Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

[name].dll is not a valid windows image


  • Please log in to reply
20 replies to this topic

#1 Rose636

Rose636

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:09:30 PM

Posted 10 July 2009 - 06:16 AM

Hello,
Over the past week or so I believe that I've had some nasty rootkit problems on my laptop and have ran Malwarebytes several times, each time it picking up the same few errors. However after deleting them they quickly re-emerge, Malwarebytes as follows:

Malwarebytes' Anti-Malware 1.38
Database version: 2401
Windows 5.1.2600 Service Pack 3

10/07/2009 12:01:30
mbam-log-2009-07-10 (12-01-30).txt

Scan type: Quick Scan
Objects scanned: 96122
Time elapsed: 3 minute(s), 49 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Now this issue has appeared to have evolved, my laptop has started throwing up [randomname].dll is not a valid windows image several times when it is loading up and whenever I attempt to load any programs which after being told that the .dll is not valid, runs anyway. I searched 'dll not valid windows image bleepingcomputer' in google and found the following thread with similar issues: http://www.bleepingcomputer.com/forums/t/238160/globalrootsystemrootsystem32hjgruihwujwmlwdll-not-a-valid-windows-image/

Following the advice on there I downloaded and ran RootRepeal, for the Files and Drives tabs, RootRepeal results saved but not posted due to long length, will post if requested.

I haven't connected it to the Internet since the .dll issues arose but prior to this it was having a lot of trouble displaying Google results pages if this is of any help to you. Thank you very much for reading this and I hope that something can be done because I am beginning to freak out a bit.

Edited by Rose636, 10 July 2009 - 06:30 AM.


BC AdBot (Login to Remove)

 


#2 DaChew

DaChew

    Visiting Alien


  • BC Advisor
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:04:30 PM

Posted 10 July 2009 - 07:35 AM

Would you post the rootrepeal Hidden/Locked Files section of the log/report?
Chewy

No. Try not. Do... or do not. There is no try.

#3 Rose636

Rose636
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:09:30 PM

Posted 10 July 2009 - 08:08 AM

Sorry, I meant to edit my original post to put it in a spoiler box to save space, but either way:

ROOTREPEAL © AD, 2007-2009
==================================================
Scan Time: 2009/07/10 11:48
Program Version: Version 1.3.0.0
Windows Version: Windows XP SP3
==================================================

Hidden/Locked Files
-------------------
Path: C:\WINDOWS\system32\hjgruiexmttivk.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\hjgruihbrcddvq.dat
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\hjgruiosswweyx.dat
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\hjgruivttfmput.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\drivers\hjgruijalmlkay.sys
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\temp\hjgrui000
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\27\59-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\27\59-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\27\59-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\00\100-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v100-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v100-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\01\10-{9C98235E-5FC5-FF47-DE0F-6B82216E4271}-v1-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v10-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\01\101-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v101-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v101-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\02\102-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v102-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v102-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\03\103-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v103-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v103-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\04\104-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v104-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v104-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\05\105-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v105-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v105-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\06\106-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v106-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v106-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\07\51-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v107-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v51-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\08\108-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v108-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v108-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\09\109-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v109-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v109-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\10\110-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v110-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v110-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\11\111-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v111-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v111-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\12\112-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v112-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v112-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\12\12-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v12-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v12-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\13\113-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v113-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v113-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\14\114-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v114-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v114-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\15\13-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v115-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v13-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\16\116-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v116-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v116-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\16\16-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v16-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v16-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\17\117-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v117-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v117-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\17\17-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v17-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v17-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\118-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v118-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v118-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\19\119-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v119-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v119-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\19\71-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\19\71-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\19\71-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\20\120-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v120-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v120-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\20\72-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\20\72-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\20\72-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\21\121-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v121-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v121-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\21\73-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\21\73-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\21\73-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\22\122-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v122-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v122-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\22\74-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\22\74-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\22\74-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\23\123-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v123-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v123-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\23\75-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\23\75-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\23\75-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\23\75-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\24\124-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v124-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v124-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\24\76-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\24\76-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\24\76-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\25\125-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v125-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v125-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\25\77-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\25\77-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\25\77-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\26\126-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v126-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v126-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\26\26-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v26-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v26-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\28\60-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\28\60-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\28\60-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\28\60-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\29\61-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\29\61-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\29\61-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\30\62-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\30\62-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\30\62-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\31\63-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\31\63-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\31\63-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\32\64-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\32\64-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\32\64-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\33\65-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\33\65-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\33\65-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\34\66-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\34\66-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\34\66-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\35\67-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\35\67-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\35\67-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\36\68-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\36\68-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\36\68-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\37\37-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v37-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v37-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\38\52-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\38\52-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\38\52-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\39\53-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\39\53-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\39\53-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\40\54-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\40\54-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\40\54-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\41\55-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\41\55-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\41\55-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\42\56-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\42\56-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\42\56-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\43\57-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\43\57-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\43\57-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\44\44-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v44-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v44-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\45\45-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v45-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v45-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\46\46-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v46-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v46-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\47\47-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v47-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v47-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\49\249-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v249-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v249-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\80\80-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v80-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v80-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\81\81-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v81-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v81-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\82\82-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v82-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v82-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\83\83-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v83-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v83-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\84\84-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v84-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v84-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\85\85-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v85-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v85-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\88\88-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v88-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v88-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\89\89-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v89-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v89-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\90\90-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v90-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v90-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\91\91-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v91-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v91-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\92\92-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v92-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v92-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\93\93-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v93-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v93-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\94\94-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v94-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v94-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\96\96-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v96-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v96-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\97\97-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v97-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v97-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\98\98-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v98-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v98-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\99\99-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v99-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v99-Downloaded.frx
Status: Locked to the Windows API!



