1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Need Help Getting Rid of Virus

Discussion in 'Virus & Other Malware Removal' started by Hjalpamig, Feb 11, 2012.

Thread Status:
Not open for further replies.
Advertisement
  1. Hjalpamig

    Hjalpamig Thread Starter

    Joined:
    Feb 10, 2012
    Messages:
    1
    [FONT=&quot]My computer is unstable, freezes frequently, and is apparently infected by a virus.[/FONT]​
    [FONT=&quot] [/FONT]​
    [FONT=&quot]I am running Windows XP Professional on a Lenovo Thinkpad T61. Service Pack 2 is installed. I am unable to download SP 3. I run Avast as an Antivirus Program, and have also added Ad-Aware since the problem arose[/FONT]​
    [FONT=&quot] [/FONT]​
    While accessing the internet on about January 19, I got an Avast warning that an executable file was trying to run, and that I should open it in the sandbox. I did. I soon began to receive other warnings, however, that websites that I was trying to visit were being blocked by Avast, and, frequently, I could not get onto the websites because the “page would not load.” This happened with even the most innocuous of websites, such as news sources.
    Then, during that same session, my computer shut down, and I received the following message:
    Stop (blue screen) error caused by a device or driver. You received this message because a hardware device, its driver, or related software has caused a stop error, also called a blue screen error. This type of error means the computer has shut down abruptly to protect itself from potential data corruption or loss. In this case, we were unable to detect the specific device or driver that caused the problem.
    I attempted to restore my computer to an earlier restore point, to go back before the virus arrived. When I went to Start, Programs, however, the “Accessories” tab was not there. I was able to find the program on my computer. When I tried to restore the computer to an earlier date, it would not let me do it. I tried about eight times with several different dates.
    I ran several different antivirus programs, and they found and removed numerous things, including one Trojan.
    After running these antivirus programs, the problems I was having changed. I was no longer blocked from visiting web pages, and the Avast warnings stopped popping up constantly, but I instead became more unstable. The computer freezes frequently and, yesterday, shutdown and recovered from a serious error. Also, I get new, different warnings from Avast, including the following:
    1. [FONT=&quot]MBR:\\.\PHYSICALDRIVE0\Partition3 Rootkit hidden boot (I was advised to delete this, and then do a boot-time scan. I did so, but the warning has re-appeared on several occassions.)
    [/FONT]​
    [FONT=&quot] [/FONT]​
    [FONT=&quot]2. URL: http://aircadriveres.com/cat/v3/main.php?AuUXfTAYAaCN3J1YmJT6Ykode3O toMwaERcGXnFCGc9UUMfhGPFAGUC2jjlLyleYLrz6QbFmXXPiGJfGRJecTgPNu7AHkwpMDrfEg[FONT=&quot][/FONT][/FONT]​
    [FONT=&quot]Process: file://C:\WINDOWS\system32\svchost.exe[FONT=&quot][/FONT][/FONT]​
    [FONT=&quot]Infection: url: Mal[/FONT]​
    [FONT=&quot] [/FONT]​
    [FONT=&quot]3. Trojan Agent Registry Value HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Runlylxkrwhfv3 Value: Runlylxkrwhfv3[/FONT]​
    [FONT=&quot]I have tried to download Service Pack 3 for Microsoft Windows XP, but when I run it, it does not complete the update. I get a dialogue box that says as follows: “Service Pack 3 Setup Error. The file C:\Windows\system32\ntkrnlpa.exe is open or in use by another apprlication. Close all other applications and then click retry.” When I go to Windows Task Manager, however, I can see no other application running. [/FONT]​
    [FONT=&quot] [/FONT]​
    [FONT=&quot]Similarly, I attempted to run Windows antivirus program, msert.exe, but it would not run. I got the following warning: “C:\Documents\Lenovo\My Documents\Downloads\msert.exe. This application has failed to start because the application configuration is incorrect. Reinstalling the application may fix the problem.” [/FONT]​
    [FONT=&quot] [/FONT]​
    [FONT=&quot]Below, I attach the relevant “HijackThis” and “GMER” logs. [/FONT]​
    [FONT=&quot] [/FONT]​
    [FONT=&quot]I am not able to get a DDS log. When I did so, I get a dialogue box that reads as follows:[/FONT]​
    [FONT=&quot] [/FONT]​
    [FONT=&quot]C:\D.D.S.[/FONT]​
    [FONT=&quot] [/FONT]​
    [FONT=&quot]As per the instructions you would have received, kindly ensure any onboard script blocking tools have been disabled for they shall interfere with DDS.[/FONT]​
    [FONT=&quot] [/FONT]​
    [FONT=&quot]DDS is a non-invasive diagnostic tool.[/FONT]​
    [FONT=&quot] [/FONT]​
    [FONT=&quot]- [FONT=&quot]DDS makes no registry writes/changes.[/FONT][/FONT]​
    [FONT=&quot]- [FONT=&quot]DDS does not create any permanent files/folders[/FONT][/FONT]​
    [FONT=&quot] [/FONT]​
    [FONT=&quot]This scan should not take longer than three minutes to complete.[/FONT]​
    [FONT=&quot] [/FONT]​
    [FONT=&quot]When the scan is complete, a longfile/report shall pop open.[/FONT]​
    [FONT=&quot] [/FONT]​
    [FONT=&quot]Post the contents of the logfile to the forum where it was requested.[/FONT]​
    [FONT=&quot] [/FONT]​
    [FONT=&quot] #######################################[/FONT]​
    [FONT=&quot] [/FONT]​
    [FONT=&quot]Note the “#” signs on the bottom. As the process seems to run, it puts out these symbols one by one, and then stops after about three minutes. (Note, I disabled Avast when I ran the program.) [FONT=&quot][/FONT][/FONT]​
    [FONT=&quot] [/FONT]​
    [FONT=&quot]Also, when I run the GMER application, I get a warning that says as follows: “LoadDriver( C:\Documen~1\LENOVO\LOCALS~1|Temp\ugddraod.sys") error 0xC0000010E; Cannot Create a stable subkey under a volatile parent key.” I clicked “OK” and then the GMER dialogue box opened and appeared to run a scan. It lasted only about five seconds, however, and returned no results. I then clicked “scan,” and got the results posted below. [/FONT]​

    [FONT=&quot]HIJACK THIS LOG:
    [/FONT]
    [FONT=&quot] [/FONT]
    [FONT=&quot] [/FONT]
    [FONT=&quot] [/FONT]
    [FONT=&quot] [/FONT]
    [FONT=&quot]Logfile of Trend Micro HijackThis v2.0.2[/FONT]
    [FONT=&quot]Scan saved at 5:37:55 PM, on 2/10/2012[/FONT]
    [FONT=&quot]Platform: Windows XP SP2 (WinNT 5.01.2600)[/FONT]
    [FONT=&quot]MSIE: Internet Explorer v7.00 (7.00.6000.17055)[/FONT]
