PDA

View Full Version : Command Service



sandon.m
2008-04-19, 05:44
I have spent all day trying to get this command service threat off of my computer and after reading another posting on here about it I did a hjt log and have attached it.

Please advise me on how to remove this maleware...

Greatly appreciated!!!!!!!!!

sandon.m
2008-04-19, 21:03
I went ahead and ran SDfix and here is the log along with an updated hjt log.

There still seems to be traces of cmdservices and the resulting other maleware. What do I do next to fully resolve this issue?

sandon.m
2008-04-19, 21:04
SDFix: Version 1.172
Run by jack on Fri 04/18/2008 at 08:54 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\DOCUME~1\jack\Desktop\SDFix

Checking Services :

Name :
cmdService

Path :
C:\WINDOWS\amFjaw\command.exe

cmdService - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\WINDOWS\amFjaw\asappsrv.dll - Deleted
C:\WINDOWS\amFjaw\command.exe - Deleted
C:\WINDOWS\amFjaw\uAI3uT.vbs - Deleted
C:\Documents and Settings\jack\Application Data\Install.dat - Deleted
C:\Temp\1cb\syscheck.log - Deleted
C:\Program Files\Setup.exe - Deleted
C:\Documents and Settings\jack\Start Menu\Programs\Startup\DW_Start.lnk - Deleted
C:\DOCUME~1\jack\LOCALS~1\Temp\snapsnet.exe - Deleted
C:\DOCUME~1\jack\LOCALS~1\Temp\yazzsnet.exe - Deleted
C:\WINDOWS\system32\msnav32.ax - Deleted
C:\WINDOWS\system32\pac.txt - Deleted



Folder C:\Program Files\AntiSpywareMaster - Removed
Folder C:\Temp\1cb - Removed


Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1353.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-18 21:09:42
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:6ed4c76a
"s2"=dword:e76da2b3
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:d1,a0,7a,79,15,28,b4,3e,1b,98,c9,b8,aa,cd,23,52,cd,c1,52,59,5a,..
"p0"="C:\Program Files\DAEMON Tools\"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,0f,e6,be,d5,f4,58,fa,2a,63,2d,db,bf,71,10,1f,b5,51,..
"khjeh"=hex:1f,78,57,8d,1d,a8,c6,60,05,55,3e,f9,90,1c,f9,af,ec,cd,42,ca,d3,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:cc,50,b3,1f,37,c1,75,03,46,c7,27,67,21,15,0a,52,db,5e,4c,73,f0,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:d1,a0,7a,79,15,28,b4,3e,1b,98,c9,b8,aa,cd,23,52,cd,c1,52,59,5a,..
"p0"="C:\Program Files\DAEMON Tools\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,0f,e6,be,d5,f4,58,fa,2a,63,2d,db,bf,71,10,1f,b5,51,..
"khjeh"=hex:1f,78,57,8d,1d,a8,c6,60,05,55,3e,f9,90,1c,f9,af,ec,cd,42,ca,d3,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:cc,50,b3,1f,37,c1,75,03,46,c7,27,67,21,15,0a,52,db,5e,4c,73,f0,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:000001e5
"TracesSuccessful"=dword:00000001

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :



Authorized Application Key Export:

Remaining Files :


File Backups: - C:\DOCUME~1\jack\Desktop\SDFix\backups\backups.zip

Files with Hidden Attributes :

