Win Police Pro aftermath - "My Documents" inaccessible

View previous topic View next topic Go down

Win Police Pro aftermath - "My Documents" inaccessible

Post by jwise1 on Sat Jan 23, 2010 11:45 am

Greetings All,

Thanks in advance for all your efforts, I hope you can help... I was a victim of the hateful Windows Police Pro, but I believe I was able to kill it myself (probably somewhat heavy handed) I kept deleting the active process from windows task manager and was eventually able to delete some or all of the files and the "Windows Police Pro" folder from my program files folder. I also purchased a new hard drive and did a clean Win XP Pro install on it. (It was time to expand anyway) I thought I could just copy my documents onto the new drive and have a fresh start. Unfortunately, immediately after that, "My Documents" (from the original drive only) started producing a "C:\Documents and settings\Jeff Wise is not accessible Access is Denied" message with an "OK" radio button on it. I've tried changing the folder attributes to no avail... The properties list it as 0 bytes, 0 files, 0 folders but I hope that's not the case.... Its really frustrating (as I'm sure you know) as most of the docs are replaceable except for last year's tax records which I need to do this year's taxes on Turbotax.

Per your website, I updated Java and attempted to do a Hijack log but it does not produce legible radio buttons or results, just a screen full of characters. I am grateful for any suggestions you can offer. THANKS Jeff

jwise1
Novice
Novice

Status :
Online
Offline

Posts : 14
Joined : 2010-01-23
OS : XP Pro

View user profile

Back to top Go down

Re: Win Police Pro aftermath - "My Documents" inaccessible

Post by Dr Jay on Sat Jan 23, 2010 4:19 pm

Please visit this webpage for instructions for downloading and running ComboFix:

[You must be registered and logged in to see this link.]

Post the log from ComboFix when you've accomplished that.


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Status :
Online
Offline

Posts : 13712
Joined : 2009-09-06
Gender : Male
OS : Windows 10 Home & Pro

View user profile

Back to top Go down

Re: Win Police Pro aftermath - "My Documents" inaccessible

Post by jwise1 on Mon Jan 25, 2010 6:31 pm

Thanks for the advice Dragon Master,, just a confirmation question or two..
I was able to access and register for bleeping computer and did a search for combofix as it was not apparent on the link you sent... I found some responses that said Combofix was pulled as it also deleted legitimate files and they posted a program that would restore some of them... I am quite willing to try it as I have little to lose at this point, but could you point me to a site where it could be obtained, AND are you still of the opinion that combofix is the best option? Bear in mind that I have a new installation of win XP on a new drive and that the "my documents I am trying to recover is still on the original C: drive.

I was able to run the Malwarebytes program from the geek police site and generate a log which I will send if you can advise me where to send. How to attach was not apparent in this reply form... I was still unable to access "my documents" after it ran however.

Thanks for your help... Jeff

jwise1
Novice
Novice

Status :
Online
Offline

Posts : 14
Joined : 2010-01-23
OS : XP Pro

View user profile

Back to top Go down

Re: Win Police Pro aftermath - "My Documents" inaccessible

Post by Dr Jay on Mon Jan 25, 2010 7:04 pm

The download links are on this page: [You must be registered and logged in to see this link.]

The bug was fixed in ComboFix.


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Status :
Online
Offline

Posts : 13712
Joined : 2009-09-06
Gender : Male
OS : Windows 10 Home & Pro

View user profile

Back to top Go down

Re: Win Police Pro aftermath - "My Documents" inaccessible

Post by jwise1 on Thu Jan 28, 2010 7:57 am

Thanks for your help and patience... I was finally able to work on my problem tonight.. The Combofix log is as follows. I still wasn't able to open the "my documents" on the original C; drive, (which is no longer the boot drive.. anyway here goes....

ComboFix 10-01-27.03 - Jeff 01/28/2010 2:43.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3262.2840 [GMT -5:00]
Running from: l:\documents and settings\Jeff\Desktop\ComboFix.exe
AV: ZoneAlarm Antivirus *On-access scanning disabled* (Updated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

l:\program files\driver
l:\windows\system32\drivers\etc\lmhosts

.
((((((((((((((((((((((((( Files Created from 2009-12-28 to 2010-01-28 )))))))))))))))))))))))))))))))
.