    [FONT=&quot]Boot mode: Normal[/FONT]
    [FONT=&quot] [/FONT]
    [FONT=&quot]Running processes:[/FONT]
    [FONT=&quot]C:\WINDOWS\System32\smss.exe[/FONT]
    [FONT=&quot]C:\WINDOWS\system32\winlogon.exe[/FONT]
    [FONT=&quot]C:\WINDOWS\system32\services.exe[/FONT]
    [FONT=&quot]C:\WINDOWS\system32\lsass.exe[/FONT]
    [FONT=&quot]C:\WINDOWS\system32\ibmpmsvc.exe[/FONT]
    [FONT=&quot]C:\WINDOWS\system32\svchost.exe[/FONT]
    [FONT=&quot]C:\WINDOWS\System32\svchost.exe[/FONT]
    [FONT=&quot]C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe[/FONT]
    [FONT=&quot]C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[/FONT]
    [FONT=&quot]C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe[/FONT]
    [FONT=&quot]C:\Program Files\AVAST Software\Avast\AvastSvc.exe[/FONT]
    [FONT=&quot]C:\WINDOWS\system32\spoolsv.exe[/FONT]
    [FONT=&quot]C:\WINDOWS\system32\IPSSVC.EXE[/FONT]
    [FONT=&quot]C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe[/FONT]
    [FONT=&quot]C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[/FONT]
    [FONT=&quot]C:\Program Files\Bonjour\mDNSResponder.exe[/FONT]
    [FONT=&quot]C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe[/FONT]
    [FONT=&quot]C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[/FONT]
    [FONT=&quot]C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[/FONT]
    [FONT=&quot]C:\WINDOWS\system32\svchost.exe[/FONT]
    [FONT=&quot]c:\program files\lenovo\system update\suservice.exe[/FONT]
    [FONT=&quot]C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe[/FONT]
    [FONT=&quot]C:\WINDOWS\System32\TPHDEXLG.exe[/FONT]
    [FONT=&quot]C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe[/FONT]
    [FONT=&quot]C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe[/FONT]
    [FONT=&quot]c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe[/FONT]
    [FONT=&quot]C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe[/FONT]
    [FONT=&quot]C:\Program Files\Common Files\Lenovo\Logger\logmon.exe[/FONT]
    [FONT=&quot]C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe[/FONT]
    [FONT=&quot]C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe[/FONT]
    [FONT=&quot]C:\WINDOWS\system32\wscntfy.exe[/FONT]
    [FONT=&quot]C:\WINDOWS\Explorer.EXE[/FONT]
    [FONT=&quot]C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe[/FONT]
    [FONT=&quot]C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[/FONT]
    [FONT=&quot]C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[/FONT]
    [FONT=&quot]C:\WINDOWS\system32\rundll32.exe[/FONT]
    [FONT=&quot]C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe[/FONT]
    [FONT=&quot]C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe[/FONT]
    [FONT=&quot]C:\WINDOWS\system32\TpShocks.exe[/FONT]
    [FONT=&quot]C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe[/FONT]
    [FONT=&quot]C:\Program Files\Analog Devices\Core\smax4pnp.exe[/FONT]
    [FONT=&quot]C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[/FONT]
    [FONT=&quot]C:\Program Files\Lenovo\Zoom\TpScrex.exe[/FONT]
    [FONT=&quot]C:\WINDOWS\system32\hkcmd.exe[/FONT]
    [FONT=&quot]C:\WINDOWS\system32\igfxsrvc.exe[/FONT]
    [FONT=&quot]C:\WINDOWS\system32\igfxpers.exe[/FONT]
    [FONT=&quot]C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe[/FONT]
    [FONT=&quot]C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe[/FONT]
    [FONT=&quot]C:\WINDOWS\System32\DLA\DLACTRLW.EXE[/FONT]
    [FONT=&quot]C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[/FONT]
    [FONT=&quot]C:\Program Files\Lenovo\AwayTask\AwaySch.EXE[/FONT]
    [FONT=&quot]C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.exe[/FONT]
    [FONT=&quot]C:\Program Files\ThinkVantage\AMSG\Amsg.exe[/FONT]
    [FONT=&quot]C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe[/FONT]
    [FONT=&quot]C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe[/FONT]
    [FONT=&quot]C:\Program Files\Lenovo\Client Security Solution\cssauth.exe[/FONT]
    [FONT=&quot]C:\WINDOWS\Philips\SPC230NC\Monitor.exe[/FONT]
    [FONT=&quot]C:\Program Files\iTunes\iTunesHelper.exe[/FONT]
    [FONT=&quot]C:\Program Files\Logitech\Z-5 Speakers\Z-5 Speakers.exe[/FONT]
    [FONT=&quot]C:\Program Files\AVAST Software\Avast\avastUI.exe[/FONT]
    [FONT=&quot]C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[/FONT]
    [FONT=&quot]C:\WINDOWS\system32\ctfmon.exe[/FONT]
    [FONT=&quot]C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe[/FONT]
    [FONT=&quot]C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe[/FONT]
    [FONT=&quot]C:\Program Files\Logitech\Z-5 Speakers\LU\LULnchr.exe[/FONT]
    [FONT=&quot]C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[/FONT]
    [FONT=&quot]C:\Program Files\Digital Line Detect\DLG.exe[/FONT]
    [FONT=&quot]C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe[/FONT]
    [FONT=&quot]C:\Program Files\iPod\bin\iPodService.exe[/FONT]
    [FONT=&quot]C:\Program Files\Philips\Philips SPC230NC Webcam\TrayMin230.exe[/FONT]
    [FONT=&quot]C:\Program Files\Logitech\Z-5 Speakers\LU\LogitechUpdate.exe[/FONT]
    [FONT=&quot]C:\Program Files\Real\RealPlayer\update\realsched.exe[/FONT]
    [FONT=&quot]C:\Program Files\Mozilla Firefox\firefox.exe[/FONT]
    [FONT=&quot]C:\Program Files\Mozilla Firefox\plugin-container.exe[/FONT]
    [FONT=&quot]C:\Program Files\Trend Micro\HijackThis\HijackThis.exe[/FONT]
    [FONT=&quot] [/FONT]
    [FONT=&quot]R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR[/FONT]
    [FONT=&quot]R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR[/FONT]
    [FONT=&quot]R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://lenovo.live.com[/FONT]
    [FONT=&quot]R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo.live.com[/FONT]
    [FONT=&quot]R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896[/FONT]
    [FONT=&quot]R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896[/FONT]
    [FONT=&quot]R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157[/FONT]
    [FONT=&quot]R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR[/FONT]
    [FONT=&quot]R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005[/FONT]
    [FONT=&quot]R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local[/FONT]
    [FONT=&quot]O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll[/FONT]
    [FONT=&quot]O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll[/FONT]
    [FONT=&quot]O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll[/FONT]
