help, virus

• relgn

  17 Sep 07, 20:23

  Logfile of HijackThis v1.99.1
  Scan saved at 8:18:18 PM, on 9/17/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\McAfee.com\Agent\mcagent.exe
  c:\program files\mcafee.com\shared\mghtml.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\WINDOWS\eHome\ehRecvr.exe
  C:\WINDOWS\eHome\ehSched.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  c:\program files\mcafee.com\agent\mcdetect.exe
  c:\PROGRA~1\mcafee.com\vso\mcshield.exe
  c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
  c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
  C:\WINDOWS\system32\mqsvc.exe
  c:\program files\mcafee.com\vso\mcvsshld.exe
  C:\PROGRA~1\mcafee.com\vso\mcvsescn.exe
  C:\WINDOWS\system32\mqtgsvc.exe
  C:\WINDOWS\system32\dllhost.exe
  c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  c:\progra~1\mcafee.com\vso\mcvsftsn.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Documents and Settings\Eileen Tan\My Documents\nus\HijackThis.exe
  
  O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
  O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\McAfee.com\Agent\McAgent.exe
  O4 - HKLM\..\Run: [McRegWiz] c:\PROGRA~1\mcafee.com\agent\mcregwiz.exe /autorun
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
  O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
  O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
  O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
  
  
• ndmmxiaomayi

  17 Sep 07, 21:39

  That's your full log?
• relgn

  18 Sep 07, 00:21

  not mine, but my gf com's log. it's full lei.
• ndmmxiaomayi

  18 Sep 07, 00:29

  It's very short.
  
  

  [*]Please go to C:\Documents and Settings\Eileen Tan\My Documents\nus and right click on HijackThis.exe. Select Rename.
  [*]Type in scanner and press Enter.
  [*]Double click on scanner to run it.
  [*]Select Do a system scan and save a logfile. Please post back this log in your next reply.

  
  
• relgn

  19 Sep 07, 22:29

  Logfile of HijackThis v1.99.1
  Scan saved at 10:24:59 PM, on 9/19/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\WINDOWS\eHome\ehRecvr.exe
  C:\WINDOWS\eHome\ehSched.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  c:\program files\mcafee.com\agent\mcdetect.exe
  c:\PROGRA~1\mcafee.com\vso\mcshield.exe
  c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
  c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
  C:\WINDOWS\system32\mqsvc.exe
  c:\program files\mcafee.com\vso\mcvsshld.exe
  C:\PROGRA~1\mcafee.com\vso\mcvsescn.exe
  c:\program files\mcafee.com\agent\mcagent.exe
  c:\progra~1\mcafee.com\vso\mcvsftsn.exe
  C:\WINDOWS\system32\mqtgsvc.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\WINDOWS\system32\dllhost.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\eHome\ehmsas.exe
  C:\WINDOWS\ehome\EHTray.exe
  C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
  C:\WINDOWS\msagent\AgentSvr.exe
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
  C:\Documents and Settings\Eileen Tan\My Documents\nus\scanner.exe
  
  O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
  O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
  O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
  O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
  O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
  
  hmmm, it still so short lei. Can u figure out something from this? thanks
• ndmmxiaomayi

  19 Sep 07, 23:17

  Yeah... it's very short.
  
  Step 1
  
  

  [*]Open HijackThis.
  [*]Click on Open the Misc Tools section.
  [*]Look under System tools.
  [*]Click on the Open Uninstall Manager... button.
  [*]Click on the Save list... button.
  [*]It will prompt you to save. Save this log in a convenient location. By default it's named uninstall_list.txt.
  [*]Notepad will open. Please copy and paste the contents of this log in your next reply.

  
  
  Step 2
  
  Please download gmer.zip from Gmer and save it to your desktop.
  