2010-01-27 12:58 . 2006-12-07 15:45 110592 ----a-w- l:\documents and settings\Jeff\Application Data\U3\temp\cleanup.exe
2010-01-23 11:52 . 2010-01-23 11:52 -------- d-----w- l:\documents and settings\Jeff\Application Data\Malwarebytes
2010-01-23 11:52 . 2010-01-07 21:07 38224 ----a-w- l:\windows\system32\drivers\mbamswissarmy.sys
2010-01-23 11:52 . 2010-01-23 11:52 -------- d-----w- l:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-23 11:52 . 2010-01-23 11:52 -------- d-----w- l:\program files\Malwarebytes' Anti-Malware
2010-01-23 11:52 . 2010-01-07 21:07 19160 ----a-w- l:\windows\system32\drivers\mbam.sys
2010-01-23 11:07 . 2010-01-23 11:07 -------- d-----w- l:\program files\Sun
2010-01-13 20:42 . 2006-12-07 15:45 3096576 ---ha-w- l:\documents and settings\Jeff\Application Data\U3\temp\Launchpad Removal.exe
2010-01-13 20:41 . 2010-01-27 12:58 -------- d-----w- l:\documents and settings\Jeff\Application Data\U3
2010-01-13 20:18 . 2009-11-21 15:51 471552 -c----w- l:\windows\system32\dllcache\aclayers.dll
2010-01-03 17:38 . 2001-08-18 03:36 5632 ----a-w- l:\windows\system32\ptpusb.dll
2010-01-03 17:38 . 2008-04-14 00:12 159232 ----a-w- l:\windows\system32\ptpusd.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-28 06:50 . 2009-11-01 21:03 -------- d-----w- l:\documents and settings\Jeff\Application Data\Apple Computer
2010-01-28 06:43 . 2009-10-28 07:19 4212 ---ha-w- l:\windows\system32\zllictbl.dat
2010-01-28 06:28 . 2009-10-28 07:19 144 ----a-w- l:\windows\system32\pdfl.dat
2010-01-28 06:28 . 2010-01-28 06:28 -------- d-----w- l:\documents and settings\All Users\Application Data\Office Genuine Advantage
2010-01-23 11:09 . 2009-10-28 06:47 -------- d-----w- l:\program files\Common Files\Adobe
2010-01-23 11:07 . 2009-11-01 20:25 411368 ----a-w- l:\windows\system32\deploytk.dll
2010-01-23 11:03 . 2009-11-01 20:25 -------- d-----w- l:\program files\Java
2010-01-19 05:26 . 2009-10-28 07:05 -------- d-----w- l:\documents and settings\All Users\Application Data\iolo
2010-01-08 01:20 . 2009-10-28 07:10 93096 ----a-w- l:\windows\system32\IncContxMenu.dll
2010-01-08 01:20 . 2009-10-28 07:10 2169256 ----a-w- l:\windows\system32\Incinerator.dll
2010-01-03 19:15 . 2009-10-28 07:12 1521 ----a-w- l:\documents and settings\Jeff\Application Data\iolo\restore.bat
2010-01-03 18:06 . 2009-11-01 20:26 -------- d-----w- l:\documents and settings\Jeff\Application Data\LimeWire
2009-12-26 15:41 . 2009-11-01 21:00 -------- d-----w- l:\documents and settings\All Users\Application Data\Apple
2009-12-24 18:40 . 2009-12-24 18:40 796010 ----a-w- l:\windows\Internet Logs\tvDebug.Zip
2009-12-21 19:14 . 2004-08-04 12:00 916480 ----a-w- l:\windows\system32\wininet.dll
2009-11-21 15:51 . 2004-08-04 12:00 471552 ----a-w- l:\windows\AppPatch\aclayers.dll
2009-11-06 00:58 . 2009-11-06 00:58 64368 ----a-w- l:\documents and settings\Guest\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-04 02:53 . 2009-11-04 02:53 152576 ----a-w- l:\documents and settings\Jeff\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-01 21:05 . 2009-11-01 21:05 64368 ----a-w- l:\documents and settings\Jeff\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-31 06:02 . 2009-10-31 06:02 1961720 ----a-w- l:\documents and settings\Jeff\Application Data\Macromedia\Flash Player\[You must be registered and logged in to see this link.]
2009-10-31 03:26 . 2009-10-31 03:26 499712 ----a-w- l:\windows\system32\msvcp71.dll
2009-10-31 03:26 . 2009-10-31 03:26 348160 ----a-w- l:\windows\system32\msvcr71.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sunkist2k"="l:\program files\Multimedia Card Reader\shwicon2k.exe" [2005-10-27 139264]
"NvCplDaemon"="l:\windows\system32\NvCpl.dll" [2006-04-01 7561216]
"nwiz"="nwiz.exe" [2006-04-01 1519616]
"SoundMan"="SOUNDMAN.EXE" [2006-08-03 577536]
"PaperPort PTD"="l:\progra~1\scansoft\paperp~1\pptd40nt.exe" [2000-04-27 29184]
"TkBellExe"="l:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-10-31 198160]
"iTunesHelper"="l:\program files\iTunes\iTunesHelper.exe" [2009-10-29 141600]
"Adobe Reader Speed Launcher"="l:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="l:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"l:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"l:\\Program Files\\iTunes\\iTunes.exe"=
"l:\\Program Files\\LimeWire\\LimeWire.exe"=

R1 BIOS;BIOS;l:\windows\system32\drivers\BIOS.sys [10/27/2009 11:23 PM 13696]
R1 BS_I2cIo;BS_I2cIo;l:\windows\system32\drivers\BS_I2cIo.sys [11/1/2009 1:29 PM 17024]
R2 ioloFileInfoList;iolo FileInfoList Service;l:\program files\iolo\Common\Lib\ioloServiceManager.exe [10/28/2009 2:10 AM 650672]
R2 ioloSystemService;iolo System Service;l:\program files\iolo\Common\Lib\ioloServiceManager.exe [10/28/2009 2:10 AM 650672]
R2 ISWKL;ZoneAlarm ForceField ISWKL;l:\program files\CheckPoint\ZAForceField\ISWKL.sys [10/14/2009 8:30 AM 25208]
R2 IswSvc;ZoneAlarm ForceField IswSvc;l:\program files\CheckPoint\ZAForceField\ISWSVC.exe [10/14/2009 8:30 AM 476528]
R2 ppsio2;PPDevice;l:\windows\system32\drivers\ppsio2.sys [10/27/2009 11:40 PM 23200]
R3 icsak;icsak;l:\program files\CheckPoint\ZAForceField\AK\icsak.sys [10/14/2009 8:29 AM 35448]
S3 BS_Flash;BS_Flash;l:\program files\BIOS Update\BIOS Update\Award\BS_Flash.sys [10/28/2009 1:48 AM 3604]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-01-28 l:\windows\Tasks\User_Feed_Synchronization-{064ED225-2203-4638-9FC2-6C8A0E6C330A}.job
- l:\windows\system32\msfeedssync.exe [2009-03-08 08:31]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - l:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.
.
------- File Associations -------
.
JSEFile=NOTEPAD.EXE %1
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2010-01-28 02:49
Windows 5.1.2600 Service Pack 3 NTFS

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(700)
l:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
l:\program files\CheckPoint\ZAForceField\AK\icsak.dll

- - - - - - - > 'lsass.exe'(756)
l:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
l:\program files\CheckPoint\ZAForceField\AK\icsak.dll