    [FONT=&quot]O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL[/FONT]
    [FONT=&quot]O2 - BHO: Ad-Aware Security Toolbar - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files\adawaretb\adawareDx.dll[/FONT]
    [FONT=&quot]O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll[/FONT]
    [FONT=&quot]O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll[/FONT]
    [FONT=&quot]O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll[/FONT]
    [FONT=&quot]O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll[/FONT]
    [FONT=&quot]O2 - BHO: ThinkVantage Password Manager - {F040E541-A427-4CF7-85D8-75E3E0F476C5} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll[/FONT]
    [FONT=&quot]O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll[/FONT]
    [FONT=&quot]O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll[/FONT]
    [FONT=&quot]O3 - Toolbar: Ad-Aware Security Toolbar - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files\adawaretb\adawareDx.dll[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [TPFNF7] C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe /r[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [TpShocks] TpShocks.exe[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [AwaySch] C:\Program Files\Lenovo\AwayTask\AwaySch.EXE[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.exe[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [AMSG] C:\Program Files\ThinkVantage\AMSG\Amsg.exe /startup[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [cssauth] "C:\Program Files\Lenovo\Client Security Solution\cssauth.exe" silent[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [SPC230NC_Monitor] C:\WINDOWS\Philips\SPC230NC\Monitor.exe[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [Z-5 Speakers] C:\Program Files\Logitech\Z-5 Speakers\Z-5 Speakers.exe[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Real\RealPlayer\update\realsched.exe" -osboot[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k[/FONT]
    [FONT=&quot]O4 - HKLM\..\Run: [Ad-Aware Browsing Protection] "C:\Documents and Settings\All Users\Application Data\Ad-Aware Browsing Protection\adawarebp.exe"[/FONT]
    [FONT=&quot]O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe[/FONT]
    [FONT=&quot]O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized[/FONT]
    [FONT=&quot]O4 - HKCU\..\Run: [ylxkrwhfv3] C:\Documents and Settings\LENOVO\ylxkrwhfv3.exe[/FONT]
    [FONT=&quot]O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe[/FONT]
    [FONT=&quot]O4 - HKUS\S-1-5-18\..\RunOnce: [adaware] reg.exe delete "HKCU\Software\AppDataLow\Software\adaware" /f (User 'SYSTEM')[/FONT]
    [FONT=&quot]O4 - HKUS\S-1-5-18\..\RunOnce: [adaware_XP] reg.exe delete "HKCU\Software\adaware" /f (User 'SYSTEM')[/FONT]
    [FONT=&quot]O4 - HKUS\.DEFAULT\..\RunOnce: [adaware] reg.exe delete "HKCU\Software\AppDataLow\Software\adaware" /f (User 'Default user')[/FONT]
    [FONT=&quot]O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe[/FONT]
    [FONT=&quot]O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe[/FONT]
    [FONT=&quot]O4 - Global Startup: Bluetooth.lnk = ?[/FONT]
    [FONT=&quot]O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe[/FONT]
    [FONT=&quot]O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe[/FONT]
    [FONT=&quot]O4 - Global Startup: TrayMin230.lnk = ?[/FONT]
    [FONT=&quot]O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm[/FONT]
    [FONT=&quot]O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200[/FONT]
    [FONT=&quot]O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000[/FONT]
    [FONT=&quot]O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm[/FONT]
    [FONT=&quot]O9 - Extra button: (no name) - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll[/FONT]
    [FONT=&quot]O9 - Extra 'Tools' menuitem: ThinkVantage Password Manager... - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll[/FONT]
    [FONT=&quot]O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll[/FONT]
    [FONT=&quot]O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll[/FONT]
    [FONT=&quot]O9 - Extra button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll[/FONT]
    [FONT=&quot]O9 - Extra 'Tools' menuitem: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll[/FONT]
    [FONT=&quot]O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL[/FONT]
    [FONT=&quot]O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll[/FONT]
    [FONT=&quot]O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll[/FONT]
    [FONT=&quot]O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe[/FONT]
    [FONT=&quot]O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe[/FONT]
    [FONT=&quot]O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll[/FONT]
    [FONT=&quot]O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll[/FONT]
    [FONT=&quot]O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing)[/FONT]
    [FONT=&quot]O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe[/FONT]
    [FONT=&quot]O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe[/FONT]
    [FONT=&quot]O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[/FONT]
    [FONT=&quot]O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe[/FONT]
    [FONT=&quot]O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe[/FONT]
    [FONT=&quot]O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe[/FONT]
    [FONT=&quot]O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe[/FONT]
    [FONT=&quot]O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[/FONT]
    [FONT=&quot]O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe[/FONT]
    [FONT=&quot]O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe[/FONT]
    [FONT=&quot]O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe[/FONT]
    [FONT=&quot]O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINDOWS\system32\ibmpmsvc.exe[/FONT]
    [FONT=&quot]O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe[/FONT]
    [FONT=&quot]O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe[/FONT]
    [FONT=&quot]O23 - Service: IPS Core Service (IPSSVC) - Lenovo Group Limited - C:\WINDOWS\system32\IPSSVC.EXE[/FONT]
    [FONT=&quot]O23 - Service: Lavasoft Ad-Aware Service - Lavasoft Limited - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe[/FONT]
    [FONT=&quot]O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[/FONT]
    [FONT=&quot]O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[/FONT]