  

  [*]Right click on gmer.zip and select Extract All....
  [*]Click Next on seeing the Welcome to the Compressed (zipped) Folders Extraction Wizard.
  [*]Click on the Browse button. Click on Desktop. Then click OK.
  [*]Click Next. It will start extracting.
  [*]Once done, check (tick) the Show extracted files box.
  [*]Double click on gmer.exe to run it.
  [*]Select the Rootkit tab.
  [*]On the right hand side, check all the items to be scanned, but leave Show All box unchecked.
  [*]Select all drives that are connected to your system to be scanned.
  [*]Click on the Scan button.
  [*]When the scan is finished, click Copy to save the scan log to the Windows clipboard.
  [*]Open Notepad or a similar text editor.
  [*]Paste the clipboard contents into the text editor.
  [*]Save the Gmer scan log and post it in your next reply.
  [*]Close Gmer.
  [*]Open Command Prompt by going to Start > Run and type in cmd. Press Enter.
  [*]In Command Prompt, type in net stop gmer. Press Enter.
  [*]Type in exit to close Command Prompt.

  Note: Do not run any programs while Gmer is running.
  
  Post back the Uninstall list as well as the Gmer log.
• relgn

  20 Sep 07, 15:03

  Uninstall log
  7 Wonders of the Ancient World
  Adobe Bridge 1.0
  Adobe Common File Installer
  Adobe Help Center 1.0
  Adobe Photoshop CS2
  Adobe Reader 7.0.9
  Adobe Stock Photos 1.0
  Allok RM RMVB to AVI MPEG DVD Converter 2.0.0524
  Apple Mobile Device Support
  Apple Software Update
  Bejeweled 2 Deluxe
  BeTrapped!
  Bookworm Deluxe
  Bricks of Atlantis
  Bricks of Egypt
  Cake Mania
  Chicken Rush
  Chuzzle
  Coloriage
  Compatibility Pack for the 2007 Office system
  Conexant HD Audio
  Customer Experience Enhancement
  DivX
  Easy Internet Sign-up
  ESPNMotion
  Form Fill (Windows Live Toolbar)
  Gem Shop
  GemMaster Mystic
  Google Toolbar for Internet Explorer
  HDAUDIO Soft Data Fax Modem with SmartCP
  Hexic
  HijackThis 1.99.1
  Hotfix for Windows Media Format 11 SDK (KB929399)
  Hotfix for Windows Media Player 11 (KB939683)
  Hotfix for Windows XP (KB896256)
  Hotfix for Windows XP (KB909095)
  Hotfix for Windows XP (KB91072
  Hotfix for Windows XP (KB912436)
  Hotfix for Windows XP (KB918005)
  Hotfix for Windows XP (KB926239)
  HP DVD Play 2.3
  HP Help and Support
  HP Imaging Device Functions 6.0
  HP Photosmart Premier Software 6.0
  HP Quick Launch Buttons 6.10 A2
  HP Update
  HP User Guides 0027
  HP Wireless Assistant 2.00 G2
  iLike
  Insaniquarium Deluxe
  Intel(R) Graphics Media Accelerator Driver
  Intel(R) PRO Network Connections Drivers
  iTunes
  J2SE Runtime Environment 5.0 Update 6
  Java(TM) 6 Update 2
  Jewel of Atlantis
  Jewel Quest
  Jigsaw 365
  Lexmark Printer Software Uninstall
  Macromedia Flash Player 8
  Macromedia Flash Player 8
  Macromedia Shockwave Player
  Magic Ball 2
  Magic Match
  Mahjong Match
  Map Button (Windows Live Toolbar)
  McAfee SecurityCenter
  McAfee VirusScan
  MediaCoder 0.6.0
  Megaupload Toolbar
  Microsoft .NET Framework 1.0 Hotfix (KB88799
  Microsoft .NET Framework 1.0 Hotfix (KB930494)
  Microsoft .NET Framework 1.1
  Microsoft .NET Framework 1.1
  Microsoft .NET Framework 1.1 Hotfix (KB928366)
  Microsoft Compression Client Pack 1.0 for Windows XP
  Microsoft Money
  Microsoft Office XP Professional with FrontPage