- - - - - - - > 'csrss.exe'(676)
l:\program files\CheckPoint\ZAForceField\AK\akconsole.dll
.
Completion time: 2010-01-28 02:50:42
ComboFix-quarantined-files.txt 2010-01-28 07:50

Pre-Run: 289,452,199,936 bytes free
Post-Run: 289,543,503,872 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
l:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 23BA7F008F2DD1F3038348719DBBC2DA

jwise1
Novice
Novice

Status :
Online
Offline

Posts : 14
Joined : 2010-01-23
OS : XP Pro

View user profile

Back to top Go down

Re: Win Police Pro aftermath - "My Documents" inaccessible

Post by jwise1 on Thu Jan 28, 2010 8:00 am

Also... sorry if this redundant.... I was able to run the malwarebytes program before I got the combofix advice and I have the log for that also if it would help. Thanks, Jeff

jwise1
Novice
Novice

Status :
Online
Offline

Posts : 14
Joined : 2010-01-23
OS : XP Pro

View user profile

Back to top Go down

Re: Win Police Pro aftermath - "My Documents" inaccessible

Post by Dr Jay on Thu Jan 28, 2010 4:39 pm

Hi again. Please do these steps in order.

1. Please download [You must be registered and logged in to see this link.] to your desktop
  • Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • It will close all programs when run, so make sure you have saved all your work before you begin.
  • Click the Start
    button to begin the process. Depending on how often you clean temp
    files, execution time should be anywhere from a few seconds to a minute
    or two. Let it run uninterrupted to completion.
  • Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.


2. Please download Malwarebytes Anti-Malware from [You must be registered and logged in to see this link.].
Alternate link: [You must be registered and logged in to see this link.].
(Note: if you already have the program installed, just follow the directions. No need to re-download or re-install!)

Double Click mbam-setup.exe to install the application.

(Note: if you already have the program installed, open Malwarebytes from the Start Menu or Desktop shortcut, click the Update tab, and click Check for Updates, before doing the scan as instructed below!)

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Full Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • Please save the log to a location you will remember.
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

3. Please visit this webpage for instructions for downloading and running SUPERAntiSpyware (SAS) to scan and remove malware from your computer:

[You must be registered and logged in to see this link.]

Post the log from SUPERAntiSpyware when you've accomplished that.

4. Please run a free online scan with the [You must be registered and logged in to see this link.]
  • Tick the box next to YES, I accept the Terms of Use
  • Click Start
  • When asked, allow the ActiveX control to install
  • Click Start
  • Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  • Click Scan (This scan can take several hours, so please be patient)
  • Once the scan is completed, you may close the window
  • Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log as a reply to this topic


5. Post the following in your next reply:
  • MBAM log
  • SAS log
  • ESET log

And, please tell me how your computer is doing.


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Status :
Online
Offline

Posts : 13712
Joined : 2009-09-06
Gender : Male
OS : Windows 10 Home & Pro

View user profile

Back to top Go down

Re: Win Police Pro aftermath - "My Documents" inaccessible

Post by jwise1 on Fri Jan 29, 2010 3:37 am

Holy Spyware Dragonmaster!! This machine was CRAWLING with bugs!!
But its now cleaner than a senior citizen prepped for colonoscopy. And it appears to be running smoothly, but it already was due to the clean win xp pro install on a new hard drive. Unfortunately, I am still unable to access the "My documents" folder on the original "c:" drive. (this is no longer the one associated with this windows install but it contains a bundle of irreplaceable documents like my tax files from last year, etc. Is there any hope of recovery? I was considering sending it in to "ontrack" or similar service, but the drive is working fine, the "my documents" folder is just "locked" somehow. The properties for that folder specifies 0 files, 0 folders, and 0 megabytes, but SOMETHING is taking up a lot of space on the drive. (its an 80 GB WD sata) I Guarantee I did not delete them by accident myself. I was just going to copy the folder into the new install and discovered then that it was "inaccessible."
Anyway, Please see the following three logs as you requested, run and presented in the order you requested, MBAM log, SAS log, and ESET log.... All ran smoothly without complication. What next?

Malwarebytes' Anti-Malware 1.44
Database version: 3654
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1/28/2010 7:53:55 PM
mbam-log-2010-01-28 (19-53-55).txt

Scan type: Full Scan (C:\|H:\|L:\|)
Objects scanned: 265056
Time elapsed: 52 minute(s), 42 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
L:\System Volume Information\_restore{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP47\A0014875.sys (Malware.Trace) -> Quarantined and deleted successfully.
L:\System Volume Information\_restore{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP47\A0014912.com (Trojan.Agent) -> Quarantined and deleted successfully.
L:\System Volume Information\_restore{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP47\A0014977.sys (Malware.Trace) -> Quarantined and deleted successfully.
L:\System Volume Information\_restore{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP47\A0015001.com (Trojan.Agent) -> Quarantined and deleted successfully.





SUPERAntiSpyware Scan Log
[You must be registered and logged in to see this link.]

Generated 01/28/2010 at 09:00 PM

Application Version : 4.33.1000

Core Rules Database Version : 4531
Trace Rules Database Version: 2343

Scan type : Complete Scan
Total Scan Time : 00:35:34

Memory items scanned : 432
Memory threats detected : 0
Registry items scanned : 4602
Registry threats detected : 0
File items scanned : 37222
File threats detected : 251