Tue 30 Nov 2004 253,952 A..HR --- "C:\Program Files\PocketCache Trial Version\BackupRestoreBus.dll"
Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Fri 11 Apr 2008 230,400 ..SHR --- "C:\Program Files\?ystem32\l?ass.exe"
Fri 18 Apr 2008 68,608 ..SHR --- "C:\WINDOWS\?icrosoft\arpa.exe"
Tue 5 Sep 2006 427,632 A..H. --- "C:\Program Files\Canon\Canon iP90 Setup Utility\Maint.exe"
Tue 11 May 2004 61,440 A..H. --- "C:\Program Files\Canon\Canon iP90 Setup Utility\uinstrsc.dll"
Thu 17 Jan 2008 72 A..H. --- "C:\Program Files\InterActual\InterActual Player\itiCD.tmp"
Wed 15 Jun 2005 474 A..HR --- "C:\Program Files\PocketCache Trial Version\BackupStorage\config.bak"
Sun 3 Jun 2007 68,608 ...H. --- "C:\Documents and Settings\jack\My Documents\THE THIEF\~WRL0375.tmp"
Sun 3 Jun 2007 68,608 ...H. --- "C:\Documents and Settings\jack\My Documents\THE THIEF\~WRL0957.tmp"
Fri 22 Jun 2007 69,632 ...H. --- "C:\Documents and Settings\jack\My Documents\THE THIEF\~WRL1969.tmp"
Thu 21 Jun 2007 69,120 ...H. --- "C:\Documents and Settings\jack\My Documents\THE THIEF\~WRL3485.tmp"
Sat 19 May 2007 32,256 ...H. --- "C:\Documents and Settings\jack\Application Data\Microsoft\Templates\~WRL0674.tmp"
Mon 23 Jul 2007 40,448 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\FILES FOR LAWYER\~WRL0545.tmp"
Mon 23 Jul 2007 57,856 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\FILES FOR LAWYER\~WRL2205.tmp"
Mon 23 Jul 2007 51,712 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\FILES FOR LAWYER\~WRL2680.tmp"
Mon 23 Jul 2007 44,032 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\FILES FOR LAWYER\~WRL3853.tmp"
Wed 1 Dec 2004 88,576 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Office Procedures\~WRL0004.tmp"
Mon 6 Dec 2004 68,608 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Office Procedures\~WRL1915.tmp"
Sat 7 Jul 2007 9,278,976 ...H. --- "C:\Documents and Settings\jack\My Documents\MISC PERSONAL\MOM\~WRL1695.tmp"
Wed 15 Mar 2006 28,672 ...H. --- "C:\Documents and Settings\jack\My Documents\THE THIEF\WORKING DOCS & ARCHIVE\~WRL0405.tmp"
Wed 15 Mar 2006 28,160 ...H. --- "C:\Documents and Settings\jack\My Documents\THE THIEF\WORKING DOCS & ARCHIVE\~WRL1145.tmp"
Wed 15 Mar 2006 27,648 ...H. --- "C:\Documents and Settings\jack\My Documents\THE THIEF\WORKING DOCS & ARCHIVE\~WRL1328.tmp"
Sat 11 Mar 2006 27,136 ...H. --- "C:\Documents and Settings\jack\My Documents\THE THIEF\WORKING DOCS & ARCHIVE\~WRL2158.tmp"
Wed 15 Mar 2006 27,648 ...H. --- "C:\Documents and Settings\jack\My Documents\THE THIEF\WORKING DOCS & ARCHIVE\~WRL3336.tmp"
Wed 15 Mar 2006 27,648 ...H. --- "C:\Documents and Settings\jack\My Documents\THE THIEF\WORKING DOCS & ARCHIVE\~WRL3375.tmp"
Wed 15 Mar 2006 27,648 ...H. --- "C:\Documents and Settings\jack\My Documents\THE THIEF\WORKING DOCS & ARCHIVE\~WRL3449.tmp"
Wed 15 Mar 2006 27,648 ...H. --- "C:\Documents and Settings\jack\My Documents\THE THIEF\WORKING DOCS & ARCHIVE\~WRL3766.tmp"
Thu 17 Apr 2008 2,044,416 ...H. --- "C:\Documents and Settings\jack\My Documents\ACADEMY\PROJECT MANAGEMENT\HANDOUTS\~WRL0712.tmp"
Wed 16 Apr 2008 2,044,928 ...H. --- "C:\Documents and Settings\jack\My Documents\ACADEMY\PROJECT MANAGEMENT\HANDOUTS\~WRL3322.tmp"
Thu 17 Apr 2008 2,045,440 ...H. --- "C:\Documents and Settings\jack\My Documents\ACADEMY\PROJECT MANAGEMENT\HANDOUTS\~WRL3714.tmp"
