-4A34-9D29-D571DCBFBD8B}\RP297\A0057332.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{54B26B70-7618-4A34-9D29-D571DCBFBD8B}\RP298\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_5a0.dat Object is locked skipped
C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
D:\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
D:\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped
D:\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped
D:\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
D:\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped
D:\downloads dump\bitcomet\mIRC 6.21\mirc621.exe/stream/data0008 Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped
D:\downloads dump\bitcomet\mIRC 6.21\mirc621.exe/stream Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped
D:\downloads dump\bitcomet\mIRC 6.21\mirc621.exe NSIS: infected - 2 skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033477.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033478.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033479.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033480.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033481.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033482.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033483.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033484.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033485.ver Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033486.inf Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033487.cat Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033488.sys Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033489.ver Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033490.inf Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033491.cat Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033492.sys Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033493.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033494.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033495.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033496.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033497.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033498.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033499.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033500.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033501.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033502.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033503.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033504.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033505.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033506.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033507.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033508.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033509.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033510.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033511.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033512.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033513.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033514.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033515.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033516.cat Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033517.cat Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033518.inf Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033519.inf Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033520.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033521.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033522.ver Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033523.ver Object is locked skipped
G:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
Scan process completed.
Thank you for your help!
I've tried the steps on this forum except for the panda scan which avast said was a trojan.
Here is hijackthis log file
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:16:35 AM, on 20/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
D:\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
D:\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\Rainlendar\Rainlendar.exe
C:\Downloads\yzdock0083\YzDock.exe
C:\Program Files\Antiy Labs\Alive\ALiveCenter_.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
D:\Alwil Software\Avast4\ashMaiSv.exe
D:\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Winamp\winamp.exe
C:\TopazChat\TopazChat.exe
C:\Program Files\mIRC\mirc.exe
C:\Downloads\HiJackThis.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Antiy Auto Update] C:\Program Files\Antiy Labs\Alive\ALiveCenter.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [avast!] D:\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Rainlendar.lnk = C:\Program Files\Rainlendar\Rainlendar.exe
O4 - Startup: YzDock.lnk = C:\Downloads\yzdock0083\YzDock.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-AU/a-UNO1/GAME_UNO1.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C6F83508-E7BD-4B83-B29F-24478B86BEC0}: NameServer = 203.12.160.35,203.12.160.36
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
--
End of file - 6872 bytes
Here is the Kaspersky logfile
KASPERSKY ONLINE SCANNER REPORT
Saturday, October 20, 2007 1:09:26 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 19/10/2007
Kaspersky Anti-Virus database records: 439796
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
J:\
Scan Statistics:
Total number of scanned objects: 70440
Number of viruses found: 1
Number of infected objects: 7
Number of suspicious objects: 0
Duration of the scan process: 01:04:50
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\enso\Application Data\Mozilla\Firefox\Profiles\499y8dd5.default\cert8.db Object is locked skipped
C:\Documents and Settings\enso\Application Data\Mozilla\Firefox\Profiles\499y8dd5.default\history.dat Object is locked skipped
C:\Documents and Settings\enso\Application Data\Mozilla\Firefox\Profiles\499y8dd5.default\key3.db Object is locked skipped
C:\Documents and Settings\enso\Application Data\Mozilla\Firefox\Profiles\499y8dd5.default\parent.lock Object is locked skipped
C:\Documents and Settings\enso\Application Data\Mozilla\Firefox\Profiles\499y8dd5.default\search.sqlite Object is locked skipped
C:\Documents and Settings\enso\Application Data\Mozilla\Firefox\Profiles\499y8dd5.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\enso\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Application Data\Microsoft\Windows Live Contacts\ic_blue@hotmail.com\real\members.stg Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Application Data\Microsoft\Windows Live Contacts\ic_blue@hotmail.com\shadow\members.stg Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Application Data\Mozilla\Firefox\Profiles\499y8dd5.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Application Data\Mozilla\Firefox\Profiles\499y8dd5.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Application Data\Mozilla\Firefox\Profiles\499y8dd5.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Application Data\Mozilla\Firefox\Profiles\499y8dd5.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\enso\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Temp\~DFF010.tmp Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Temp\~DFF01C.tmp Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Temp\~DFF861.tmp Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Temp\~DFF915.tmp Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Temp\~ROMFN_00000F7C Object is locked skipped
C:\Documents and Settings\enso\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\enso\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\enso\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\logs\starwind.2007-10-19.23-26-06.log Object is locked skipped
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped
C:\Program Files\Winamp\Plugins\AudioScrobbler.log.txt Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{54B26B70-7618-4A34-9D29-D571DCBFBD8B}\RP297\A0057332.exe/stream/data0008 Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped
C:\System Volume Information\_restore{54B26B70-7618-4A34-9D29-D571DCBFBD8B}\RP297\A0057332.exe/stream Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped
C:\System Volume Information\_restore{54B26B70-7618-4A34-9D29-D571DCBFBD8B}\RP297\A0057332.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{54B26B70-7618-4A34-9D29-D571DCBFBD8B}\RP298\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_5a0.dat Object is locked skipped
C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
D:\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
D:\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped
D:\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped
D:\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
D:\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped
D:\downloads dump\bitcomet\mIRC 6.21\mirc621.exe/stream/data0008 Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped
D:\downloads dump\bitcomet\mIRC 6.21\mirc621.exe/stream Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped
D:\downloads dump\bitcomet\mIRC 6.21\mirc621.exe NSIS: infected - 2 skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033477.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033478.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033479.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033480.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033481.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033482.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033483.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033484.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033485.ver Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033486.inf Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033487.cat Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033488.sys Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033489.ver Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033490.inf Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033491.cat Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033492.sys Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033493.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033494.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033495.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033496.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033497.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033498.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033499.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033500.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033501.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033502.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033503.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033504.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033505.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033506.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033507.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033508.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033509.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033510.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033511.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033512.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033513.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033514.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033515.dll Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033516.cat Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033517.cat Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033518.inf Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033519.inf Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033520.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033521.exe Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033522.ver Object is locked skipped
F:\System Volume Information\_restore{BA89A933-9138-422F-8776-56D8950D07B6}\RP72\A0033523.ver Object is locked skipped
G:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
Scan process completed.
Thank you for your help!
0