    [FONT=&quot]O23 - Service: System Update (SUService) - - c:\program files\lenovo\system update\suservice.exe[/FONT]
    [FONT=&quot]O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe[/FONT]
    [FONT=&quot]O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.exe[/FONT]
    [FONT=&quot]O23 - Service: TSS Core Service (TSSCoreService) - IBM - C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe[/FONT]
    [FONT=&quot]O23 - Service: TVT Backup Protection Service - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe[/FONT]
    [FONT=&quot]O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe[/FONT]
    [FONT=&quot]O23 - Service: TVT Scheduler - Lenovo Group Limited - c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe[/FONT]
    [FONT=&quot]O23 - Service: tvtnetwk - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe[/FONT]
    [FONT=&quot] [/FONT]
    [FONT=&quot]--[/FONT]
    [FONT=&quot]End of file - 16201 bytes[/FONT]
    [FONT=&quot] [/FONT]
    [FONT=&quot]GMER LOG[/FONT]​
    [FONT=&quot] [/FONT]
    [FONT=&quot]GMER 1.0.15.15641 - http://www.gmer.net[/FONT]
    [FONT=&quot]Rootkit scan 2012-02-10 20:51:06[/FONT]
    [FONT=&quot]Windows 5.1.2600 Service Pack 2 [/FONT]
    [FONT=&quot]Running: wefbzg3v.exe; Driver: C:\DOCUME~1\LENOVO\LOCALS~1\Temp\ugddraod.sys[/FONT]
    [FONT=&quot] [/FONT]
    [FONT=&quot] [/FONT]
    [FONT=&quot]---- Files - GMER 1.0.15 ----[/FONT]
    [FONT=&quot] [/FONT]
    [FONT=&quot]File C:\RRbackups\C 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data0 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data1 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data10 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data100 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data101 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data102 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data103 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data104 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data105 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data106 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data107 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data108 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data109 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data11 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data110 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data111 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data112 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data113 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data114 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data115 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data270 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data271 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data272 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data273 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data274 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data275 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data276 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data277 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data278 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data279 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data28 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data280 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data281 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data282 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data283 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data284 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data285 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data286 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data287 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data288 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data47 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data48 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data49 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data5 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data50 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data51 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data52 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data53 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data54 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data55 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data56 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data57 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data58 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data59 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data6 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data60 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data61 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data62 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data63 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data64 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data66 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data67 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data68 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data69 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data7 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data70 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data71 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data72 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data73 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data74 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data75 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data76 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data77 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data78 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data79 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data8 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data80 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data81 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data82 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data83 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data84 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data85 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data86 