Mon 25 Oct 2004 123,904 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Admin\Fax\~WRL1998.tmp"
Tue 31 Aug 2004 30,720 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Admin\Labels\~WRL0005.tmp"
Fri 19 Sep 2003 30,208 A..H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\AVANT GARDE DESKTOP\ELECTRICAL\~WRL0002.tmp"
Wed 25 Feb 2004 68,096 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\CONTRACTS\5 Exhibit A\~WRL3499.tmp"
Fri 28 May 2004 138,752 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\CONTRACTS\6 Exhibit B-Scopes\~WRL0299.tmp"
Fri 28 May 2004 139,776 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\CONTRACTS\6 Exhibit B-Scopes\~WRL0376.tmp"
Fri 28 May 2004 137,216 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\CONTRACTS\6 Exhibit B-Scopes\~WRL0754.tmp"
Thu 27 May 2004 115,200 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\CONTRACTS\6 Exhibit B-Scopes\~WRL1432.tmp"
Fri 28 May 2004 136,704 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\CONTRACTS\6 Exhibit B-Scopes\~WRL1608.tmp"
Fri 28 May 2004 116,224 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\CONTRACTS\6 Exhibit B-Scopes\~WRL1780.tmp"
Fri 28 May 2004 138,752 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\CONTRACTS\6 Exhibit B-Scopes\~WRL2184.tmp"
Fri 28 May 2004 137,728 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\CONTRACTS\6 Exhibit B-Scopes\~WRL2222.tmp"
Fri 28 May 2004 139,264 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\CONTRACTS\6 Exhibit B-Scopes\~WRL2671.tmp"
Fri 28 May 2004 117,760 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\CONTRACTS\6 Exhibit B-Scopes\~WRL2835.tmp"
Fri 28 May 2004 117,248 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\CONTRACTS\6 Exhibit B-Scopes\~WRL3226.tmp"
Wed 12 Apr 2006 173,568 A..H. --- "C:\Documents and Settings\jack\My Documents\MISC PERSONAL\MISC WRITING\CHRISTIAN\~WRL1447.tmp"
Wed 12 Apr 2006 179,712 A..H. --- "C:\Documents and Settings\jack\My Documents\MISC PERSONAL\MISC WRITING\CHRISTIAN\~WRL2065.tmp"
Fri 9 Jun 2006 11,077,632 A..H. --- "C:\Documents and Settings\jack\My Documents\PICTURES\SHERI\SHERI-2\~WRL0064.tmp"
Fri 9 Jun 2006 6,526,464 A..H. --- "C:\Documents and Settings\jack\My Documents\PICTURES\SHERI\SHERI-2\~WRL1366.tmp"
Fri 9 Jun 2006 11,077,632 A..H. --- "C:\Documents and Settings\jack\My Documents\PICTURES\SHERI\SHERI-2\~WRL1551.tmp"
Sun 2 Apr 2006 70,144 A..H. --- "C:\Documents and Settings\jack\My Documents\THERAPIST SUBMISSION\ARCHIVE\Diane Martin I\~WRL1255.tmp"
Sun 2 Apr 2006 36,864 A..H. --- "C:\Documents and Settings\jack\My Documents\THERAPIST SUBMISSION\ARCHIVE\Diane Martin II\~WRL0001.tmp"
Fri 8 Dec 2006 37,376 A..H. --- "C:\Documents and Settings\jack\My Documents\THERAPIST SUBMISSION\ARCHIVE\Diane Martin II\~WRL0003.tmp"
Fri 8 Dec 2006 37,376 A..H. --- "C:\Documents and Settings\jack\My Documents\THERAPIST SUBMISSION\ARCHIVE\Diane Martin II\~WRL0005.tmp"
Sat 16 Dec 2006 84,480 A..H. --- "C:\Documents and Settings\jack\My Documents\THERAPIST SUBMISSION\ARCHIVE\Diane Martin II\~WRL0807.tmp"
Sat 16 Dec 2006 84,480 A..H. --- "C:\Documents and Settings\jack\My Documents\THERAPIST SUBMISSION\ARCHIVE\Diane Martin II\~WRL2134.tmp"
Sun 2 Apr 2006 68,608 A..H. --- "C:\Documents and Settings\jack\My Documents\THERAPIST SUBMISSION\ARCHIVE\Diane Martin II\~WRL2830.tmp"