Adware.Tracking Cookie
L:\Documents and Settings\Jeff\Cookies\jeff@serving-sys[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@beacon.dmsinsights[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@content.yieldmanager[1].txt
L:\Documents and Settings\Jeff\Cookies\jeff@advertising[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@fuckherthroat[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@adultrevenueservice[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@burstnet[1].txt
L:\Documents and Settings\Jeff\Cookies\jeff@pointroll[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@revsci[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@doubleclick[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@ads.pointroll[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@adrevolver[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@[You must be registered and logged in to see this link.]
L:\Documents and Settings\Jeff\Cookies\jeff@ad.yieldmanager[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@click.yottacash[1].txt
L:\Documents and Settings\Jeff\Cookies\jeff@catfights.pornbomb[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@invitemedia[1].txt
L:\Documents and Settings\Jeff\Cookies\jeff@socialmedia[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@mediapromoter[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@[You must be registered and logged in to see this link.]
L:\Documents and Settings\Jeff\Cookies\jeff@microsoftwindows.112.2o7[1].txt
L:\Documents and Settings\Jeff\Cookies\jeff@richmedia.yahoo[1].txt
L:\Documents and Settings\Jeff\Cookies\jeff@videoegg.adbureau[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@interclick[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@ads.sun[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@bs.serving-sys[1].txt
L:\Documents and Settings\Jeff\Cookies\jeff@media.adrevolver[1].txt
L:\Documents and Settings\Jeff\Cookies\jeff@naiadsystems[1].txt
L:\Documents and Settings\Jeff\Cookies\jeff@[You must be registered and logged in to see this link.]
L:\Documents and Settings\Jeff\Cookies\jeff@msnportal.112.2o7[1].txt
L:\Documents and Settings\Jeff\Cookies\jeff@realmedia[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@ad.wsod[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@ads.bridgetrack[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@casalemedia[1].txt
L:\Documents and Settings\Jeff\Cookies\jeff@ehg-eset.hitbox[1].txt
L:\Documents and Settings\Jeff\Cookies\jeff@adbrite[1].txt
L:\Documents and Settings\Jeff\Cookies\jeff@stopzilla[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@apmebf[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@2o7[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@buzznet.112.2o7[1].txt
L:\Documents and Settings\Jeff\Cookies\jeff@zedo[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@click.quoom[1].txt
L:\Documents and Settings\Jeff\Cookies\jeff@questionmarket[1].txt
L:\Documents and Settings\Jeff\Cookies\jeff@media6degrees[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@hentaicounter[1].txt
L:\Documents and Settings\Jeff\Cookies\jeff@specificclick[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@mediaplex[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@[You must be registered and logged in to see this link.]
L:\Documents and Settings\Jeff\Cookies\jeff@collective-media[1].txt
L:\Documents and Settings\Jeff\Cookies\jeff@microsoftoffice.112.2o7[1].txt
L:\Documents and Settings\Jeff\Cookies\jeff@trafficmp[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@fuckedfaces[1].txt
L:\Documents and Settings\Jeff\Cookies\jeff@[You must be registered and logged in to see this link.]
L:\Documents and Settings\Jeff\Cookies\jeff@hitbox[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@imrworldwide[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@tribalfusion[1].txt
L:\Documents and Settings\Jeff\Cookies\jeff@statcounter[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@[You must be registered and logged in to see this link.]
L:\Documents and Settings\Jeff\Cookies\jeff@fastclick[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@counter16.sextracker[1].txt
L:\Documents and Settings\Jeff\Cookies\jeff@atdmt[1].txt
L:\Documents and Settings\Jeff\Cookies\jeff@click.mediadome[1].txt
L:\Documents and Settings\Jeff\Cookies\jeff@sextracker[1].txt
L:\Documents and Settings\Jeff\Cookies\jeff@insightexpressai[2].txt
L:\Documents and Settings\Jeff\Cookies\jeff@sexlist[1].txt
C:\Documents and Settings\Jeff Wise\Cookies\jeff_wise@invitemedia[2].txt
C:\Documents and Settings\Jeff Wise\Cookies\jeff_wise@adserver.adtechus[1].txt
C:\Documents and Settings\Jeff Wise\Cookies\jeff_wise@login.tracking101[2].txt
C:\Documents and Settings\Jeff Wise\Cookies\jeff_wise@stats.ilsemedia[1].txt
C:\Documents and Settings\Jeff Wise\Cookies\jeff_wise@xml.trafficengine[2].txt
C:\Documents and Settings\Jeff Wise\Cookies\jeff_wise@ad.zanox[1].txt
C:\Documents and Settings\Jeff Wise\Cookies\jeff_wise@insightexpressai[2].txt
C:\Documents and Settings\Jeff Wise\Cookies\jeff_wise@advertising[2].txt
C:\Documents and Settings\Jeff Wise\Cookies\jeff_wise@content.yieldmanager[2].txt
C:\Documents and Settings\Jeff Wise\Cookies\jeff_wise@content.yieldmanager[3].txt
C:\Documents and Settings\Jeff Wise\Cookies\jeff_wise@stopsearchclick[2].txt
C:\Documents and Settings\Jeff Wise\Cookies\jeff_wise@ads.right-ads[2].txt
C:\Documents and Settings\Jeff Wise\Cookies\jeff_wise@mediatraffic[2].txt
C:\Documents and Settings\Jeff Wise\Cookies\jeff_wise@linksynergy[2].txt
C:\Documents and Settings\Jeff Wise\Cookies\jeff_wise@doubleclick[2].txt
C:\Documents and Settings\Jeff Wise\Cookies\jeff_wise@media6degrees[1].txt
C:\Documents and Settings\Jeff Wise\Cookies\jeff_wise@ad.yieldmanager[2].txt
L:\Documents and Settings\Guest\Cookies\guest@ad.yieldmanager[1].txt
L:\Documents and Settings\Guest\Cookies\guest@doubleclick[1].txt
L:\Documents and Settings\Guest\Cookies\guest@videoegg.adbureau[2].txt
L:\Documents and Settings\Guest\Cookies\guest@atdmt[2].txt
L:\Documents and Settings\Guest\Cookies\guest@msnportal.112.2o7[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@ads.revsci[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@ads.cnn[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@statcounter[2].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@overture[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@adrevolver[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@fastclick[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@ads.pointroll[2].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@mediaplex[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@ads.adbrite[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@[You must be registered and logged in to see this link.]
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@[You must be registered and logged in to see this link.]
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@insightexpressai[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@ads.adbrite[2].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@[You must be registered and logged in to see this link.]
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@hitbox[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@imrworldwide[2].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@[You must be registered and logged in to see this link.]
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@click.dpbill[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@advertising[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@[You must be registered and logged in to see this link.]
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@toplist[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@media.adrevolver[2].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@ads.ookla[2].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@xxxpower[2].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@casalemedia[2].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@adultrental[2].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@[You must be registered and logged in to see this link.]
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@statse.webtrendslive[2].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@cnn.122.2o7[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@atdmt[2].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@ehg-tigerdirect2.hitbox[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@x-tremsex[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@ehg-ati.hitbox[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@[You must be registered and logged in to see this link.]
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@[You must be registered and logged in to see this link.]
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@adbrite[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@stats1.reliablestats[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@try.starware[2].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@revsci[2].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@zedo[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@adultfriendfinder[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@click.richfetish[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@image.masterstats[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@ad.yieldmanager[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@ehg-wssuk.hitbox[2].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@doubleclick[2].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@[You must be registered and logged in to see this link.]
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@ad4.bannerbank[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@click.zoopartners[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@[You must be registered and logged in to see this link.]
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@ehg-speakeasy.hitbox[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@questionmarket[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@dhdmedia[2].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@fucking-old[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@h.starware[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@server.iad.liveperson[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@server.iad.liveperson[3].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@atwola[1].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@2o7[2].txt
L:\WD130GB\Documents and Settings\Jeff Wise\Cookies\jeff_wise@3.adbrite[3].txt