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data87 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data88 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data89 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data9 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data90 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data91 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data92 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data93 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data94 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data95 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data96 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data97 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data98 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data99 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\EFSFile 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\HashFile 757434 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Info 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\TOCFile 77005790 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data117 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data118 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data119 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data12 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data120 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data121 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data122 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data123 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data124 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data125 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data126 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data127 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data128 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data129 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data13 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data130 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data131 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data132 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data133 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data134 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data136 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data137 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data138 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data139 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data14 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data140 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data141 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data142 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data143 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data144 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data145 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data146 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data147 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data148 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data149 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data15 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data150 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data151 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data152 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data153 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data155 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data156 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data157 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data158 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data159 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data16 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data160 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data161 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data162 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data163 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data164 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data165 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data166 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data167 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data168 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data169 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data17 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data170 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data171 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data172 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data116 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data135 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data154 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data173 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data192 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data210 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data23 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data249 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data27 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data289 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data307 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data326 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data345 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data46 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data65 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data174 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data175 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data176 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data177 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data178 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data179 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data18 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data180 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data181 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data182 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data183 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data184 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data185 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data186 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data187 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data188 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data189 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data19 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data190 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data191 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data193 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data194 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data195 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data196 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data197 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data198 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data199 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data2 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data20 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data200 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data201 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data202 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data203 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data204 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data205 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data206 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data207 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data208 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data209 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data21 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data211 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data212 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data213 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data214 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data215 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data216 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data217 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data218 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data219 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data22 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data220 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data221 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data222 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data223 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data224 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data225 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data226 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data227 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data228 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data229 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data230 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data231 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data232 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data233 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data234 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data235 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data236 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data237 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data238 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data239 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data24 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data240 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data241 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data242 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data243 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data244 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data245 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data246 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data247 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data248 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data25 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data250 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data251 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data252 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data253 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data254 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data255 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data256 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data257 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data258 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data259 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data26 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data260 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data261 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data262 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data263 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data264 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data265 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data266 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data267 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data268 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data269 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data29 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data290 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data291 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data292 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data293 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data294 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data295 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data296 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data297 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data298 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data299 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data3 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data30 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data300 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data301 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data302 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data303 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data304 