  Microsoft User-Mode Driver Framework Feature Pack 1.0
  Microsoft Works
  Mosiac - Tomb of Mystery
  Mozaki Blocks
  Mozilla Firefox (2.0.0.6)
  MSN
  MSXML 4.0 SP2 (KB925672)
  MSXML 4.0 SP2 (KB92797
  MSXML 4.0 SP2 (KB936181)
  muvee autoProducer 5.0
  Mystery Case Files - Huntsville
  NetWaiting
  Ocean Express
  OneCare Advisor (Windows Live Toolbar)
  Otto
  Pat Sajak?ˉs Lucky Letters
  Poker Superstars 2
  Popup Blocker (Windows Live Toolbar)
  PPLive 1.5.43
  PrintKey2000
  QuickTime
  Rainbow Web
  Ricochet Lost Worlds
  RM MP3 Converter 1.10
  Security Update for CAPICOM (KB931906)
  Security Update for CAPICOM (KB931906)
  Security Update for Step By Step Interactive Training (KB89845
  Security Update for Step By Step Interactive Training (KB923723)
  Security Update for Windows Media Player (KB911564)
  Security Update for Windows Media Player 10 (KB911565)
  Security Update for Windows Media Player 10 (KB917734)
  Security Update for Windows Media Player 11 (KB936782)
  Security Update for Windows Media Player 6.4 (KB92539
  Security Update for Windows XP (KB893066)
  Security Update for Windows XP (KB893756)
  Security Update for Windows XP (KB89635
  Security Update for Windows XP (KB896422)
  Security Update for Windows XP (KB896423)
  Security Update for Windows XP (KB896424)
  Security Update for Windows XP (KB89642
  Security Update for Windows XP (KB899587)
  Security Update for Windows XP (KB899591)
  Security Update for Windows XP (KB900725)
  Security Update for Windows XP (KB901017)
  Security Update for Windows XP (KB901190)
  Security Update for Windows XP (KB901214)
  Security Update for Windows XP (KB902400)
  Security Update for Windows XP (KB903235)
  Security Update for Windows XP (KB904706)
  Security Update for Windows XP (KB905414)
  Security Update for Windows XP (KB905749)
  Security Update for Windows XP (KB908519)
  Security Update for Windows XP (KB911562)
  Security Update for Windows XP (KB911927)
  Security Update for Windows XP (KB912919)
  Security Update for Windows XP (KB913446)
  Security Update for Windows XP (KB913580)
  Security Update for Windows XP (KB91438
  Security Update for Windows XP (KB914389)
  Security Update for Windows XP (KB917344)
  Security Update for Windows XP (KB917422)
  Security Update for Windows XP (KB917953)
  Security Update for Windows XP (KB91811
  Security Update for Windows XP (KB918439)
  Security Update for Windows XP (KB919007)
  Security Update for Windows XP (KB920213)
  Security Update for Windows XP (KB920670)
  Security Update for Windows XP (KB920683)
  Security Update for Windows XP (KB920685)
  Security Update for Windows XP (KB92139
  Security Update for Windows XP (KB921503)
  Security Update for Windows XP (KB922616)
  Security Update for Windows XP (KB922819)
  Security Update for Windows XP (KB923191)
  Security Update for Windows XP (KB923414)
  Security Update for Windows XP (KB923689)
  Security Update for Windows XP (KB923694)
  Security Update for Windows XP (KB923980)
  Security Update for Windows XP (KB924191)
  Security Update for Windows XP (KB924270)
  Security Update for Windows XP (KB924496)
  Security Update for Windows XP (KB924667)
  Security Update for Windows XP (KB925454)
  Security Update for Windows XP (KB925902)