Thank you for the quick reply, however I am soon to start work and therefore if any further logs are requested then I will be unable to provide them until tomorrow. Once again, thank you for helping me.

#4 DaChew

DaChew

    Visiting Alien


  • BC Advisor
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:04:30 PM

Posted 10 July 2009 - 08:18 AM

Rerun Rootrepeal, this time only select the file scan

Path: C:\WINDOWS\system32\drivers\hjgruijalmlkay.sys
Status: Invisible to the Windows API!


This is the core rootkit file

Highlight this line and rightclick and choose Wipe

Immediately reboot and run MBAM
Chewy

No. Try not. Do... or do not. There is no try.

#5 Rose636

Rose636
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:09:30 PM

Posted 12 July 2009 - 02:12 PM

Hello, thanks for the help so far. I 'wiped' the hjgruijalmlkay.sys file via RootRepeal, restarted and did an MBAM scan as follows (no [name].dll errors occurred on reboot or opening files):


Malwarebytes' Anti-Malware 1.38
Database version: 2402
Windows 5.1.2600 Service Pack 3

12/07/2009 19:40:50
mbam-log-2009-07-12 (19-40-50).txt

Scan type: Quick Scan
Objects scanned: 97302
Time elapsed: 10 minute(s), 15 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 5
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\hjgruikklvroye (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\hjgruikklvroye (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hjgruikklvroye (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\WINDOWS\system32\hjgruiexmttivk.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\hjgruivttfmput.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\drivers\hjgruijalmlkay.sys (Trojan.Agent) -> Quarantined and deleted successfully.



Following this I rebooted again to see if there were any remnant files that were re-installing themselves when the computer was rebooted and MBAM found 3 files as follows:

Malwarebytes' Anti-Malware 1.38
Database version: 2402
Windows 5.1.2600 Service Pack 3

12/07/2009 19:57:15
mbam-log-2009-07-12 (19-57-15).txt

Scan type: Quick Scan
Objects scanned: 97237
Time elapsed: 12 minute(s), 37 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)



Furthermore I ran another RootRepeal file scan as follows:

ROOTREPEAL © AD, 2007-2009
==================================================
Scan Time: 2009/07/12 20:04
Program Version: Version 1.3.0.0
Windows Version: Windows XP SP3
==================================================

Hidden/Locked Files
-------------------
Path: c:\program files\spyware doctor\history\userlog.dad
Status: Allocation size mismatch (API: 458752, Raw: 24)