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data305 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data306 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data308 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data309 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data31 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data310 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data311 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data312 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data313 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data314 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data315 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data316 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data317 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data318 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data319 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data32 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data320 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data321 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data322 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data323 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data324 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data325 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data327 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data328 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data329 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data33 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data330 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data331 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data332 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data333 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data334 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data335 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data336 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data337 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data338 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data339 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data34 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data340 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data341 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data342 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data343 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data344 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data346 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data347 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data348 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data349 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data35 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data350 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data351 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data352 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data353 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data354 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data355 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data356 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data357 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data358 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data359 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data36 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data37 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data38 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data39 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data4 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data40 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data41 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data42 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data43 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data44 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\C\0\Data45 50003968 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\common 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\common\backups.dat 8192 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\common\css.dat 8192 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\common\hints.dat 8192 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\common\mnd.dat 8192 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\common\regcerts.dat 8192 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\common\restore.log 110 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\common\rr.log 74048 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\common\SAM 262144 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\common\secpolicy.dat 53248 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\common\settings.dat 28672 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\common\system.dat 12288 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\common\tvtcmn.dat 8192 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\common\tvtns.bin 15 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\common\usersids.dat 15600 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Administrator 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Administrator\Application Data 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Administrator\Application Data\Lenovo 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Administrator\Application Data\Lenovo\Client Security Solution 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Crypto 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Crypto\RSA 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Protect 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Protect\CREDHIST 24 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Protect\S-1-5-21-1404323078-3538738752-523830773-500 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Protect\S-1-5-21-1404323078-3538738752-523830773-500\0ee18e5e-9e37-430c-9070-b0125f160406 388 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Protect\S-1-5-21-1404323078-3538738752-523830773-500\Preferred 24 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\SystemCertificates 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\SystemCertificates\My 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\All Users 