Sun 2 Apr 2006 83,456 A..H. --- "C:\Documents and Settings\jack\My Documents\THERAPIST SUBMISSION\ARCHIVE\Diane Martin II\~WRL3414.tmp"
Fri 15 Aug 2003 47 A..H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\AVANT GARDE DESKTOP\ADMIN\Forms, Labels, Letterhead etc\ZDP04938.TMP"
Tue 20 Apr 2004 29,696 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL0001.tmp"
Mon 12 Apr 2004 26,112 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL0002.tmp"
Tue 20 Apr 2004 29,696 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL0012.tmp"
Tue 20 Apr 2004 30,720 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL0190.tmp"
Thu 27 May 2004 30,720 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL0427.tmp"
Tue 20 Apr 2004 29,696 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL0700.tmp"
Tue 20 Apr 2004 28,672 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL0839.tmp"
Tue 20 Apr 2004 30,208 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL0926.tmp"
Tue 20 Apr 2004 29,184 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL0992.tmp"
Tue 20 Apr 2004 29,696 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL0995.tmp"
Tue 20 Apr 2004 27,648 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL1053.tmp"
Tue 20 Apr 2004 30,720 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL1308.tmp"
Tue 20 Apr 2004 27,648 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL1687.tmp"
Tue 20 Apr 2004 29,696 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL1742.tmp"
Tue 20 Apr 2004 29,696 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL1836.tmp"
Tue 20 Apr 2004 29,696 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL1956.tmp"
Tue 20 Apr 2004 28,160 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL2158.tmp"
Tue 20 Apr 2004 30,720 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL2641.tmp"
Tue 20 Apr 2004 30,208 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL2911.tmp"
Tue 20 Apr 2004 30,720 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL2915.tmp"
Tue 20 Apr 2004 29,696 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL3175.tmp"
Tue 20 Apr 2004 27,136 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL3325.tmp"
Tue 20 Apr 2004 30,208 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL3414.tmp"
Tue 20 Apr 2004 30,208 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL3440.tmp"
Tue 20 Apr 2004 30,208 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL3897.tmp"
Tue 20 Apr 2004 29,696 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL3961.tmp"
Tue 20 Apr 2004 28,672 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Forms & Procedures\~WRL4096.tmp"
Mon 25 Oct 2004 34,816 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Reallocation Requests\~WRL0004.tmp"
Tue 18 May 2004 35,328 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Reallocation Requests\~WRL0893.tmp"
Mon 25 Oct 2004 34,304 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Reallocation Requests\~WRL1667.tmp"
Tue 18 May 2004 35,328 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Reallocation Requests\~WRL1801.tmp"
Tue 18 May 2004 34,816 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Bank\FIRST BANK - Construction Loan Draws\Reallocation Requests\~WRL1816.tmp"
Mon 6 Dec 2004 169,984 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Daily Log\LOGS\Dec\~WRL0004.tmp"
Wed 1 Nov 2006 75,264 A..H. --- "C:\Documents and Settings\jack\My Documents\THERAPIST SUBMISSION\ARCHIVE\2006-REWRITE\PART I-2006RW\~WRL0705.tmp"