Path: c:\program files\spyware doctor\history\userlog.das
Status: Allocation size mismatch (API: 262144, Raw: 196608)

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\27\59-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\27\59-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\27\59-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\00\100-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v100-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v100-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\01\10-{9C98235E-5FC5-FF47-DE0F-6B82216E4271}-v1-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v10-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\01\101-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v101-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v101-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\02\102-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v102-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v102-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\03\103-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v103-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v103-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\04\104-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v104-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v104-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\05\105-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v105-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v105-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\06\106-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v106-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v106-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\07\51-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v107-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v51-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\08\108-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v108-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v108-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\09\109-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v109-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v109-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\10\110-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v110-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v110-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\11\111-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v111-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v111-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\12\112-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v112-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v112-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\12\12-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v12-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v12-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\13\113-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v113-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v113-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\14\114-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v114-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v114-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\15\13-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v115-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v13-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\16\116-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v116-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v116-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\16\16-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v16-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v16-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\17\117-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v117-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v117-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\17\17-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v17-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v17-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\118-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v118-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v118-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\18\70-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\19\119-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v119-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v119-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\19\71-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\19\71-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\19\71-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\20\120-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v120-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v120-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\20\72-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\20\72-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\20\72-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\21\121-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v121-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v121-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\21\73-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\21\73-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\21\73-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\22\122-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v122-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v122-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\22\74-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\22\74-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\22\74-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\23\123-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v123-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v123-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\23\75-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\23\75-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\23\75-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\23\75-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\24\124-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v124-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v124-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\24\76-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\24\76-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\24\76-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\25\125-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v125-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v125-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\25\77-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\25\77-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\25\77-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\26\126-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v126-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v126-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\26\26-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v26-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v26-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\28\60-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\28\60-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\28\60-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\28\60-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\29\61-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\29\61-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\29\61-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\30\62-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\30\62-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\30\62-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\31\63-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\31\63-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\31\63-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\32\64-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\32\64-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\32\64-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\33\65-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\33\65-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\33\65-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\34\66-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\34\66-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\34\66-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\35\67-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\35\67-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\35\67-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\36\68-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\36\68-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\36\68-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\37\37-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v37-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v37-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\38\52-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\38\52-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\38\52-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\39\53-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\39\53-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\39\53-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\40\54-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\40\54-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\40\54-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\41\55-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\41\55-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\41\55-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\42\56-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\42\56-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\42\56-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\43\57-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\43\57-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\43\57-{0C~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\44\44-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v44-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v44-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\45\45-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v45-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v45-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\46\46-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v46-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v46-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\47\47-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v47-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v47-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\49\249-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v249-{C8D34086-8758-481E-98AA-C711D2BB51F0}-v249-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\80\80-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v80-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v80-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\81\81-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v81-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v81-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\82\82-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v82-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v82-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\83\83-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v83-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v83-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\84\84-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v84-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v84-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\85\85-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v85-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v85-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\88\88-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v88-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v88-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\89\89-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v89-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v89-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\90\90-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v90-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v90-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\91\91-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v91-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v91-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\92\92-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v92-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v92-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\93\93-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v93-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v93-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\94\94-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v94-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v94-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\96\96-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v96-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v96-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\97\97-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v97-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v97-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\98\98-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v98-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v98-Downloaded.frx
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jon Rose\Local Settings\Application Data\Microsoft\Messenger\the_tramp@hotmail.co.uk\SharingMetadata\whileyourewaiting_alk3@hotmail.co.uk\DFSR\Staging\CS{9C98235E-5FC5-FF47-DE0F-6B82216E4271}\99\99-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v99-{0C392FFE-FD1B-4C53-8B1F-82EC9B4F7205}-v99-Downloaded.frx
Status: Locked to the Windows API!



Is there anything that you can see from the above information that could indicate what is causing these three files to reinstall? Thank you in advance.

Edited by Rose636, 12 July 2009 - 02:14 PM.