  Security Update for Windows XP (KB926255)
  Security Update for Windows XP (KB926436)
  Security Update for Windows XP (KB927779)
  Security Update for Windows XP (KB927802)
  Security Update for Windows XP (KB928090)
  Security Update for Windows XP (KB928255)
  Security Update for Windows XP (KB928843)
  Security Update for Windows XP (KB929123)
  Security Update for Windows XP (KB929969)
  Security Update for Windows XP (KB93017
  Security Update for Windows XP (KB931261)
  Security Update for Windows XP (KB93176
  Security Update for Windows XP (KB931784)
  Security Update for Windows XP (KB93216
  Security Update for Windows XP (KB933566)
  Security Update for Windows XP (KB935839)
  Security Update for Windows XP (KB935840)
  Security Update for Windows XP (KB936021)
  Security Update for Windows XP (KB937143)
  Security Update for Windows XP (KB938127)
  Security Update for Windows XP (KB938829)
  Slingo
  Smart Menus (Windows Live Toolbar)
  Sonic Audio Module
  Sonic Copy Module
  Sonic Data Module
  Sonic Express Labeler
  Sonic MyDVD Plus
  Sonic Update Manager
  SonicAC3Encoder
  SonicMPEGEncoder
  Symantec KB-DocID:2003093015493306
  Synaptics Pointing Device Driver
  Tabbed Browsing (Windows Live Toolbar)
  TeamSpeak 2 RC2
  Tiks Texas Hold em
  Update for Windows Media Player 10 (KB910393)
  Update for Windows Media Player 10 (KB913800)
  Update for Windows Media Player 10 (KB926251)
  Update for Windows XP (KB896727)
  Update for Windows XP (KB898461)
  Update for Windows XP (KB900485)
  Update for Windows XP (KB908531)
  Update for Windows XP (KB910437)
  Update for Windows XP (KB911164)
  Update for Windows XP (KB911280)
  Update for Windows XP (KB916595)
  Update for Windows XP (KB920872)
  Update for Windows XP (KB922582)
  Update for Windows XP (KB927891)
  Update for Windows XP (KB92933
  Update for Windows XP (KB930916)
  Update for Windows XP (KB931836)
  Update for Windows XP (KB933360)
  Update for Windows XP (KB936357)
  Update for Windows XP (KB93882
  Veoh Player
  VideoLAN VLC media player 0.8.6b
  Windows Installer 3.1 (KB893803)
  Windows Live Favorites for Windows Live Toolbar
  Windows Live Messenger
  Windows Live Outlook Toolbar (Windows Live Toolbar)
  Windows Live Sign-in Assistant
  Windows Live Toolbar
  Windows Live Toolbar
  Windows Live Toolbar Extension (Windows Live Toolbar)
  Windows Live Toolbar Feed Detector (Windows Live Toolbar)
  Windows Media Connect
  Windows Media Format 11 runtime
  Windows Media Format 11 runtime
  Windows Media Player 11
  Windows Media Player 11
  Windows XP Hotfix - KB873339
  Windows XP Hotfix - KB885250
  Windows XP Hotfix - KB885835
  Windows XP Hotfix - KB885836
  Windows XP Hotfix - KB885855
  Windows XP Hotfix - KB885884
  Windows XP Hotfix - KB886185
  Windows XP Hotfix - KB887472
  Windows XP Hotfix - KB888113
  Windows XP Hotfix - KB888239
  Windows XP Hotfix - KB888302
  Windows XP Hotfix - KB890546
  Windows XP Hotfix - KB890859
  Windows XP Hotfix - KB891220
  Windows XP Hotfix - KB891781
  Windows XP Hotfix - KB892559
  Windows XP Media Center Edition 2005 KB925766
  WinRAR archiver
  Wonderland - Secret Worlds
  Yahoo! Photos Easy Upload Tool
  Yahoo! Photos Print-at-Home Tool
  Yahoo! Toolbar for Internet Explorer
  Zuma Deluxe
  