Wed 1 Nov 2006 92,672 A..H. --- "C:\Documents and Settings\jack\My Documents\THERAPIST SUBMISSION\ARCHIVE\2006-REWRITE\PART I-2006RW\~WRL2248.tmp"
Tue 10 Aug 2004 180,736 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\1 ALLEN\THE ATLANTIS PROJECT\Phase One\Transmittals\~WRL0002.tmp"
Wed 26 Nov 2003 19,456 A..H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\AVANT GARDE DESKTOP\ADMIN\Financial\J&C INVOICES\~WRL0003.tmp"
Wed 26 Nov 2003 19,968 A..H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\AVANT GARDE DESKTOP\ADMIN\Financial\J&C INVOICES\~WRL0005.tmp"
Wed 26 Nov 2003 19,968 A..H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\AVANT GARDE DESKTOP\ADMIN\Financial\J&C INVOICES\~WRL1376.tmp"
Wed 26 Nov 2003 19,968 A..H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\AVANT GARDE DESKTOP\ADMIN\Financial\J&C INVOICES\~WRL2798.tmp"
Sun 5 Dec 2004 428,032 A..H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\AVANT GARDE DESKTOP\ADMIN\HR\Patty Folder\~WRL0333.tmp"
Sun 5 Dec 2004 428,032 A..H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\AVANT GARDE DESKTOP\ADMIN\HR\Patty Folder\~WRL3153.tmp"
Mon 6 Dec 2004 20,992 A..H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\AVANT GARDE DESKTOP\INVESTOR BROCHURE\Portfolio\ATLANTIS I\~WRL0005.tmp"
Mon 6 Dec 2004 20,992 A..H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\AVANT GARDE DESKTOP\INVESTOR BROCHURE\Portfolio\ATLANTIS I\~WRL3879.tmp"
Mon 6 Dec 2004 20,992 A..H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\AVANT GARDE DESKTOP\INVESTOR BROCHURE\Portfolio\ATLANTIS II\~WRL1273.tmp"
Mon 6 Dec 2004 20,992 A..H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\AVANT GARDE DESKTOP\INVESTOR BROCHURE\Portfolio\ATLANTIS II\~WRL1560.tmp"
Sat 18 Dec 2004 623,104 A..H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\AVANT GARDE DESKTOP\INVESTOR BROCHURE\Portfolio\ATLANTIS II\~WRL3572.tmp"
Tue 10 Aug 2004 65,024 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Daily Log\LOGS\Mayjunjulaug\August\~WRL1080.tmp"
Tue 10 Aug 2004 64,512 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Daily Log\LOGS\Mayjunjulaug\August\~WRL3375.tmp"
Fri 19 Nov 2004 169,984 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Daily Log\LOGS\SeptOctNov\Nov\~WRL0004.tmp"
Mon 22 Nov 2004 169,984 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Daily Log\LOGS\SeptOctNov\Nov\~WRL3045.tmp"
Wed 8 Sep 2004 63,488 ...H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\Daily Log\LOGS\SeptOctNov\Sept\~WRL1413.tmp"
Thu 21 Aug 2003 19,456 A..H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\AVANT GARDE DESKTOP\AUTOCAD DRAWINGS\ARCHIVE\Electrical\REDLINE VERSIONS\JOSE-FIRST DRAFT\~WRL0760.tmp"
Wed 13 Aug 2003 25,088 A..H. --- "C:\Documents and Settings\jack\My Documents\AVANTGARDE\AVANT GARDE DESKTOP\AUTOCAD DRAWINGS\ARCHIVE\Electrical\REDLINE VERSIONS\JOSE-FIRST DRAFT\~WRL1280.tmp"

Finished!

Blade81
2008-04-19, 23:01
Hi

Please post a fresh hjt log too.

Blade81
2008-04-27, 01:07
Due to inactivity, this thread will now be closed.

Note:If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than five days since your last response and you need the thread re-opened, please send me or your helper a private message (pm). A valid, working link to the closed topic is required.