#6 DaChew

DaChew

    Visiting Alien


  • BC Advisor
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:04:30 PM

Posted 12 July 2009 - 02:22 PM

Please download and run Processexplorer


http://technet.microsoft.com/en-us/sysinte...s/bb896653.aspx

Under file and save as, create a log and post here

copy and paste into a reply
Chewy

No. Try not. Do... or do not. There is no try.

#7 DaChew

DaChew

    Visiting Alien


  • BC Advisor
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:04:30 PM

Posted 12 July 2009 - 02:27 PM

This is the newest variant, it would advisable to update MBAM, your database is 2-3 days old

I just did 2413
Chewy

No. Try not. Do... or do not. There is no try.

#8 Rose636

Rose636
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:09:30 PM

Posted 15 July 2009 - 05:02 AM

Hi again, I've updated MBAM as of 10:30 GMT on 15th July. I ran another scan as follows:

Malwarebytes' Anti-Malware 1.39
Database version: 2432
Windows 5.1.2600 Service Pack 3

15/07/2009 10:46:36
mbam-log-2009-07-15 (10-46-36).txt

Scan type: Quick Scan
Objects scanned: 95448
Time elapsed: 7 minute(s), 28 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)






I then ran the Process Explorer as you asked:

Process PID CPU Description Company Name
System Idle Process 0 90.91
Interrupts n/a 1.52 Hardware Interrupts
DPCs n/a Deferred Procedure Calls
System 4
csrss.exe 872 Client Server Runtime Process Microsoft Corporation
winlogon.exe 908 Windows NT Logon Application Microsoft Corporation
services.exe 952 3.03 Services and Controller app Microsoft Corporation
ati2evxx.exe 1128 ATI External Event Utility EXE Module ATI Technologies Inc.
svchost.exe 1160 Generic Host Process for Win32 Services Microsoft Corporation
igfxsrvc.exe 4136 igfxsrvc Module Intel Corporation
svchost.exe 1228 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 1268 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 1308 Generic Host Process for Win32 Services Microsoft Corporation
EvtEng.exe 1368 EvtEng Module Intel Corporation
S24EvMon.exe 1396 Event Monitor - Supports driver extensions to NIC Driver for wireless adapters. Intel Corporation
svchost.exe 1468 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 1556 Generic Host Process for Win32 Services Microsoft Corporation
spoolsv.exe 1916 Spooler SubSystem App Microsoft Corporation
svchost.exe 1520 Generic Host Process for Win32 Services Microsoft Corporation
AppleMobileDeviceService.exe 256 Apple Mobile Device Service Apple Inc.
mDNSResponder.exe 280 Bonjour Service Apple Inc.
fsgk32st.exe 336 fsgk32st F-Secure Corporation
fsgk32.exe 2024 Gatekeeper Handler II F-Secure Corp.
fssm32.exe 3744 fssm32 F-Secure Corp.
FSMA32.EXE 428 F-Secure Management Agent F-Secure Corporation
FSMB32.EXE 556 F-Secure Message Broker F-Secure Corporation
FCH32.EXE 1188 F-Secure Configuration Handler F-Secure Corporation
FAMEH32.EXE 2652 F-Secure Alert and Management Extension Handler F-Secure Corporation
fsqh.exe 2660 F-Secure Quarantine Handler F-Secure Corporation
fspc.exe 2812 F-Secure Parental Control F-Secure Corporation
fsav32.exe 5284 FSAV Handler F-Secure Corporation
jqs.exe 516 Java™ Quick Starter Service Sun Microsystems, Inc.
MDM.EXE 660 Machine Debug Manager Microsoft Corporation
RegSrvc.exe 820 RegSrvc Module Intel Corporation
pctsAuxs.exe 864 PC Tools Auxiliary Service PC Tools
pctsSvc.exe 1428 PC Tools Security Service PC Tools
svchost.exe 3464 Generic Host Process for Win32 Services Microsoft Corporation
VESMgr.exe 3536 VAIO Event Service (Service Module) Sony Corporation
fsaua.exe 3660 F-Secure Automatic Update Agent F-Secure Corporation
fsdfwd.exe 4852 F-Secure Anti-Virus Internet Shield daemon F-Secure Corporation
iPodService.exe 4960 iPodService Module Apple Inc.
alg.exe 5432 Application Layer Gateway Service Microsoft Corporation
lsass.exe 964 LSA Shell (Export Version) Microsoft Corporation
ati2evxx.exe 484 ATI External Event Utility EXE Module ATI Technologies Inc.
explorer.exe 732 Windows Explorer Microsoft Corporation
Apoint.exe 1648 Alps Pointing-device Driver Alps Electric Co., Ltd.
ico.exe 1732 Mouse Suite 98 Daemon Primax Electronics Ltd.
SPMgr.exe 1716 SPM Module Sony Corporation
ISBMgr.exe 1956 Sony Corporation
Switcher.exe 1840 Wireless Switch Setting Utility Sony Corporation
pdservice.exe 2036 PrivateDisk Service Utimaco Safeware AG
menusw.exe 2080 Biometrics User Switcher UPEK Inc.
FSM32.EXE 2096 F-Secure Settings and Statistics F-Secure Corporation
fsguidll.exe 2488 4.55 F-Secure GUI component F-Secure Corporation
iTunesHelper.exe 2360 iTunesHelper Module Apple Inc.
jusched.exe 2384 Java™ Platform SE binary Sun Microsystems, Inc.
pctsTray.exe 2420 PC Tools Tray Application PC Tools
ctfmon.exe 2436 CTF Loader Microsoft Corporation
GoogleToolbarNotifier.exe 2540 GoogleToolbarNotifier Google Inc.
msmsgs.exe 2548 Windows Messenger Microsoft Corporation
RegMech.exe 2564 Registry Mechanic 8.0 PC Tools
Process Explorer.exe 3808 Sysinternals Process Explorer Sysinternals - www.sysinternals.com
ApntEx.exe 2676 Alps Pointing-device Driver for Windows NT/2000/XP Alps Electric Co., Ltd.
TosBtMng.exe 2760 TosBtMng TOSHIBA CORPORATION.
TosA2dp.exe 3056 TosA2dp TOSHIBA CORPORATION.
TosBtHSP.exe 3172 TosBtHSP TOSHIBA CORPORATION.
fsus.exe 5120 F-Secure Automatic Update Agent - Run Upstreamer F-Secure Corporation