• relgn

  20 Sep 07, 15:33

  GMER 1.0.13.12551 - http://www.gmer.net
  Rootkit scan 2007-09-20 14:59:00
  Windows 5.1.2600 Service Pack 2
  
  ---- User code sections - GMER 1.0.13 ----
  
  .text C:\WINDOWS\Explorer.EXE[220] WS2_32.dll!connect 71AB406A 5 Bytes JMP 10003E00 C:\PROGRA~1\mcafee.com\vso\McVSSkt.dll
  .text C:\WINDOWS\system32\ctfmon.exe[492] WS2_32.dll!connect 71AB406A 5 Bytes JMP 10003E00 C:\PROGRA~1\mcafee.com\vso\McVSSkt.dll
  .text c:\program files\mcafee.com\vso\mcvsshld.exe[796] WS2_32.dll!connect 71AB406A 5 Bytes JMP 014C3E00 C:\PROGRA~1\mcafee.com\vso\McVSSkt.dll
  .text C:\WINDOWS\eHome\ehmsas.exe[1124] WS2_32.dll!connect 06A 5 Bytes JMP 10003E00 C:\PROGRA~1\mcafee.com\vso\McVSSkt.dll
  .text c:\PROGRA~1\mcafee.com\vso\OasClnt.exe[1592] WS2_32.dll!connect 71AB406A 5 Bytes JMP 00DD3E00 C:\PROGRA~1\mcafee.com\vso\McVSSkt.dll
  .text ...
  
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE [F81D41DE] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_NAMED_PIPE [F81D41DE] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_READ [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL [F81D4454] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_INTERNAL_DEVICE_CONTROL [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_MAILSLOT [F81D41DE] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_POWER [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SYSTEM_CONTROL [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CHANGE [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_NAMED_PIPE [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_READ [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_INTERNAL_DEVICE_CONTROL [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_MAILSLOT [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_POWER [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SYSTEM_CONTROL [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CHANGE [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA [970AF930] naiavf5x.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE_NAMED_PIPE [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CLOSE [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_READ [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_WRITE [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_INFORMATION [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_INFORMATION [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_EA [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_EA [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_FLUSH_BUFFERS [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_VOLUME_INFORMATION [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_VOLUME_INFORMATION [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_DIRECTORY_CONTROL [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_FILE_SYSTEM_CONTROL [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_DEVICE_CONTROL [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_INTERNAL_DEVICE_CONTROL [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SHUTDOWN [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_LOCK_CONTROL [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CLEANUP [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE_MAILSLOT [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_SECURITY [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_SECURITY [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_POWER [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SYSTEM_CONTROL [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_DEVICE_CHANGE [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_QUOTA [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_QUOTA [F6E9BA30] SynTP.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE [F8A1BA4A] eabfiltr.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CLOSE [F8A1BA4A] eabfiltr.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_READ [F8A1BC82] eabfiltr.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_DEVICE_CONTROL [F8A1BCE8] eabfiltr.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_POWER [F8A1B660] eabfiltr.sys
  AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SYSTEM_CONTROL [F8A1B78E] eabfiltr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CREATE [F81D41DE] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CREATE_NAMED_PIPE [F81D41DE] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CLOSE [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_READ [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_WRITE [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_INFORMATION [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_INFORMATION [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_EA [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_EA [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_FLUSH_BUFFERS [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_VOLUME_INFORMATION [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_VOLUME_INFORMATION [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_DIRECTORY_CONTROL [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_FILE_SYSTEM_CONTROL [F81D4454] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CONTROL [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_INTERNAL_DEVICE_CONTROL [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SHUTDOWN [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_LOCK_CONTROL [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CLEANUP [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CREATE_MAILSLOT [F81D41DE] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_SECURITY [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_SECURITY [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_POWER [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SYSTEM_CONTROL [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CHANGE [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_QUOTA [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_QUOTA [F81C7F4C] fltMgr.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CREATE [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CREATE_NAMED_PIPE [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CLOSE [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_READ [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_WRITE [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_INFORMATION [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_INFORMATION [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_EA [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_EA [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_FLUSH_BUFFERS [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_VOLUME_INFORMATION [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_VOLUME_INFORMATION [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_DIRECTORY_CONTROL [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_FILE_SYSTEM_CONTROL [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CONTROL [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_INTERNAL_DEVICE_CONTROL [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SHUTDOWN [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_LOCK_CONTROL [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CLEANUP [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CREATE_MAILSLOT [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_SECURITY [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_SECURITY [970AF930] naiavf5x.sys
  AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CHANGE [970AF930] naiavf5x.sys
  