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\All Users\Application Data 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\fc1e3851f429ea606d6ff1e01a5229f1_c1c472d7-7f87-4c5a-a35e-5b1ad33ec60b 52 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\42e7e898003fbdeb9585806ee1664b51_c1c472d7-7f87-4c5a-a35e-5b1ad33ec60b 57 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\8f71098770f72c7a67cd8f1151619865_c1c472d7-7f87-4c5a-a35e-5b1ad33ec60b 54 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\b973ec0ff915c48a18fe09064ce3a22d_c1c472d7-7f87-4c5a-a35e-5b1ad33ec60b 56 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\d42cc0c3858a58db2db37658219e6400_c1c472d7-7f87-4c5a-a35e-5b1ad33ec60b 893 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Default User 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Default User\Application Data 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Default User\Application Data\Lenovo 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Default User\Application Data\Lenovo\Client Security Solution 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Crypto 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Crypto\RSA 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\CREDHIST 24 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-1404323078-3538738752-523830773-500 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-1404323078-3538738752-523830773-500\0ee18e5e-9e37-430c-9070-b0125f160406 388 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-1404323078-3538738752-523830773-500\Preferred 24 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data\Lenovo 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data\Lenovo\Client Security Solution 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data\Lenovo\Client Security Solution\hibernation.dat 4 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data\Microsoft 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data\Microsoft\Crypto 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data\Microsoft\Crypto\RSA 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data\Microsoft\Crypto\RSA\S-1-5-21-2441623939-2341895870-809940527-1005 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data\Microsoft\Crypto\RSA\S-1-5-21-2441623939-2341895870-809940527-1005\5c05a24649dce38756a5072a69bfe1ba_c1c472d7-7f87-4c5a-a35e-5b1ad33ec60b 47 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data\Microsoft\Crypto\RSA\S-1-5-21-2441623939-2341895870-809940527-1005\8f71098770f72c7a67cd8f1151619865_c1c472d7-7f87-4c5a-a35e-5b1ad33ec60b 54 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data\Microsoft\Protect 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data\Microsoft\Protect\CREDHIST 24 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data\Microsoft\Protect\S-1-5-21-1404323078-3538738752-523830773-500 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data\Microsoft\Protect\S-1-5-21-1404323078-3538738752-523830773-500\0ee18e5e-9e37-430c-9070-b0125f160406 388 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data\Microsoft\Protect\S-1-5-21-1404323078-3538738752-523830773-500\Preferred 24 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data\Microsoft\Protect\S-1-5-21-2441623939-2341895870-809940527-1005 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data\Microsoft\Protect\S-1-5-21-2441623939-2341895870-809940527-1005\51630ac1-3727-4548-a8d2-af27f0420474 388 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data\Microsoft\Protect\S-1-5-21-2441623939-2341895870-809940527-1005\73aa2e98-95a7-414c-9df0-b6e5cd9bc43b 388 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data\Microsoft\Protect\S-1-5-21-2441623939-2341895870-809940527-1005\86b342e7-c8f5-4ddd-bb37-b2fad7eec517 388 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data\Microsoft\Protect\S-1-5-21-2441623939-2341895870-809940527-1005\956a30cd-70c7-436e-8866-1f30bfbff98f 388 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data\Microsoft\Protect\S-1-5-21-2441623939-2341895870-809940527-1005\Preferred 24 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data\Microsoft\SystemCertificates 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data\Microsoft\SystemCertificates\My 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LENOVO\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LocalService 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LocalService\Application Data 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LocalService\Application Data\Microsoft 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\NetworkService 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\NetworkService\Application Data 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes[/FONT]
    [FONT=&quot]File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes[/FONT]
    [FONT=&quot]File C:\WINDOWS\$NtUninstallKB30827$\3584934593 0 bytes[/FONT]
    [FONT=&quot]File C:\WINDOWS\$NtUninstallKB30827$\831605242 0 bytes[/FONT]
    [FONT=&quot]File C:\WINDOWS\$NtUninstallKB30827$\831605242\@ 2048 bytes[/FONT]
    [FONT=&quot]File C:\WINDOWS\$NtUninstallKB30827$\831605242\bckfg.tmp 840 bytes[/FONT]
    [FONT=&quot]File C:\WINDOWS\$NtUninstallKB30827$\831605242\cfg.ini 184 bytes[/FONT]
    [FONT=&quot]File C:\WINDOWS\$NtUninstallKB30827$\831605242\Desktop.ini 4608 bytes[/FONT]
    [FONT=&quot]File C:\WINDOWS\$NtUninstallKB30827$\831605242\keywords 139 bytes[/FONT]
    [FONT=&quot]File C:\WINDOWS\$NtUninstallKB30827$\831605242\kwrd.dll 223744 bytes[/FONT]
    [FONT=&quot]File C:\WINDOWS\$NtUninstallKB30827$\831605242\L 0 bytes[/FONT]
    [FONT=&quot]File C:\WINDOWS\$NtUninstallKB30827$\831605242\L\hvmonmrs 162816 bytes[/FONT]
    [FONT=&quot]File C:\WINDOWS\$NtUninstallKB30827$\831605242\U 0 bytes[/FONT]
    [FONT=&quot]File C:\WINDOWS\$NtUninstallKB30827$\831605242\U\00000001.@ 2048 bytes[/FONT]
    [FONT=&quot]File C:\WINDOWS\$NtUninstallKB30827$\831605242\U\00000002.@ 224768 bytes[/FONT]
    [FONT=&quot]File C:\WINDOWS\$NtUninstallKB30827$\831605242\U\00000004.@ 1024 bytes[/FONT]
    [FONT=&quot]File C:\WINDOWS\$NtUninstallKB30827$\831605242\U\80000000.@ 1024 bytes[/FONT]
    [FONT=&quot]File C:\WINDOWS\$NtUninstallKB30827$\831605242\U\80000004.@ 12800 bytes[/FONT]
    [FONT=&quot]File C:\WINDOWS\$NtUninstallKB30827$\831605242\U\80000032.@ 97792 bytes[/FONT]
    [FONT=&quot] [/FONT]
    [FONT=&quot]---- EOF - GMER 1.0.15 ----[/FONT]
     
As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/1040518