Adware.Vundo/Variant-GTC
C:\SYSTEM VOLUME INFORMATION\_RESTORE{0ADB220E-C72A-47AD-BB80-3EA86860FF70}\RP440\A0083683.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{0ADB220E-C72A-47AD-BB80-3EA86860FF70}\RP441\A0083706.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{0ADB220E-C72A-47AD-BB80-3EA86860FF70}\RP442\A0083729.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{0ADB220E-C72A-47AD-BB80-3EA86860FF70}\RP443\A0083752.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{0ADB220E-C72A-47AD-BB80-3EA86860FF70}\RP444\A0083775.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{0ADB220E-C72A-47AD-BB80-3EA86860FF70}\RP445\A0083798.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{0ADB220E-C72A-47AD-BB80-3EA86860FF70}\RP445\A0084853.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008086.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008144.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008166.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008172.DLL

Adware.Vundo/Variant-CLD
C:\SYSTEM VOLUME INFORMATION\_RESTORE{0ADB220E-C72A-47AD-BB80-3EA86860FF70}\RP447\A0086853.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{0ADB220E-C72A-47AD-BB80-3EA86860FF70}\RP447\A0086891.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008117.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008137.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008175.DLL

Adware.Vundo/Variant
C:\SYSTEM VOLUME INFORMATION\_RESTORE{0ADB220E-C72A-47AD-BB80-3EA86860FF70}\RP469\A0104151.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008074.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008076.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008077.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008078.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008079.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008080.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008081.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008083.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008087.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008088.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008090.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008091.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008094.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008095.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008096.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008099.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008100.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008102.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008105.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008106.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008108.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008110.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008113.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008115.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008116.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008121.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008122.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008123.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008124.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008125.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008126.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008127.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008130.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008134.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008135.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008141.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008142.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008143.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008145.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008146.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008147.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008149.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008153.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008155.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008157.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008158.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008159.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008162.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008163.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008164.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008165.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008168.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008170.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008177.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008178.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008179.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008180.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008181.DLL
C:\WINDOWS\SYSTEM32\FEZELETE.DLL
C:\WINDOWS\SYSTEM32\TODIVAFI.DLL

Adware.Vundo/Variant-Mini
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008082.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008104.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008139.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008140.DLL

Adware.Vundo/Variant-[Fixed]
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008093.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008098.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008118.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP23\A0008120.DLL

Trojan.Agent/Gen-Nullo[Short]
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP46\A0014666.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP46\A0014667.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP46\A0014668.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP46\A0014669.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP46\A0014670.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP46\A0014671.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP46\A0014672.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP46\A0014673.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP46\A0014674.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP46\A0014675.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP46\A0014676.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP46\A0014677.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP46\A0014678.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B12F0F2-F563-4A87-AA46-0906296DB7EF}\RP46\A0014679.DLL

Adware.Vundo/Variant-EC
C:\WINDOWS\SYSTEM32\BOTAPOVU.DLL

Adware.Vundo/Variant-81k
C:\WINDOWS\SYSTEM32\HITOKETE.DLL
C:\WINDOWS\SYSTEM32\MAGENEYE.DLL
C:\WINDOWS\SYSTEM32\MEMEZOJA.DLL

Adware.Vundo Variant
C:\WINDOWS\SYSTEM32\YIGEJIYU.DLL





ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=e57f5a2e2472d04788659db36371ee7f
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-01-29 03:12:11
# local_time=2010-01-28 10:12:11 (-0500, Eastern Standard Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# compatibility_mode=9217 16776869 100 77 2755769 8052967 0 0
# scanned=126823
# found=72
# cleaned=72
# scan_time=3100
C:\Program Files\LimeWire\Jay sean ft lil wayne - down.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan (cleaned - quarantined) 00000000000000000000000000000000 C
C:\Program Files\LimeWire\Mercedes ft. Master P - Crazy About You(1).wma WMA/TrojanDownloader.Wimad.NAG trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Program Files\LimeWire\reflections rocket to moon 2009.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan (cleaned - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\aboyaluh.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\afanaban.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\ahunomis.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\alanokeh.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\asabujoj.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\asatofol.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\asomagil.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\atimitot.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\avobegol.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\awewilew.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\azarosom.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\azipilum.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\edekobak.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\edenohib.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\edomitud.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\edunoniy.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\ehitovud.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\ejajijov.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\ekitenuj.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\esavikay.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\ewufalav.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\ibiwovaw.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\idiyiriy.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\idoduhop.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\ifokogen.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\ihujejen.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\ijeruvim.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\ikuhakat.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\ikuvivuf.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\imekipek.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\imifunum.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\ipotewet.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\irutayis.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\isalamad.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\iserosas.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\isinuzof.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\ivutariz.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\iwegozed.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\iyefitov.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\iyuzoper.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\obabavar.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\ofadozej.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\ofasayiy.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\ojegihoh.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\ojesolov.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\ojopimot.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\okiziyib.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\omeninuw.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\omiherod.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\opeposeg.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\opopenot.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\osoyodeb.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\ovanavos.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\oveyuteh.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\owemavod.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\owozurop.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\ubagewed.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\ubezovam.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\udihideb.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\uhikatiz.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\ujeyunij.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\ukajebor.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\ulukotep.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\umimiyop.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\umolamuj.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\unodoziy.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\uvegozef.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\uvokituh.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\uwedokos.ini Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