#9 DaChew

DaChew

    Visiting Alien


  • BC Advisor
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:04:30 PM

Posted 15 July 2009 - 11:42 AM

Please download ATF Cleaner by Atribune & save it to your desktop.
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main "Select Files to Delete" choose: Select All.
  • Click the Empty Selected button.
  • If you use Firefox browser click Firefox at the top and choose: Select All
  • Click the Empty Selected button.
    If you would like to keep your saved passwords, please click No at the prompt.
  • If you use Opera browser click Opera at the top and choose: Select All
  • Click the Empty Selected button.
    If you would like to keep your saved passwords, please click No at the prompt.
  • Click Exit on the Main menu to close the program.
Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".

Please download and scan with SUPERAntiSpyware Free
  • Double-click SUPERAntiSypware.exe and use the default settings for installation.
  • An icon will be created on your desktop. Double-click that icon to launch the program.
  • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here. Double-click on the hyperlink for Download Installer and save SASDEFINITIONS.EXE to your desktop. Then double-click on SASDEFINITIONS.EXE to install the definitions.)
  • In the Main Menu, click the Preferences... button.
  • Click the "General and Startup" tab, and under Start-up Options, make sure "Start SUPERAntiSpyware when Windows starts" box is unchecked.
  • Click the "Scanning Control" tab, and under Scanner Options, make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Scan for tracking cookies.
    • Terminate memory threats before quarantining.
  • Click the "Close" button to leave the control center screen and exit the program.
  • Do not run a scan just yet.
Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with SUPERAntiSpyware as follows:
  • Launch the program and back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  • On the left, make sure you check C:\Fixed Drive.
  • On the right, under "Complete Scan", choose Perform Complete Scan and click "Next".
  • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  • Make sure everything has a checkmark next to it and click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked if you want to reboot, click "Yes" and reboot normally.
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    • Please copy and paste the Scan Log results in your next reply.
  • Click Close to exit the program.

Chewy

No. Try not. Do... or do not. There is no try.

#10 Rose636

Rose636
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:09:30 PM

Posted 16 July 2009 - 03:49 PM

Hey, I ran the ATF as stated, it got rid of ~60mb of materials. Furthermore I ran the superantispyware with the following results:
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/16/2009 at 09:03 PM

Application Version : 4.26.1006

Core Rules Database Version : 3998
Trace Rules Database Version: 1938

Scan type : Complete Scan
Total Scan Time : 07:05:21

Memory items scanned : 336
Memory threats detected : 0
Registry items scanned : 6077
Registry threats detected : 5
File items scanned : 177988
File threats detected : 10

Rogue.Component/Trace
HKLM\Software\Microsoft\54A59CD1
HKLM\Software\Microsoft\54A59CD1#54a59cd1
HKLM\Software\Microsoft\54A59CD1#Version
HKLM\Software\Microsoft\54A59CD1#54a53151
HKLM\Software\Microsoft\54A59CD1#54a558b4

Trojan.Agent/Gen-FSG
C:\DOCUMENTS AND SETTINGS\JON ROSE\DESKTOP\REGISTRY MECHANIC\KEYGEN.EXE

Trojan.Agent/Gen
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\UACGMJDLDGDHKNBDOTOI.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\UACLXMPJOVYQLYIDOVKT.DLL.VIR

Trojan.Agent/Gen-PEC
C:\WINDOWS\PEV.EXE

Trojan.Agent/Gen-WinHelper[FakeInit]
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\I7M981WP\FIREWALL[1].DLL

Rogue.FakeAlert/Wallpaper
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\I7M981WP\WARNING[1].GIF
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\UDAVWPE7\WARNING[1].GIF

Trace.Known Threat Sources
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\UDAVWPE7\winlogon[1].htm
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\K94H67KX\loads[2].htm
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\K94H67KX\winlogon[1].htm


However there was an issue... when I restarted it simply turned off my laptop rather than restarting it. Is this a problem and would have whatever was queued to be removed upon restart be deleted upon the shutdown-restart? Should I rerun SAS, reboot if necessary and post the second log?

Thanks, as always.

#11 DaChew

DaChew

    Visiting Alien


  • BC Advisor
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:04:30 PM

Posted 16 July 2009 - 04:07 PM

When did you run Combofix?

When did you install F-Secure ?

Please uninstall registry mechanic, we don't reccomend those kind of tools much less cracked versions

Let's try another scanner

Before we start fixing anything you should print out these instructions or copy them to a NotePad file so they will be accessible. Some steps will require you to disconnect from the Internet or use Safe Mode and you will not have access to this page.

Please download DrWeb-CureIt and save it to your desktop. DO NOT perform a scan yet.

Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with Dr.Web CureIt as follows:
  • Double-click on launch.exe to open the program and click Start. (There is no need to update if you just downloaded the most current version
  • Read the Virus check by DrWeb scanner prompt and click Ok where asked to Start scan now? Allow the setup.exe to load if asked by any of your security programs.
  • The Express scan will automatically begin.
    (This is a short scan of files currently running in memory, boot sectors, and targeted folders).
  • If prompted to dowload the Full version Free Trial, ignore and click the X to close the window.
  • If an infected object is found, you will be prompted to move anything that cannot be cured. Click Yes to All.
  • When complete, click Select All, then choose Cure > Move incurable.
    (This will move any detected files to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if they can't be cured)
  • Now put a check next to Complete scan to scan all local disks and removable media.
  • In the top menu, click Settings > Change settings, and UNcheck "Heuristic analysis" under the "Scanning" tab, then click Ok.
  • Back at the main window, click the green arrow "Start Scanning" button on the right under the Dr.Web logo.
  • When the scan is complete, a message will be displayed at the bottom indicating if any viruses were found.
  • Click "Yes to all" if asked to cure or move the file(s) and select "Move incurable".
  • In the top menu, click file and choose save report list.
  • Save the DrWeb.csv report to your desktop.
  • Exit Dr.Web Cureit when done.
  • Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
  • After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)

Chewy

No. Try not. Do... or do not. There is no try.

#12 Rose636

Rose636
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:09:30 PM

Posted 25 July 2009 - 06:09 AM

Hey, apologies for the long time between replies but I've been rather swamped at work and running DWCI a couple of times.

I have had a legal and paid for version of F-Secure for about 2.5 years now (since I bought the laptop).
ComboFix, yes I admit I am rather stupid with regard to this although I was only aware of the 'only run it with the help of a professional' after running it. I ran it about a week before contacting you here.
Registry Mechanic is now completely deleted.

I'm having trouble with DrWebCureIt, the first time it ran it found about 5-6 issues which I told it to cure on the fly. However it got about 2/3 of the way through the full scan (~550,000 items) but then 'uw93r.exe' crashed and it became inoperable, therefore it couldn't finish and I couldn't save the log as requested. I've ran it a couple of times since (each taking about 6 hours each time) and each time it gets to about 2/3 of the way through the progress bar (and ~550,000 items scanned) and the same issue arises. However on these subsequent scans no issues were found.

#13 DaChew

DaChew

    Visiting Alien


  • BC Advisor
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:04:30 PM

Posted 25 July 2009 - 06:39 AM

We may be looking at some other issues besides malware

Download this system spec tool

http://www.alexnolan.net/software/SysSpec.exe

Under file, save to csv

Post the report
Chewy

No. Try not. Do... or do not. There is no try.

#14 Rose636

Rose636
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:09:30 PM

Posted 27 July 2009 - 12:05 PM

Windows: Microsoft Windows XP Professional 5.1.2600 Service Pack 3
Internet Explorer: 8.0.6001.18702
Memory (RAM): 2047 MB
CPU Info: Intel® Pentium® M processor 2.00GHz
CPU Speed: 1055.7 MHz
Sound card: Realtek HD Audio output
Display Adapters: ATI MOBILITY RADEON X700 | TucbVideo | ATI MOBILITY RADEON X700 | NetMeeting driver | RDPDD Chained DD
Monitors: 1
Screen Resolution: 1920 X 1200 - 32 bit
Network: Network Present
Network Adapters: Intel® PRO/Wireless 2200BG Network Connection - Packet Scheduler Miniport | Marvell Yukon 88E8053 PCI-E Gigabit Ethernet Controller - Packet Scheduler Miniport
CD / DVD Drives: G: SONY DVD RW DW-Q58A
COM Ports: COM6 | COM7 | COM10 | COM11 | COM12 | COM13 | COM14 | COM20 | COM21 | COM3
LPT Ports: NOT Present
Mouse: 3 Button Wheel Mouse Present
Hard Disks: C: 67.5GB | F: 74.5GB
Hard Disks - Free: C: 19.9GB | F: 4.6GB
USB Controllers: 8 host controllers.
Firewire (1394): 1 host controllers.
PCMCIA (Laptops): Not Installed
Manufacturer: Phoenix Technologies LTD
Product Make: VGN-BX197XP
AC Power Status: OnLine
BIOS Info: AT/AT COMPATIBLE | 11/25/05 | SONY - 6040000
Time Zone: GMT Standard Time
Battery: Unknown
Motherboard: Sony Corporation Q-Project
Modem: HDAUDIO SoftV92 Data Fax Modem with SmartCP

:

#15 Rose636

Rose636
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:09:30 PM

Posted 01 August 2009 - 11:05 AM

Was there a reason why you asked since when I had had F-Secure installed? I ran a full-computer scan and it found 'word64main.exe' file as a trojan. If I try to disinfect/quarantine/delete the file then it simply loads for a while but eventually cannot find the file again, saying that some other program may have got it. Half way through the disinfect/quarantine/delete process my task bar and windows explorer windows revert back to pre-XP layout, the grey box like version as opposed to XP's more curvy and colourful layout and I cannot change it to XP style again, the settings state that it is already showing the XP variant. Furthermore I cannot shutdown or restart my computer at this point so I have to turn off the power to turn it off. The settings change back to the XP layout upon reboot and nothing appears different until F-Secure finds the file again during another scan.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users