  ---- Files - GMER 1.0.13 ----
  
  ADS C:\Documents and Settings\Eileen Tan\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{28C361E9-DA6D-72C9-1B98-54FF8914032C}\01\20-{28C361E9-DA6D-72C9-1B98-54FF8914032C}-v1-{B1DC4818-C791-4CCB-ADE9-80EDAF719B34}-v20-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
  ADS C:\Documents and Settings\Eileen Tan\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EFEECE80-A086-29D7-BD12-10CA2BDF3E47}\01\13-{EFEECE80-A086-29D7-BD12-10CA2BDF3E47}-v1-{B1DC4818-C791-4CCB-ADE9-80EDAF719B34}-v13-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
  ADS C:\Documents and Settings\Eileen Tan\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EFEECE80-A086-29D7-BD12-10CA2BDF3E47}\14\125-{B4633B54-021F-4E7F-9B27-768C43124E1D}-v114-{B4633B54-021F-4E7F-9B27-768C43124E1D}-v125-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
  ADS C:\Documents and Settings\Eileen Tan\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EFEECE80-A086-29D7-BD12-10CA2BDF3E47}\14\125-{B4633B54-021F-4E7F-9B27-768C43124E1D}-v114-{B4633B54-021F-4E7F-9B27-768C43124E1D}-v125-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
  ADS C:\Documents and Settings\Eileen Tan\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EFEECE80-A086-29D7-BD12-10CA2BDF3E47}\15\115-{B4633B54-021F-4E7F-9B27-768C43124E1D}-v115-{B4633B54-021F-4E7F-9B27-768C43124E1D}-v115-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
  ADS C:\Documents and Settings\Eileen Tan\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EFEECE80-A086-29D7-BD12-10CA2BDF3E47}\15\15-{B1DC4818-C791-4CCB-ADE9-80EDAF719B34}-v15-{B1DC4818-C791-4CCB-ADE9-80EDAF719B34}-v15-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
  ADS C:\Documents and Settings\Eileen Tan\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EFEECE80-A086-29D7-BD12-10CA2BDF3E47}\15\15-{B1DC4818-C791-4CCB-ADE9-80EDAF719B34}-v15-{B1DC4818-C791-4CCB-ADE9-80EDAF719B34}-v15-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
  ADS C:\Documents and Settings\Eileen Tan\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EFEECE80-A086-29D7-BD12-10CA2BDF3E47}\16\116-{B4633B54-021F-4E7F-9B27-768C43124E1D}-v116-{B4633B54-021F-4E7F-9B27-768C43124E1D}-v116-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
  ADS C:\Documents and Settings\Eileen Tan\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EFEECE80-A086-29D7-BD12-10CA2BDF3E47}\17\117-{B4633B54-021F-4E7F-9B27-768C43124E1D}-v117-{B4633B54-021F-4E7F-9B27-768C43124E1D}-v117-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
  ADS C:\Documents and Settings\Eileen Tan\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EFEECE80-A086-29D7-BD12-10CA2BDF3E47}\18\118-{B4633B54-021F-4E7F-9B27-768C43124E1D}-v118-{B4633B54-021F-4E7F-9B27-768C43124E1D}-v118-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
  ADS C:\Documents and Settings\Eileen Tan\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EFEECE80-A086-29D7-BD12-10CA2BDF3E47}\18\18-{B1DC4818-C791-4CCB-ADE9-80EDAF719B34}-v18-{B1DC4818-C791-4CCB-ADE9-80EDAF719B34}-v18-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
  ADS C:\Documents and Settings\Eileen Tan\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EFEECE80-A086-29D7-BD12-10CA2BDF3E47}\18\18-{B1DC4818-C791-4CCB-ADE9-80EDAF719B34}-v18-{B1DC4818-C791-4CCB-ADE9-80EDAF719B34}-v18-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
  ADS C:\Documents and Settings\Eileen Tan\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EFEECE80-A086-29D7-BD12-10CA2BDF3E47}\18\18-{B1DC4818-C791-4CCB-ADE9-80EDAF719B34}-v18-{B1DC4818-C791-4CCB-ADE9-80EDAF719B34}-v18-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
  ADS C:\Documents and Settings\Eileen Tan\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EFEECE80-A086-29D7-BD12-10CA2BDF3E47}\19\119-{B4633B54-021F-4E7F-9B27-768C43124E1D}-v119-{B4633B54-021F-4E7F-9B27-768C43124E1D}-v119-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
  ADS C:\Documents and Settings\Eileen Tan\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EFEECE80-A086-29D7-BD12-10CA2BDF3E47}\20\120-{B4633B54-021F-4E7F-9B27-768C43124E1D}-v120-{B4633B54-021F-4E7F-9B27-768C43124E1D}-v120-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
  ADS C:\Documents and Settings\Eileen Tan\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EFEECE80-A086-29D7-BD12-10CA2BDF3E47}\21\121-{B4633B54-021F-4E7F-9B27-768C43124E1D}-v121-{B4633B54-021F-4E7F-9B27-768C43124E1D}-v121-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
  ADS C:\Documents and Settings\Eileen Tan\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EFEECE80-A086-29D7-BD12-10CA2BDF3E47}\22\122-{B4633B54-021F-4E7F-9B27-768C43124E1D}-v122-{B4633B54-021F-4E7F-9B27-768C43124E1D}-v122-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
  ADS C:\Documents and Settings\Eileen Tan\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EFEECE80-A086-29D7-BD12-10CA2BDF3E47}\23\123-{B4633B54-021F-4E7F-9B27-768C43124E1D}-v123-{B4633B54-021F-4E7F-9B27-768C43124E1D}-v123-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
  ADS C:\Documents and Settings\Eileen Tan\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EFEECE80-A086-29D7-BD12-10CA2BDF3E47}\24\124-{B4633B54-021F-4E7F-9B27-768C43124E1D}-v124-{B4633B54-021F-4E7F-9B27-768C43124E1D}-v124-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
  ADS C:\Documents and Settings\Eileen Tan\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{32F5140F-05D5-3354-0184-312BD0662867}\01\11-{32F5140F-05D5-3354-0184-312BD0662867}-v1-{B1DC4818-C791-4CCB-ADE9-80EDAF719B34}-v11-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
  ADS C:\Documents and Settings\Eileen Tan\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{54C5DB7C-C236-62C2-8C11-F217A76C8FA8}\01\12-{54C5DB7C-C236-62C2-8C11-F217A76C8FA8}-v1-{B1DC4818-C791-4CCB-ADE9-80EDAF719B34}-v12-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
  
  ---- EOF - GMER 1.0.13 ----
• relgn

  20 Sep 07, 15:34

  thanks
• relgn

  21 Sep 07, 23:40

  xiaomayi, how? can it be fixed
• ndmmxiaomayi

  22 Sep 07, 00:03

  I'm afraid not. A lot of things are really missing... and they are showing up in the Uninstall list.
  
  Like Yahoo! toolbar and Megaupload toolbar.
  
  You will need to backup and reformat the computer...
  
  And one more thing. Change all accounts passwords. If she does online banking, contact the banks and check the account statements from the past few all the way to the next few months.