jwise1
Novice
Novice

Status :
Online
Offline

Posts : 14
Joined : 2010-01-23
OS : XP Pro

View user profile

Back to top Go down

Re: Win Police Pro aftermath - "My Documents" inaccessible

Post by Dr Jay on Fri Jan 29, 2010 3:56 am

Please download [You must be registered and logged in to see this link.], and save to your Desktop.
  • Double-click on Cheetah-Anti-Rogue.zip, and extract the file to your Desktop.
  • Double-click on Cheetah-Anti-Rogue.cmd to start.
  • It will finish quickly and launch a log.
  • Post the contents of it in your next reply.


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Status :
Online
Offline

Posts : 13712
Joined : 2009-09-06
Gender : Male
OS : Windows 10 Home & Pro

View user profile

Back to top Go down

Re: Win Police Pro aftermath - "My Documents" inaccessible

Post by jwise1 on Fri Jan 29, 2010 2:11 pm

As you wish fearless leader.... Please see the Cheetah anti-rogue log as follows..... Continued gratitude for your efforts. When we're finished; where should I donate? You're the author of some of the software AND the one putting in the time; but we've visited/utilized other worthy contributors as well...... open to suggestion. Regards and respect


Cheetah-Anti-Rogue v1.2.10
by DragonMaster Jay

Microsoft Windows XP [Version 5.1.2600]
Date: 01/29/2010 - Time: 9:06:38 - Arch.: x86


-- Malware tools check --
Malwarebytes' Anti-Malware
SUPERAntiSpyware


-- Known infection --



Extra message: Detection only.


EOF

jwise1
Novice
Novice

Status :
Online
Offline

Posts : 14
Joined : 2010-01-23
OS : XP Pro

View user profile

Back to top Go down

Re: Win Police Pro aftermath - "My Documents" inaccessible

Post by Dr Jay on Fri Jan 29, 2010 3:23 pm

Please re-open Malwarebytes, click the Update tab, and click Check for Updates. Then, click the Scanner tab, select Perform Quick Scan, and press Scan. Remove selected, and post the log in your next reply.

I have a page that I will link you to, a little bit later. Right On!


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Status :
Online
Offline

Posts : 13712
Joined : 2009-09-06
Gender : Male
OS : Windows 10 Home & Pro

View user profile

Back to top Go down

Re: Win Police Pro aftermath - "My Documents" inaccessible

Post by jwise1 on Sat Jan 30, 2010 8:58 am

per your request...... thanks

Malwarebytes' Anti-Malware 1.44
Database version: 3661
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1/30/2010 3:58:08 AM
mbam-log-2010-01-30 (03-58-08).txt

Scan type: Quick Scan
Objects scanned: 120180
Time elapsed: 7 minute(s), 49 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

jwise1
Novice
Novice

Status :
Online
Offline

Posts : 14
Joined : 2010-01-23
OS : XP Pro

View user profile

Back to top Go down

Re: Win Police Pro aftermath - "My Documents" inaccessible

Post by Dr Jay on Sat Jan 30, 2010 3:42 pm

Now to get you off to a good start we will clean your restore points so that all the bad stuff is gone for good. Then if you need to restore at some stage you will be clean. There are several ways to reset your restore points, but this is my method:
  • Select Start > All Programs > Accessories > System tools > System Restore.
  • On the dialogue box that appears select Create a Restore Point
  • Click NEXT
  • Enter a name e.g. Clean
  • Click CREATE

You now have a clean restore point, to get rid of the bad ones:
  • Select Start > All Programs > Accessories > System tools > Disk Cleanup.
  • In the Drop down box that appears select your main drive e.g. C
  • Click OK
  • The System will do some calculation and the display a dialogue box with TABS
  • Select the More Options Tab.
  • At the bottom will be a system restore box with a CLEANUP button click this
  • Accept the Warning and select OK again, the program will close and you are done


To remove all of the tools we used and the files and folders they created, please do the following:
Please download [You must be registered and logged in to see this link.] by OldTimer:

  • Save it to your Desktop.
  • Double click OTC.exe.
  • Click the CleanUp! button.
  • If you are prompted to Reboot during the cleanup, select Yes.
  • The tool will delete itself once it finishes.

Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

==

Please download [You must be registered and logged in to see this link.] to your desktop
  • Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • It will close all programs when run, so make sure you have saved all your work before you begin.
  • Click the Start
    button to begin the process. Depending on how often you clean temp
    files, execution time should be anywhere from a few seconds to a minute
    or two. Let it run uninterrupted to completion.
  • Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.


==

Download Security Check by screen317 from [You must be registered and logged in to see this link.] or [You must be registered and logged in to see this link.].
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Status :
Online
Offline

Posts : 13712
Joined : 2009-09-06
Gender : Male
OS : Windows 10 Home & Pro

View user profile

Back to top Go down

Re: Win Police Pro aftermath - "My Documents" inaccessible

Post by jwise1 on Sun Jan 31, 2010 6:38 pm

Greetings Fearless Leader,

I too am confident that my PC is now as clean as the proverbial whistle.. Thanks! Now, please forgive the following anxiety-motivated reminder/ question..... Bear in mind that my ORIGINAL query and REASON for my pleas for help was that "my documents" from a past win XP pro installation on my current C: drive (which is no longer the boot drive) had become inaccessible. (I'm sure you help a lot of others, so please forgive my being careful here...) IS IT POSSIBLE THAT THE DISK CLEANUP YOU ARE RECCOMMENDING WILL WIPE OR DAMAGE THE CONTENTS OF THE "MY DOCUMENTS" FOLDER I AM TRYING TO RESCUE? The properties of that folder indicate that it has 0 mb of space, 0 folders, and 0 files, when in reality it should contain many gigabytes of files. OR will it confine itself to the fresh win xp installation on the current boot (L:) drive? Sorry to waste your time, but just needing a shred of reassurance before proceeding.

Yopur obedient but fearful student.... ;-}

jwise1
Novice
Novice

Status :
Online
Offline

Posts : 14
Joined : 2010-01-23
OS : XP Pro

View user profile

Back to top Go down

Re: Win Police Pro aftermath - "My Documents" inaccessible

Post by jwise1 on Sun Jan 31, 2010 6:59 pm

Please Scratch my latest anxiety ridden request for reassurance... I read more acrefully and see that you specified the main drive, so I am proceeding as you instructed... I should be able to yield the checkup.txt file before long...

jwise1
Novice
Novice

Status :
Online
Offline

Posts : 14
Joined : 2010-01-23
OS : XP Pro

View user profile

Back to top Go down

Re: Win Police Pro aftermath - "My Documents" inaccessible

Post by jwise1 on Sun Jan 31, 2010 7:31 pm

OK Chief, here goes.... I see that I have a clean bill of health... Just a side note.... I have been using zonealarm for the last couple of years and it will be expiring soon. I have found zonealarm a bit intrusive and also been able to resolve ther occaisional problem by disabling or uninstalling and re-installing zonealarm....... I have purchased a 3-license version of Norton Internet Security 2010. I've already installed it on my wife's healthy computer and we like it so far... I intend to be using that on this machine in the near future Any thought or comments are welcome, or more importantly, any reason I should NOT install it until after we are done here?

Anyway, Checkup.txt is as follows .. THANKS, as ever...

Results of screen317's Security Check version 0.99.1
Windows XP Service Pack 3
``````````````````````````````
Antivirus/Firewall Check:

Windows Firewall Disabled!
ESET Online Scanner v3
ZoneAlarm Extreme Security
iolo technologies' System Mechanic
Antivirus up to date!
``````````````````````````````
Anti-malware/Other Utilities Check:

SUPERAntiSpyware Free Edition
Java DB 10.5.3.0
Java(TM) 6 Update 18
Java(TM) SE Development Kit 6 Update 18
Out of date Java installed!
Adobe Flash Player 10
Adobe Reader 9.3
``````````````````````````````
Process Check:
objlist.exe by Laurent

Zone Labs ZoneAlarm zlclient.exe
iolo common lib ioloServiceManager.exe
``````````````````````````````
DNS Vulnerability Check:

GREAT! (Not vulnerable to DNS cache poisoning)

`````````End of Log```````````

jwise1
Novice
Novice

Status :
Online
Offline

Posts : 14
Joined : 2010-01-23
OS : XP Pro

View user profile

Back to top Go down

Re: Win Police Pro aftermath - "My Documents" inaccessible

Post by jwise1 on Sun Jan 31, 2010 7:40 pm

I just double-checked via Sunmicrosystems site..... Java version 6, update 18 is currently installed and functiuoning properly on my machine.... I checked after I saw the red "out of date JAVA installed on the checkup.txt log....

jwise1
Novice
Novice

Status :
Online
Offline

Posts : 14
Joined : 2010-01-23
OS : XP Pro

View user profile

Back to top Go down

Re: Win Police Pro aftermath - "My Documents" inaccessible

Post by Dr Jay on Sun Jan 31, 2010 8:54 pm

No biggie. Old version of Security Check. Goofy

Please read the following information that I have provided, which will help you prevent malicious software in the future. Please keep in mind, malware is a continuous danger on the Internet. It is highly important to stay safe while browsing, to prevent re-infection.

Software recommendations

AntiSpyware

  • [You must be registered and logged in to see this link.]
    SpywareBlaster is a program that prevents spyware from installing on your computer. A tutorial on using SpywareBlaster may be found [You must be registered and logged in to see this link.].
  • [You must be registered and logged in to see this link.].
    Spybot - Search & Destroy is a spyware and adware removal program. It also has realtime protection, TeaTimer to help safeguard your computer against spyware. (The link for Spybot - Search & Destroy contains a tutorial that will help you download, install, and begin using Spybot).


NOTE: Please keep ALL of these programs up-to-date and run them whenever you suspect a problem to prevent malware problems.

Resident Protection help
A number of programs have resident protection and it is a good idea to run the resident protection of one of each type of program to maintain protection. However, it is important to run only one resident program of each type since they can conflict and become less effective. That means only one antivirus, firewall, and scanning anti-spyware program at a time. Passive protectors such as SpywareBlaster can be run with any of them.

Rogue programs help
There are a lot of rogue programs out there that want to scare you into giving them your money and some malware actually claims to be security programs. If you get a popup for a security program that you did not install yourself, do NOT click on it and ask for help immediately. It is very important to run an antivirus and firewall, but you can't always rely on reviews and ads for information. Ask in a security forum that you trust if you are not sure. If you are unsure and looking for anti-spyware programs, you can find out if it is a rogue here:
[You must be registered and logged in to see this link.]

Securing your computer

  • [You must be registered and logged in to see this link.] - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.
  • [You must be registered and logged in to see this link.] replaces your current HOSTS file with one containing well known ad sites and other bad sites. This prevents your computer from connecting to those sites by redirecting them to 127.0.0.1, which is your local computer's loopback address, meaning it will be difficult to infect your computer in the future.


Please consider using an alternate browser
Mozilla's Firefox browser is a very good alternative. In addition to being generally more secure than Internet Explorer, it has a very good built-in popup blocker and add-ons, like NoScript, can make it even more secure. Opera is another good option.

If you are interested:


Thank you for choosing GeekPolice. Please see [You must be registered and logged in to see this link.] if you would like to leave feedback or contribute to our site. Do you have any more questions?


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Status :
Online
Offline

Posts : 13712
Joined : 2009-09-06
Gender : Male
OS : Windows 10 Home & Pro

View user profile

Back to top Go down

Re: Win Police Pro aftermath - "My Documents" inaccessible

Post by jwise1 on Sun Jan 31, 2010 11:21 pm

My friend,..... PLEASE READ THIS CAREFULLY

You have given me a great deal of your time and advice, for which I am extremely grateful... I understand that you cannot possibly read thoroughlly all the questions/requests that you receive from MANY distraught people such as myself...

However, you have not once referred to, or suggested a solution for my original questions and the PRIMARY cause of my distress..... As stated in the TITLE line of this topic; "MY DOCUMENTS" on my former boot drive is inaccessible. I have re-iterated this concern in my replies of the 23rd, 25th, 2x on the 28th, and again this very date..... (6x total if you count the title of my original request)

Can you offer any suggestions for the inaccessible my documents folder?? Do you believe that they are irretrievable, or can you possibly suggest a method, program, person, or service that would have any chance or recovering them?

PLEASE do not misunderstand, I AM GRATEFUL FOR YOUR HELP, but please respond to my original question and tell me if I'm S.O.L. or if there's any possible means of recovering my documents. My computer is very clean and healthy thanks to you, but please don't tell me we've been wasting days eradicating Malware and totally ignoring my original plea for help...

THANK YOU FOR YOUR EFFORTS, but please answer the questions asked or tell me the bad news and be done with it...

jwise1
Novice
Novice

Status :
Online
Offline

Posts : 14
Joined : 2010-01-23
OS : XP Pro

View user profile

Back to top Go down

Re: Win Police Pro aftermath - "My Documents" inaccessible

Post by Dr Jay on Mon Feb 01, 2010 5:01 am

"MY DOCUMENTS" on my former boot drive is inaccessible

I suspected this to be a trojan, launching the alerts.

More/less I was actually confused, because each time you said you could not access the My Documents folder, you attached something else to that line, and it was hard to tell if that folder was located on a different drive, or if the install that needed malware removed was the issue at hand about the folder.

Please navigate to this webpage: [You must be registered and logged in to see this link.] and see the section "Fix it for me" and click the Microsoft Fix-It button. This will download a fix utility to repair the security settings on your computer, due to damages of malware or other harmful system changes. Install the file after download.

==

Then, let me know if you can access it.


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Status :
Online
Offline

Posts : 13712
Joined : 2009-09-06
Gender : Male
OS : Windows 10 Home & Pro

View user profile

Back to top Go down

Re: Win Police Pro aftermath - "My Documents" inaccessible

Post by jwise1 on Mon Feb 01, 2010 1:16 pm

Okay, Thanks for listening... allow me to re-iterate in a less-confusing fashion, what I have stated before and what was evident on the numerous logs you requested. I have three drives on my home built pc. The boot drive (L:) is a 320 GB WD EIDE drive, there is also a 160 GB WD EIDE (H:)
and the original (former) boot drive is an 80 GB WD SATA drive.

After I succesfully killed Police Pro by deleting its active processes in task manger and deleting its files and folders from my "Program Files" folder I thought all was well... I still had the original my documents folder and was not even aware that I could not access it. It was time to expand this machine, so I got the new WD320 EIDE drive, made it my boot drive, and did a fresh windows XP pro install on it, thinking I was being extra safe. I had tranferred a lot of my other files etc. to the other drives, but when I tried to do so with "my documents" I got the inaccessible prompt and panic set in (of course the damn police pro struck between backups).

Would it help to disconnect the other drives and try to make the target drive the current windows install? I just checked and I hadn't deleted the Windows folder, etc. yet

I have run the Microsoft fixit and my docs is still inaccessble....

THANKS FOR YOUR PERSEVERANCE!

jwise1
Novice
Novice

Status :
Online
Offline

Posts : 14
Joined : 2010-01-23
OS : XP Pro

View user profile

Back to top Go down

Re: Win Police Pro aftermath - "My Documents" inaccessible

Post by jwise1 on Mon Feb 01, 2010 2:12 pm

HALLELUJAH!!! I/WE DID IT!!!! Hooray! It was a result of a windows security feature...when I re-installed windows on the new drive it locked the old my documents folder and gave the **** inaccessible, access denied prompt. This links explains it better as well as how to remedy it.. [You must be registered and logged in to see this link.]

Thank You!

THANK YOU MY FRIEND, I WOULD NEVER HAVE THOUGHT OF GOING TO MICROSOFT FOR HELP, but after their fixit did NOT cure the problem I did a search for the inaccessible, access denied prompt and it took me satraight to the link above. AND IT WORKED!!!! YIPPEEE!! THANKS FOR YOUR PATIENCE AND PERSEVERANCE AND APOLOGIES FOR MY IMPATIENCE (clearly, I was getting desperate) Cheesy Grin (sparkly

GEEK POLICE RULE!!! .... Your humble and contrite student/servant

jwise1
Novice
Novice

Status :
Online
Offline

Posts : 14
Joined : 2010-01-23
OS : XP Pro

View user profile

Back to top Go down

Re: Win Police Pro aftermath - "My Documents" inaccessible

Post by Dr Jay on Mon Feb 01, 2010 2:47 pm

ok


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Status :
Online
Offline

Posts : 13712
Joined : 2009-09-06
Gender : Male
OS : Windows 10 Home & Pro

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum