From owner-freebsd-questions@FreeBSD.ORG Tue Aug 3 10:22:50 2010 Return-Path: Delivered-To: questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 43C24106566C for ; Tue, 3 Aug 2010 10:22:50 +0000 (UTC) (envelope-from alexk@specialisterren.nl) Received: from mail-ew0-f54.google.com (mail-ew0-f54.google.com [209.85.215.54]) by mx1.freebsd.org (Postfix) with ESMTP id 4DE638FC12 for ; Tue, 3 Aug 2010 10:22:48 +0000 (UTC) Received: by ewy26 with SMTP id 26so1803220ewy.13 for ; Tue, 03 Aug 2010 03:22:48 -0700 (PDT) Received: by 10.213.36.18 with SMTP id r18mr659000ebd.74.1280830967990; Tue, 03 Aug 2010 03:22:47 -0700 (PDT) Received: from [192.168.0.117] ([188.201.152.137]) by mx.google.com with ESMTPS id z55sm10533701eeh.21.2010.08.03.03.22.26 (version=TLSv1/SSLv3 cipher=RC4-MD5); Tue, 03 Aug 2010 03:22:47 -0700 (PDT) Message-ID: <4C57EDE9.1070609@specialisterren.nl> Date: Tue, 03 Aug 2010 12:22:33 +0200 From: Alex de Kruijff User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.9.1.11) Gecko/20100711 Lightning/1.0b1 Thunderbird/3.0.6 MIME-Version: 1.0 To: David N References: <4C56ACE0.2050403@specialisterren.nl> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: questions@freebsd.org, akruijff@dds.nl Subject: Re: Samba PDC roaming profiles problem X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 03 Aug 2010 10:22:50 -0000 Have you installed /usr/ports/net/smbldap-tools/, although you dont > need it, it helps when creating users. > > Do you have > sambaProfilePath in your ldap? > > Regards > I've enabled debugging in Windows Domain using: http://support.microsoft.com/default.aspx?scid=kb;en-us;221833 I find it strange that it first tries \\%L\profiles\testers. This is the log. USERENV(2ec.2f0) 12:08:35:468 LoadUserProfile: Entering, hToken = <0x960>, lpProfileInfo = 0x6e3e0 USERENV(2ec.2f0) 12:08:35:468 LoadUserProfile: lpProfileInfo->dwFlags = <0x0> USERENV(2ec.2f0) 12:08:35:468 LoadUserProfile: lpProfileInfo->lpUserName = USERENV(2ec.2f0) 12:08:35:484 LoadUserProfile: lpProfileInfo->lpProfilePath = <\\%L\profiles\tester> USERENV(2ec.2f0) 12:08:35:484 LoadUserProfile: lpProfileInfo->lpDefaultPath = <\\SERVER\netlogon\Default User> USERENV(2ec.2f0) 12:08:35:484 LoadUserProfile: NULL server name USERENV(2ec.2f0) 12:08:35:484 LoadUserProfile: In console winlogon process USERENV(2ec.2f0) 12:08:35:484 In LoadUserProfileP USERENV(2ec.2f0) 12:08:35:500 ========================================================= USERENV(2ec.2f0) 12:08:35:500 LoadUserProfile: Entering, hToken = <0x960>, lpProfileInfo = 0x6e3e0 USERENV(2ec.2f0) 12:08:35:500 LoadUserProfile: lpProfileInfo->dwFlags = <0x0> USERENV(2ec.2f0) 12:08:35:500 LoadUserProfile: lpProfileInfo->lpUserName = USERENV(2ec.2f0) 12:08:35:515 LoadUserProfile: lpProfileInfo->lpProfilePath = <\\%L\profiles\tester> USERENV(2ec.2f0) 12:08:35:515 LoadUserProfile: lpProfileInfo->lpDefaultPath = <\\SERVER\netlogon\Default User> USERENV(2ec.2f0) 12:08:35:515 LoadUserProfile: NULL server name USERENV(2ec.2f0) 12:08:35:515 LoadUserProfile: User sid: S-1-5-21-914212253-3526360373-1445599473-21010 USERENV(2ec.2f0) 12:08:35:531 CSyncManager::EnterLock USERENV(2ec.2f0) 12:08:35:531 CSyncManager::EnterLock: No existing entry found USERENV(2ec.2f0) 12:08:35:531 CSyncManager::EnterLock: New entry created USERENV(2ec.2f0) 12:08:35:531 CHashTable::HashAdd: S-1-5-21-914212253-3526360373-1445599473-21010 added in bucket 7 USERENV(2ec.2f0) 12:08:35:546 LoadUserProfile: Wait succeeded. In critical section. USERENV(2ec.2f0) 12:08:35:546 GetUserGuid: Failed to get user guid with 1355. USERENV(2ec.2f0) 12:08:35:562 GetProfileSid: No Guid -> Sid Mapping available USERENV(2ec.2f0) 12:08:35:562 GetUserGuid: Failed to get user guid with 1355. USERENV(2ec.2f0) 12:08:35:562 GetProfileSid: No Guid -> Sid Mapping available USERENV(2ec.2f0) 12:08:35:562 LoadUserProfile: Expanded profile path is \\%L\profiles\tester USERENV(2ec.2f0) 12:08:35:578 ParseProfilePath: Entering, lpProfilePath = <\\%L\profiles\tester> USERENV(2ec.2f0) 12:08:35:578 CheckXForestLogon: checking x-forest logon, user handle = 2400 USERENV(2ec.2f0) 12:08:35:578 CheckXForestLogon: Stand-alone or NT4 domain, not x-forest logon. USERENV(2ec.2f0) 12:08:40:078 AbleToBypassCSC: Try to bypass CSC USERENV(2ec.2f0) 12:08:40:078 AbleToBypassCSC: tried NPAddConnection3ForCSCAgent. Error 53 USERENV(2ec.2f0) 12:08:44:578 ParseProfilePath: CSC bypassed failed. Ignoring Roaming profile path USERENV(2ec.2f0) 12:08:44:578 ReportError: Impersonating user. USERENV(2ec.2f0) 12:08:44:578 ReportError: Logging Error USERENV(2ec.2f0) 12:08:44:578 ErrorDialogEx: Calling DialogBoxParam USERENV(2ec.2f0) 12:08:44:593 ErrorDlgProc:: DialogBoxParam USERENV(2ec.2f0) 12:08:47:171 LoadUserProfile: ParseProfilePath returned a directory of <> USERENV(2ec.2f0) 12:08:47:171 RestoreUserProfile: Entering USERENV(2ec.2f0) 12:08:47:171 IsCentralProfileReachable: Entering USERENV(2ec.2f0) 12:08:47:187 IsCentralProfileReachable: Null path. Leaving USERENV(2ec.2f0) 12:08:47:187 RestoreUserProfile: Profile path = <> USERENV(2ec.2f0) 12:08:47:187 ExtractProfileFromBackup: Failed to open key Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-914212253-3526360373-14455994 73-21010 with error 2 USERENV(2ec.2f0) 12:08:47:187 ExtractProfileFromBackup: Couldn't open backup profile key. Error = 2 USERENV(2ec.2f0) 12:08:47:203 GetUserGuid: Failed to get user guid with 1355. USERENV(2ec.2f0) 12:08:47:203 PatchNewProfileIfRequred: No OldSidString found USERENV(2ec.2f0) 12:08:47:203 IsTempProfileAllowed: Returning 1 USERENV(2ec.2f0) 12:08:47:203 CreateLocalProfileKey: Not setting additional Security USERENV(2ec.2f0) 12:08:47:218 CreateLocalProfileImage: One way or another we haven't got an existing local profile, try and create one USERENV(2ec.2f0) 12:08:47:218 CreateSecureDirectory: Entering with USERENV(2ec.2f0) 12:08:47:218 CreateSecureDirectory: Created the directory USERENV(2ec.2f0) 12:08:47:218 ComputeLocalProfileName: generated the profile directory USERENV(2ec.2f0) 12:08:47:234 ReportError: Impersonating user. USERENV(2ec.2f0) 12:08:47:234 ReportError: Logging Error USERENV(2ec.2f0) 12:08:47:234 ErrorDialogEx: Calling DialogBoxParam USERENV(2ec.2f0) 12:08:47:234 ErrorDlgProc:: DialogBoxParam USERENV(2ec.2f0) 12:08:47:593 Local profile name is USERENV(2ec.2f0) 12:08:47:593 RestoreUserProfile: Working with a new user. Go straight to issuing a default profile. USERENV(2ec.2f0) 12:08:47:593 RestoreUserProfile: Issuing default profile USERENV(2ec.2f0) 12:08:47:609 CheckNetDefaultProfile: Entering, lpNetPath = <\\SERVER\netlogon\Default User> USERENV(2ec.2f0) 12:08:47:609 CheckXForestLogon: checking x-forest logon, user handle = 2400 USERENV(2ec.2f0) 12:08:47:609 CheckXForestLogon: Stand-alone or NT4 domain, not x-forest logon. USERENV(2ec.2f0) 12:08:47:765 CheckNetDefaultProfile: Found a valid network profile. USERENV(2ec.2f0) 12:08:47:765 CheckNetDefaultProfile: setting default profile to <\\SERVER\netlogon\Default User> USERENV(2ec.2f0) 12:08:47:765 CheckNetDefaultProfile: Removing local copy of network default user profile. USERENV(2ec.2f0) 12:08:47:781 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\Default User (Network)> USERENV(2ec.2f0) 12:08:47:781 CheckNetDefaultProfile: Leaving with a value of 1. USERENV(2ec.2f0) 12:08:47:781 IssueDefaultProfile: Entering. lpDefaultProfile = <\\SERVER\netlogon\Default User> lpLocalProfile = USERENV(2ec.2f0) 12:08:47:781 CopyProfileDirectoryEx: Entering, lpSourceDir = <\\SERVER\netlogon\Default User>, lpDestinationDir = , dwFlags = 0xc8103 USERENV(2ec.2f0) 12:08:47:796 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Templates\ to the list of directories USERENV(2ec.2f0) 12:08:47:796 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Start Menu\Programs\Startup\ to the list of directories USERENV(2ec.2f0) 12:08:47:812 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Start Menu\Programs\Accessories\Entertainment\ to the list of directories USERENV(2ec.2f0) 12:08:47:812 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Start Menu\Programs\Accessories\Accessibility\ to the list of directories USERENV(2ec.2f0) 12:08:47:828 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Start Menu\Programs\Accessories\ to the list of directories USERENV(2ec.2f0) 12:08:47:828 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Start Menu\Programs\ to the list of directories USERENV(2ec.2f0) 12:08:47:828 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Start Menu\ to the list of directories USERENV(2ec.2f0) 12:08:47:828 RecurseDirectory: Adding \\SERVER\netlogon\Default User\SendTo\ to the list of directories USERENV(2ec.2f0) 12:08:47:843 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Recent\ to the list of directories USERENV(2ec.2f0) 12:08:47:843 RecurseDirectory: Adding \\SERVER\netlogon\Default User\PrintHood\ to the list of directories USERENV(2ec.2f0) 12:08:47:843 RecurseDirectory: Adding \\SERVER\netlogon\Default User\NetHood\ to the list of directories USERENV(2ec.2f0) 12:08:47:859 RecurseDirectory: Adding \\SERVER\netlogon\Default User\My Documents\ to the list of directories USERENV(2ec.2f0) 12:08:47:859 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Local Settings\Temporary Internet Files\Content.IE5\MHKG8I59\ to the list of directories USERENV(2ec.2f0) 12:08:47:875 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Local Settings\Temporary Internet Files\Content.IE5\JPE64RK5\ to the list of directories USERENV(2ec.2f0) 12:08:47:875 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Local Settings\Temporary Internet Files\Content.IE5\FMP7MR2X\ to the list of directories USERENV(2ec.2f0) 12:08:47:875 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Local Settings\Temporary Internet Files\Content.IE5\0CH4UJGO\ to the list of directories USERENV(2ec.2f0) 12:08:47:890 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Local Settings\Temporary Internet Files\Content.IE5\ to the list of directories USERENV(2ec.2f0) 12:08:47:890 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Local Settings\Temporary Internet Files\ to the list of directories USERENV(2ec.2f0) 12:08:47:890 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Local Settings\Temp\ to the list of directories USERENV(2ec.2f0) 12:08:47:906 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Local Settings\History\History.IE5\ to the list of directories USERENV(2ec.2f0) 12:08:47:906 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Local Settings\History\ to the list of directories USERENV(2ec.2f0) 12:08:47:921 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\ to the list of directories USERENV(2ec.2f0) 12:08:47:921 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Local Settings\Application Data\Microsoft\Windows Media\ to the list of directories USERENV(2ec.2f0) 12:08:47:921 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Local Settings\Application Data\Microsoft\Media Player\ to the list of directories USERENV(2ec.2f0) 12:08:47:921 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Local Settings\Application Data\Microsoft\ to the list of directories USERENV(2ec.2f0) 12:08:47:937 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Local Settings\Application Data\ to the list of directories USERENV(2ec.2f0) 12:08:47:937 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Local Settings\ to the list of directories USERENV(2ec.2f0) 12:08:47:937 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Favorites\ to the list of directories USERENV(2ec.2f0) 12:08:47:953 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Desktop\ to the list of directories USERENV(2ec.2f0) 12:08:47:953 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Cookies\ to the list of directories USERENV(2ec.2f0) 12:08:47:968 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\ to the list of directories USERENV(2ec.2f0) 12:08:47:968 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\ to the list of directories USERENV(2ec.2f0) 12:08:47:968 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\ to the list of directories USERENV(2ec.2f0) 12:08:47:968 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Application Data\Microsoft\SystemCertificates\My\ to the list of directories USERENV(2ec.2f0) 12:08:47:984 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Application Data\Microsoft\SystemCertificates\ to the list of directories USERENV(2ec.2f0) 12:08:47:984 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Application Data\Microsoft\Media Player\ to the list of directories USERENV(2ec.2f0) 12:08:47:984 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Application Data\Microsoft\Internet Explorer\ to the list of directories USERENV(2ec.2f0) 12:08:48:000 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Application Data\Microsoft\ to the list of directories USERENV(2ec.2f0) 12:08:48:000 RecurseDirectory: Adding \\SERVER\netlogon\Default User\Application Data\ to the list of directories USERENV(2ec.2f0) 12:08:48:000 FindTotalDiskSpaceNeeded: Largest 7 file size is 817136 USERENV(2ec.2f0) 12:08:48:000 Available -497418240 USERENV(2ec.2f0) 12:08:48:015 Needed 2130869 USERENV(2ec.2f0) 12:08:48:015 Src size 1120018 USERENV(2ec.2f0) 12:08:48:015 Dest size 0 USERENV(2ec.2f0) 12:08:48:015 Largest hive file 262144 USERENV(2ec.2f0) 12:08:48:031 CopyProfileDirectoryEx: Found hive file NTUSER.DAT USERENV(2ec.2f0) 12:08:48:125 ReconcileFile: \\SERVER\netlogon\Default User\NTUSER.DAT ==> C:\Documents and Settings\TEMP\NTUSER.DAT [OK] USERENV(2ec.2f0) 12:08:48:125 CopyProfileDirectoryEx: Found hive file Ntuser.dat.LOG USERENV(2ec.2f0) 12:08:48:187 ReconcileFile: \\SERVER\netlogon\Default User\Ntuser.dat.LOG ==> C:\Documents and Settings\TEMP\Ntuser.dat.LOG [OK] USERENV(2ec.2f0) 12:08:48:187 CopyProfileDirectoryEx: Calling ReconcileDirectory for all Directories USERENV(2ec.2f0) 12:08:48:500 CopyProfileDirectoryEx: Reconcile Directory Done for all Directories USERENV(2ec.8d8) 12:08:48:531 ReconcileFile: \\SERVER\netlogon\Default User\Cookies\index.dat ==> C:\Documents and Settings\TEMP\Cookies\index.dat [OK] USERENV(2ec.310) 12:08:48:578 ReconcileFile: \\SERVER\netlogon\Default User\Application Data\desktop.ini ==> C:\Documents and Settings\TEMP\Application Data\desktop.ini [OK] USERENV(2ec.8d4) 12:08:48:593 ReconcileFile: \\SERVER\netlogon\Default User\Local Settings\History\History.IE5\index.dat ==> C:\Documents and Settings\TEMP\Local Settings\History\History.IE5\index.dat [OK] USERENV(2ec.a24) 12:08:48:609 ReconcileFile: \\SERVER\netlogon\Default User\Local Settings\Temporary Internet Files\Content.IE5\0CH4UJGO\desktop.ini ==> C:\Documents and Settings\TEMP\Local Settings\Temporary Internet Files\Content.IE5\0CH4UJGO\desktop.ini [OK] USERENV(2ec.a24) 12:08:48:625 ReconcileFile: \\SERVER\netlogon\Default User\SendTo\Mail Recipient.MAPIMail ==> C:\Documents and Settings\TEMP\SendTo\Mail Recipient.MAPIMail [OK] USERENV(2ec.580) 12:08:48:687 ReconcileFile: \\SERVER\netlogon\Default User\Local Settings\desktop.ini ==> C:\Documents and Settings\TEMP\Local Settings\desktop.ini [OK] USERENV(2ec.8d8) 12:08:48:734 ReconcileFile: \\SERVER\netlogon\Default User\Start Menu\Programs\Accessories\Accessibility\desktop.ini ==> C:\Documents and Settings\TEMP\Start Menu\Programs\Accessories\Accessibility\desktop.ini [OK] USERENV(2ec.310) 12:08:48:812 ReconcileFile: \\SERVER\netlogon\Default User\Start Menu\Programs\Accessories\Entertainment\Windows Media Player.lnk ==> C:\Documents and Settings\TEMP\Start Menu\Programs\Accessories\Entertainment\Windows Media Player.lnk [OK] USERENV(2ec.8d8) 12:08:48:843 ReconcileFile: \\SERVER\netlogon\Default User\Start Menu\Programs\Accessories\Command Prompt.lnk ==> C:\Documents and Settings\TEMP\Start Menu\Programs\Accessories\Command Prompt.lnk [OK] USERENV(2ec.a24) 12:08:48:906 ReconcileFile: \\SERVER\netlogon\Default User\Start Menu\Programs\Accessories\desktop.ini ==> C:\Documents and Settings\TEMP\Start Menu\Programs\Accessories\desktop.ini [OK] USERENV(2ec.8d4) 12:08:48:921 ReconcileFile: \\SERVER\netlogon\Default User\Start Menu\Programs\desktop.ini ==> C:\Documents and Settings\TEMP\Start Menu\Programs\desktop.ini [OK] USERENV(2ec.efc) 12:08:48:937 ReconcileFile: \\SERVER\netlogon\Default User\Templates\wordpfct.wpg ==> C:\Documents and Settings\TEMP\Templates\wordpfct.wpg [OK] USERENV(2ec.8d8) 12:08:48:953 ReconcileFile: \\SERVER\netlogon\Default User\Templates\winword2.doc ==> C:\Documents and Settings\TEMP\Templates\winword2.doc [OK] USERENV(2ec.8d4) 12:08:48:984 ReconcileFile: \\SERVER\netlogon\Default User\Templates\lotus.wk4 ==> C:\Documents and Settings\TEMP\Templates\lotus.wk4 [OK] USERENV(2ec.a24) 12:08:49:000 ReconcileFile: \\SERVER\netlogon\Default User\Templates\excel4.xls ==> C:\Documents and Settings\TEMP\Templates\excel4.xls [OK] USERENV(2ec.8d8) 12:08:49:000 ReconcileFile: \\SERVER\netlogon\Default User\Templates\amipro.sam ==> C:\Documents and Settings\TEMP\Templates\amipro.sam [OK] USERENV(2ec.2f0) 12:08:49:000 CopyProfileDirectoryEx: Setting Directory TimeStamps all Directories USERENV(2ec.2f0) 12:08:49:031 CopyProfileDirectoryEx: Set times on all directories USERENV(2ec.2f0) 12:08:49:031 CopyProfileDirectoryEx: Leaving with a return value of 1 USERENV(2ec.2f0) 12:08:49:046 MyRegLoadKey: Returning 00000000 USERENV(2ec.2f0) 12:08:49:046 IssueDefaultProfile: Leaving successfully USERENV(2ec.2f0) 12:08:49:046 RestoreUserProfile: Successfully setup the specified default. USERENV(2ec.2f0) 12:08:49:046 SetupNewHive: Entering USERENV(2ec.2f0) 12:08:49:062 SetDefaultUserHiveSecurity: Entering USERENV(2ec.2f0) 12:08:49:093 SecureUserKey: Entering USERENV(2ec.2f0) 12:08:49:109 SecureUserKey: Leaving with a return value of 1 USERENV(2ec.2f0) 12:08:49:109 SecureUserKey: Entering USERENV(2ec.2f0) 12:08:49:109 SecureUserKey: Leaving with a return value of 1 USERENV(2ec.2f0) 12:08:49:671 SetupNewHive: Leaving with a return value of 1 USERENV(2ec.2f0) 12:08:49:671 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(2ec.2f0) 12:08:49:890 MyRegLoadKey: Returning 00000000 USERENV(2ec.2f0) 12:08:49:890 CreateClassHive: existing user classes hive not found USERENV(2ec.2f0) 12:08:49:890 SetDefaultUserHiveSecurity: Entering USERENV(2ec.2f0) 12:08:49:921 RestoreUserProfile: About to Leave. Final Information follows: USERENV(2ec.2f0) 12:08:49:921 Profile was successfully loaded. USERENV(2ec.2f0) 12:08:49:937 lpProfile->lpRoamingProfile = <> USERENV(2ec.2f0) 12:08:49:937 lpProfile->lpLocalProfile = USERENV(2ec.2f0) 12:08:49:937 lpProfile->dwInternalFlags = 0xa04 USERENV(2ec.2f0) 12:08:49:953 RestoreUserProfile: Leaving. USERENV(2ec.2f0) 12:08:49:968 UpgradeProfile: Entering USERENV(2ec.2f0) 12:08:49:968 UpgradeProfile: Build numbers match USERENV(2ec.2f0) 12:08:49:968 UpgradeProfile: Leaving Successfully USERENV(2ec.2f0) 12:08:49:984 Profile Ref Count is 1 USERENV(2ec.2f0) 12:08:49:984 LoadUserProfile: Leaving critical Section. USERENV(2ec.2f0) 12:08:50:000 CSyncManager::LeaveLock USERENV(2ec.2f0) 12:08:50:062 CSyncManager::LeaveLock: Lock released USERENV(2ec.2f0) 12:08:50:062 CHashTable::HashDelete: S-1-5-21-914212253-3526360373-1445599473-21010 deleted USERENV(2ec.2f0) 12:08:50:062 CSyncManager::LeaveLock: Lock deleted USERENV(2ec.2f0) 12:08:50:078 LoadUserProfile: Impersonated user: 00000960, 00000000 USERENV(2ec.2f0) 12:08:50:078 LoadUserProfile: Reverted to user: 00000000 USERENV(2ec.2f0) 12:08:50:093 LoadUserProfile: Leaving with a value of 1. USERENV(2ec.2f0) 12:08:50:093 ========================================================= USERENV(2ec.2f0) 12:08:50:093 LoadUserProfile: LoadUserProfileP succeeded USERENV(2ec.2f0) 12:08:50:093 LoadUserProfile: Returning success. Final Information follows: USERENV(2ec.2f0) 12:08:50:109 lpProfileInfo->UserName = USERENV(2ec.2f0) 12:08:50:109 lpProfileInfo->lpProfilePath = <\\%L\profiles\tester> USERENV(2ec.2f0) 12:08:50:125 lpProfileInfo->dwFlags = 0x0 USERENV(2ec.2f0) 12:08:50:125 LoadUserProfile: Returning TRUE. hProfile = <0x7e8> USERENV(2ec.2f0) 12:08:50:125 ApplySystemPolicy: Entering USERENV(2ec.2f0) 12:08:50:125 ApplySystemPolicy: PolicyPath is: <\\SERVER\netlogon\ntconfig.pol>. USERENV(2ec.2f0) 12:08:50:140 ApplySystemPolicy: No policy file. USERENV(2ec.2f0) 12:08:50:140 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(2ec.2f0) 12:08:50:171 IsSyncForegroundPolicyRefresh: Synchronous, Reason: FirstPolicyRefresh USERENV(2ec.fa8) 12:08:50:187 IsSyncForegroundPolicyRefresh: Synchronous, Reason: FirstPolicyRefresh USERENV(f8c.c44) 12:08:50:234 LibMain: Process Name: C:\WINDOWS\system32\SearchFilterHost.exe USERENV(2ec.fa8) 12:08:50:671 ApplyGroupPolicy: Entering. Flags = 2 USERENV(2ec.fa8) 12:08:50:671 ProcessGPOs: USERENV(2ec.fa8) 12:08:50:671 ProcessGPOs: USERENV(2ec.fa8) 12:08:50:671 ProcessGPOs: Starting user Group Policy (Background) processing... USERENV(2ec.fa8) 12:08:50:687 ProcessGPOs: USERENV(2ec.fa8) 12:08:50:687 ProcessGPOs: USERENV(2ec.fa8) 12:08:50:687 EnterCriticalPolicySectionEx: Entering with timeout 600000 and flags 0x0 USERENV(2ec.fa8) 12:08:50:703 EnterCriticalPolicySectionEx: User critical section has been claimed. Handle = 0x844 USERENV(2ec.fa8) 12:08:50:703 EnterCriticalPolicySectionEx: Leaving successfully. USERENV(2ec.fa8) 12:08:50:703 ProcessGPOs: Machine role is 1. USERENV(2ec.fa8) 12:08:50:703 ReadGPExtensions: Rsop entry point not found for gptext.dll. USERENV(2ec.fa8) 12:08:50:718 ReadGPExtensions: Rsop entry point not found for dskquota.dll. USERENV(2ec.fa8) 12:08:50:718 ReadGPExtensions: Rsop entry point not found for gptext.dll. USERENV(2ec.fa8) 12:08:50:718 ReadGPExtensions: Rsop entry point not found for C:\WINDOWS\system32\iedkcs32.dll. USERENV(2ec.fa8) 12:08:50:734 ReadGPExtensions: Rsop entry point not found for C:\WINDOWS\System32\srchadmin.dll. USERENV(2ec.fa8) 12:08:50:734 ReadGPExtensions: Rsop entry point not found for C:\WINDOWS\system32\iedkcs32.dll. USERENV(2ec.fa8) 12:08:50:734 ReadGPExtensions: Rsop entry point not found for scecli.dll. USERENV(2ec.fa8) 12:08:50:734 ReadGPExtensions: Rsop entry point not found for C:\WINDOWS\System32\cscui.dll. USERENV(2ec.fa8) 12:08:50:750 ReadGPExtensions: Rsop entry point not found for C:\WINDOWS\system32\iedkcs32.dll. USERENV(2ec.fa8) 12:08:50:750 ReadGPExtensions: Rsop entry point not found for gptext.dll. USERENV(2ec.fa8) 12:08:50:750 ReadExtStatus: Reading Previous Status for extension {35378EAC-683F-11D2-A89A-00C04FBBCFA2} USERENV(2ec.fa8) 12:08:50:750 ReadExtStatus: Reading Previous Status for extension {0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63} USERENV(2ec.fa8) 12:08:50:765 ReadExtStatus: Reading Previous Status for extension {25537BA6-77A8-11D2-9B6C-0000F8080861} USERENV(2ec.fa8) 12:08:50:765 ReadExtStatus: Reading Previous Status for extension {3610eda5-77ef-11d2-8dc5-00c04fa31a66} USERENV(2ec.fa8) 12:08:50:765 ReadExtStatus: Reading Previous Status for extension {426031c0-0b47-4852-b0ca-ac3d37bfcb39} USERENV(2ec.fa8) 12:08:50:765 ReadExtStatus: Reading Previous Status for extension {42B5FAAE-6536-11d2-AE5A-0000F87571E3} USERENV(2ec.fa8) 12:08:50:781 ReadExtStatus: Reading Previous Status for extension {4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3} USERENV(2ec.fa8) 12:08:50:781 ReadExtStatus: Reading Previous Status for extension {7933F41E-56F8-41d6-A31C-4148A711EE93} USERENV(2ec.fa8) 12:08:50:781 ReadExtStatus: Reading Previous Status for extension {7B849a69-220F-451E-B3FE-2CB811AF94AE} USERENV(2ec.fa8) 12:08:50:796 ReadExtStatus: Reading Previous Status for extension {827D319E-6EAC-11D2-A4EA-00C04F79F83A} USERENV(2ec.fa8) 12:08:50:796 ReadExtStatus: Reading Previous Status for extension {A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B} USERENV(2ec.fa8) 12:08:50:796 ReadExtStatus: Reading Previous Status for extension {B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A} USERENV(2ec.fa8) 12:08:50:796 ReadExtStatus: Reading Previous Status for extension {B587E2B1-4D59-4e7e-AED9-22B9DF11D053} USERENV(2ec.fa8) 12:08:50:812 ReadExtStatus: Reading Previous Status for extension {C631DF4C-088F-4156-B058-4375F0853CD8} USERENV(2ec.fa8) 12:08:50:812 ReadExtStatus: Reading Previous Status for extension {c6dc5466-785a-11d2-84d0-00c04fb169f7} USERENV(2ec.fa8) 12:08:50:812 ReadExtStatus: Reading Previous Status for extension {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D} USERENV(2ec.fa8) 12:08:50:812 ReadExtStatus: Reading Previous Status for extension {e437bc1c-aa7d-11d2-a382-00c04f991e27} USERENV(2ec.fa8) 12:08:50:828 ProcessGPOs: No site name defined. Skipping site policy. USERENV(2ec.fa8) 12:08:50:828 ProcessGPOs: Calling GetGPOInfo for normal policy mode USERENV(2ec.fa8) 12:08:50:828 GetGPOInfo: ******************************** USERENV(2ec.fa8) 12:08:50:843 GetGPOInfo: Entering... USERENV(2ec.fa8) 12:08:50:843 GetGPOInfo: lpHostName or lpDNName is NULL. Skipping DS stuff. USERENV(2ec.fa8) 12:08:50:843 GetGPOInfo: GPO Local Group Policy doesn't contain any data since the version number is 0. It will be skipped. USERENV(2ec.fa8) 12:08:50:843 GetGPOInfo: Leaving with 1 USERENV(2ec.fa8) 12:08:50:859 GetGPOInfo: ******************************** USERENV(2ec.fa8) 12:08:50:859 ProcessGPOs: Logging Data for Target . USERENV(2ec.fa8) 12:08:50:875 GetWbemServices: CoCreateInstance succeeded USERENV(2ec.fa8) 12:08:50:890 ConnectToNameSpace: ConnectServer returned 0x0 USERENV(2ec.fa8) 12:08:50:921 LogExtSessionStatus: Successfully logged Extension Session data USERENV(2ec.fa8) 12:08:50:921 CSessionLogger::Log: logging new security grps USERENV(2ec.fa8) 12:08:50:937 CSessionLogger::Log: new Site is NULL USERENV(2ec.fa8) 12:08:50:953 LogRsopData: Successfully logged Rsop data USERENV(2ec.fa8) 12:08:50:953 ProcessGPOs: Logged Rsop Data successfully. USERENV(2ec.fa8) 12:08:50:984 ProcessGPOs: OpenThreadToken failed with error 1008, assuming thread is not impersonating USERENV(2ec.fa8) 12:08:50:984 ProcessGPOs: ----------------------- USERENV(2ec.fa8) 12:08:51:000 ProcessGPOs: Processing extension Registry USERENV(2ec.fa8) 12:08:51:000 CompareGPOLists: The lists are the same. USERENV(2ec.fa8) 12:08:51:000 ProcessGPOs: Extension Registry skipped because both deleted and changed GPO lists are empty. USERENV(2ec.fa8) 12:08:51:015 ProcessGPOs: ----------------------- USERENV(2ec.fa8) 12:08:51:015 ProcessGPOs: Processing extension Wireless USERENV(2ec.fa8) 12:08:51:015 CompareGPOLists: The lists are the same. USERENV(2ec.fa8) 12:08:51:031 ProcessGPOs: Extension Wireless skipped with flags 0x2. USERENV(2ec.fa8) 12:08:51:031 ProcessGPOs: ----------------------- USERENV(2ec.fa8) 12:08:51:031 ProcessGPOs: Processing extension Folder Redirection USERENV(2ec.fa8) 12:08:51:031 CompareGPOLists: The lists are the same. USERENV(2ec.fa8) 12:08:51:046 CompareGPOLists: The lists are the same. USERENV(2ec.fa8) 12:08:51:046 ProcessGPOs: Extension Folder Redirection skipped because both deleted and changed GPO lists are empty. USERENV(2ec.fa8) 12:08:51:046 ProcessGPOs: ----------------------- USERENV(2ec.fa8) 12:08:51:046 ProcessGPOs: Processing extension Microsoft Disk Quota USERENV(2ec.fa8) 12:08:51:062 CompareGPOLists: The lists are the same. USERENV(2ec.fa8) 12:08:51:062 ProcessGPOs: Extension Microsoft Disk Quota skipped with flags 0x2. USERENV(2ec.fa8) 12:08:51:062 ProcessGPOs: ----------------------- USERENV(2ec.fa8) 12:08:51:078 ProcessGPOs: Processing extension QoS Packet Scheduler USERENV(2ec.fa8) 12:08:51:078 CompareGPOLists: The lists are the same. USERENV(2ec.fa8) 12:08:51:078 ProcessGPOs: Extension QoS Packet Scheduler skipped with flags 0x2. USERENV(2ec.fa8) 12:08:51:078 ProcessGPOs: ----------------------- USERENV(2ec.fa8) 12:08:51:093 ProcessGPOs: Processing extension Scripts USERENV(2ec.fa8) 12:08:51:093 CompareGPOLists: The lists are the same. USERENV(2ec.fa8) 12:08:51:093 ProcessGPOs: Extension Scripts skipped because both deleted and changed GPO lists are empty. USERENV(2ec.fa8) 12:08:51:109 ProcessGPOs: ----------------------- USERENV(2ec.fa8) 12:08:51:109 ProcessGPOs: Processing extension Internet Explorer Zonemapping USERENV(2ec.fa8) 12:08:51:109 CompareGPOLists: The lists are the same. USERENV(2ec.fa8) 12:08:51:109 ProcessGPOs: Extension Internet Explorer Zonemapping skipped because both deleted and changed GPO lists are empty. USERENV(2ec.fa8) 12:08:51:125 ProcessGPOs: ----------------------- USERENV(2ec.fa8) 12:08:51:125 ProcessGPOs: Processing extension Windows Search Group Policy Extension USERENV(2ec.fa8) 12:08:51:125 CompareGPOLists: The lists are the same. USERENV(2ec.fa8) 12:08:51:140 ProcessGPOs: Extension Windows Search Group Policy Extension skipped because both deleted and changed GPO lists are empty. USERENV(2ec.fa8) 12:08:51:140 ProcessGPOs: ----------------------- USERENV(2ec.fa8) 12:08:51:140 ProcessGPOs: Processing extension Internet Explorer User Accelerators USERENV(2ec.fa8) 12:08:51:140 CompareGPOLists: The lists are the same. USERENV(2ec.fa8) 12:08:51:156 ProcessGPOs: Extension Internet Explorer User Accelerators skipped because both deleted and changed GPO lists are empty. USERENV(2ec.fa8) 12:08:51:156 ProcessGPOs: ----------------------- USERENV(2ec.fa8) 12:08:51:156 ProcessGPOs: Processing extension Security USERENV(2ec.fa8) 12:08:51:171 CompareGPOLists: The lists are the same. USERENV(2ec.fa8) 12:08:51:171 ProcessGPOs: Extension Security skipped with flags 0x2. USERENV(2ec.fa8) 12:08:51:171 ProcessGPOs: ----------------------- USERENV(2ec.fa8) 12:08:51:171 ProcessGPOs: Processing extension Internet Explorer Branding USERENV(2ec.fa8) 12:08:51:187 CompareGPOLists: The lists are the same. USERENV(2ec.fa8) 12:08:51:187 ProcessGPOs: Extension Internet Explorer Branding skipped because both deleted and changed GPO lists are empty. USERENV(2ec.fa8) 12:08:51:187 ProcessGPOs: ----------------------- USERENV(2ec.fa8) 12:08:51:187 ProcessGPOs: Processing extension EFS recovery USERENV(2ec.fa8) 12:08:51:203 CompareGPOLists: The lists are the same. USERENV(2ec.fa8) 12:08:51:203 ProcessGPOs: Extension EFS recovery skipped with flags 0x2. USERENV(2ec.fa8) 12:08:51:203 ProcessGPOs: ----------------------- USERENV(2ec.fa8) 12:08:51:218 ProcessGPOs: Processing extension 802.3 Group Policy USERENV(2ec.fa8) 12:08:51:218 CompareGPOLists: The lists are the same. USERENV(2ec.fa8) 12:08:51:218 ProcessGPOs: Extension 802.3 Group Policy skipped with flags 0x2. USERENV(2ec.fa8) 12:08:51:218 ProcessGPOs: ----------------------- USERENV(2ec.fa8) 12:08:51:234 ProcessGPOs: Processing extension Microsoft Offline Files USERENV(2ec.fa8) 12:08:51:234 CompareGPOLists: The lists are the same. USERENV(2ec.fa8) 12:08:51:234 ProcessGPOs: Extension Microsoft Offline Files skipped with flags 0x2. USERENV(2ec.fa8) 12:08:51:234 ProcessGPOs: ----------------------- USERENV(2ec.fa8) 12:08:51:250 ProcessGPOs: Processing extension Software Installation USERENV(2ec.fa8) 12:08:51:250 CompareGPOLists: The lists are the same. USERENV(2ec.fa8) 12:08:51:250 CompareGPOLists: The lists are the same. USERENV(2ec.fa8) 12:08:51:265 ProcessGPOs: Extension Software Installation skipped because both deleted and changed GPO lists are empty. USERENV(2ec.fa8) 12:08:51:265 ProcessGPOs: ----------------------- USERENV(2ec.fa8) 12:08:51:265 ProcessGPOs: Processing extension Internet Explorer Machine Accelerators USERENV(2ec.fa8) 12:08:51:265 CompareGPOLists: The lists are the same. USERENV(2ec.fa8) 12:08:51:281 ProcessGPOs: Extension Internet Explorer Machine Accelerators skipped because both deleted and changed GPO lists are empty. USERENV(2ec.fa8) 12:08:51:281 ProcessGPOs: ----------------------- USERENV(2ec.fa8) 12:08:51:281 ProcessGPOs: Processing extension IP Security USERENV(2ec.fa8) 12:08:51:281 CompareGPOLists: The lists are the same. USERENV(2ec.fa8) 12:08:51:296 ProcessGPOs: Extension IP Security skipped with flags 0x2. USERENV(2ec.fa8) 12:08:51:296 SetFgRefreshInfo: Previous User Fg policy Synchronous, Reason: FirstPolicyRefresh. USERENV(2ec.fa8) 12:08:51:312 SetFgRefreshInfo: Next User Fg policy Asynchronous, Reason: NoNeedForSync. USERENV(2ec.fa8) 12:08:51:312 LeaveCriticalPolicySection: Critical section 0x844 has been released. USERENV(2ec.fa8) 12:08:51:328 ProcessGPOs: User Group Policy has been applied. USERENV(2ec.fa8) 12:08:51:328 ProcessGPOs: Leaving with 1. USERENV(2ec.fa8) 12:08:51:328 ApplyGroupPolicy: Leaving successfully. USERENV(2ec.930) 12:08:51:406 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(2ec.eac) 12:08:51:421 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(8d0.694) 12:08:51:578 LibMain: Process Name: C:\WINDOWS\system32\userinit.exe USERENV(2ec.a84) 12:08:51:640 GPOThread: Next refresh will happen in 110 minutes USERENV(a68.1ec) 12:09:00:625 LibMain: Process Name: C:\WINDOWS\system32\userinit.exe USERENV(c50.cb8) 12:09:00:796 LibMain: Process Name: C:\WINDOWS\Explorer.EXE USERENV(c50.cb8) 12:09:00:968 GetProfileType: Profile already loaded. USERENV(c50.cb8) 12:09:00:984 GetProfileType: ProfileFlags is 1 USERENV(324.344) 12:09:01:156 ImpersonateUser: Failed to impersonate user with 5. USERENV(324.344) 12:09:01:171 GetUserNameAndDomain Failed to impersonate user USERENV(324.344) 12:09:01:171 ImpersonateUser: Failed to impersonate user with 5. USERENV(324.344) 12:09:01:171 GetUserDNSDomainName: Failed to impersonate user USERENV(d34.c40) 12:09:02:359 LibMain: Process Name: C:\WINDOWS\system32\ie4uinit.exe USERENV(d34.c40) 12:09:02:421 GetProfileType: Profile already loaded. USERENV(d34.c40) 12:09:02:421 GetProfileType: ProfileFlags is 1 USERENV(d34.c40) 12:09:02:562 DeleteLinkFile: Failed to delete . Error = 2 USERENV(d34.c40) 12:09:02:562 DeleteLinkFile: Failed to delete . Error = 2 USERENV(fa0.b64) 12:09:02:968 LibMain: Process Name: C:\WINDOWS\system32\regsvr32.exe USERENV(fa0.b64) 12:09:02:984 GetProfileType: Profile already loaded. USERENV(fa0.b64) 12:09:02:984 GetProfileType: ProfileFlags is 1 USERENV(fa0.b64) 12:09:03:109 GetProfileType: Profile already loaded. USERENV(fa0.b64) 12:09:03:125 GetProfileType: ProfileFlags is 1 USERENV(7c0.5fc) 12:09:03:796 LibMain: Process Name: C:\WINDOWS\System32\rundll32.exe USERENV(b94.e40) 12:09:04:609 LibMain: Process Name: C:\Program Files\Outlook Express\setup50.exe USERENV(b94.e40) 12:09:04:625 DeleteLinkFile: Failed to delete . Error = 3 USERENV(b94.e40) 12:09:04:625 DeleteLinkFile: Failed to delete . Error = 3 USERENV(b94.e40) 12:09:04:625 DeleteLinkFile: Failed to delete . Error = 3 USERENV(b94.e40) 12:09:04:625 DeleteLinkFile: Failed to delete . Error = 3 USERENV(b94.e40) 12:09:04:640 DeleteLinkFile: Failed to delete . Error = 3 USERENV(b94.e40) 12:09:04:640 DeleteLinkFile: Failed to delete . Error = 3 USERENV(b94.e40) 12:09:04:640 DeleteLinkFile: Failed to delete . Error = 2 USERENV(b94.e40) 12:09:04:640 DeleteLinkFile: Failed to delete . Error = 2 USERENV(b94.e40) 12:09:04:656 DeleteLinkFile: Failed to delete . Error = 2 USERENV(b94.e40) 12:09:04:656 DeleteLinkFile: Failed to delete . Error = 2 USERENV(b94.e40) 12:09:04:656 DeleteLinkFile: Failed to delete . Error = 2 USERENV(b94.e40) 12:09:04:671 DeleteLinkFile: Failed to delete . Error = 2 USERENV(b94.e40) 12:09:04:671 DeleteLinkFile: Failed to delete . Error = 2 USERENV(b94.e40) 12:09:04:671 DeleteLinkFile: Failed to delete . Error = 2 USERENV(b94.e40) 12:09:04:671 DeleteLinkFile: Failed to delete . Error = 2 USERENV(b94.e40) 12:09:04:687 DeleteLinkFile: Failed to delete . Error = 2 USERENV(b94.e40) 12:09:04:687 DeleteLinkFile: Failed to delete . Error = 2 USERENV(b94.e40) 12:09:04:687 DeleteLinkFile: Failed to delete . Error = 2 USERENV(b94.e40) 12:09:04:703 DeleteLinkFile: Failed to delete . Error = 2 USERENV(b94.e40) 12:09:04:703 DeleteLinkFile: Failed to delete . Error = 2 USERENV(b94.e40) 12:09:04:703 DeleteLinkFile: Failed to delete . Error = 2 USERENV(b94.e40) 12:09:04:703 DeleteLinkFile: Failed to delete . Error = 2 USERENV(b94.e40) 12:09:04:718 DeleteLinkFile: Failed to delete . Error = 2 USERENV(b94.e40) 12:09:04:718 DeleteLinkFile: Failed to delete . Error = 2 USERENV(b94.e40) 12:09:04:718 DeleteLinkFile: Failed to delete . Error = 3 USERENV(b94.e40) 12:09:04:734 DeleteLinkFile: Failed to delete . Error = 3 USERENV(b94.e40) 12:09:04:734 DeleteLinkFile: Failed to delete . Error = 3 USERENV(b94.e40) 12:09:04:734 DeleteLinkFile: Failed to delete . Error = 3 USERENV(b94.e40) 12:09:04:734 DeleteLinkFile: Failed to delete . Error = 3 USERENV(b94.e40) 12:09:04:750 DeleteLinkFile: Failed to delete . Error = 3 USERENV(b94.e40) 12:09:04:750 DeleteLinkFile: Failed to delete . Error = 3 USERENV(b94.e40) 12:09:04:750 DeleteLinkFile: Failed to delete . Error = 3 USERENV(b94.e40) 12:09:04:781 GetProfileType: Profile already loaded. USERENV(b94.e40) 12:09:04:796 GetProfileType: ProfileFlags is 1 USERENV(838.73c) 12:09:04:875 LibMain: Process Name: C:\WINDOWS\system32\rundll32.exe USERENV(85c.b48) 12:09:05:015 GetProfileType: Profile already loaded. USERENV(85c.b48) 12:09:05:031 GetProfileType: ProfileFlags is 1 USERENV(db0.e08) 12:09:05:093 LibMain: Process Name: C:\WINDOWS\system32\rundll32.exe USERENV(f18.990) 12:09:05:453 LibMain: Process Name: C:\WINDOWS\INF\unregmp2.exe USERENV(8ac.f4) 12:09:05:890 LibMain: Process Name: C:\Program Files\Outlook Express\setup50.exe USERENV(8ac.f4) 12:09:05:890 PrependPath: Entering with USERENV(8ac.f4) 12:09:05:906 UnExpandSysRoot: Entering with USERENV(8ac.f4) 12:09:05:906 UnExpandSysRoot: Leaving with USERENV(8ac.f4) 12:09:05:906 PrependPath: Leaving with USERENV(8ac.f4) 12:09:05:937 PrependPath: Entering with <> USERENV(8ac.f4) 12:09:05:937 PrependPath: lpFile is NULL, setting lpResult to a null string USERENV(8ac.f4) 12:09:05:937 CreateLinkFileEx: Calling SHSetLocalizedName on link . USERENV(8ac.f4) 12:09:05:968 GetProfileType: Profile already loaded. USERENV(8ac.f4) 12:09:05:968 GetProfileType: ProfileFlags is 1 USERENV(8ac.f4) 12:09:05:984 CreateLinkFileEx: Leaving with status of 1. USERENV(8ac.f4) 12:09:05:984 DeleteLinkFile: Failed to delete . Error = 2 USERENV(8ac.f4) 12:09:05:984 DeleteLinkFile: Failed to delete . Error = 2 USERENV(8ac.f4) 12:09:06:000 DeleteLinkFile: Failed to delete . Error = 2 USERENV(8ac.f4) 12:09:06:000 DeleteLinkFile: Failed to delete . Error = 2 USERENV(8ac.f4) 12:09:06:000 DeleteLinkFile: Failed to delete . Error = 3 USERENV(8ac.f4) 12:09:06:000 DeleteLinkFile: Failed to delete . Error = 3 USERENV(8ac.f4) 12:09:06:015 DeleteLinkFile: Failed to delete . Error = 2 USERENV(8ac.f4) 12:09:06:015 DeleteLinkFile: Failed to delete . Error = 2 USERENV(8ac.f4) 12:09:06:015 DeleteLinkFile: Failed to delete . Error = 2 USERENV(8ac.f4) 12:09:06:031 DeleteLinkFile: Failed to delete . Error = 2 USERENV(594.88c) 12:09:06:078 LibMain: Process Name: C:\WINDOWS\system32\shmgrate.exe USERENV(60c.22c) 12:09:06:109 LibMain: Process Name: C:\WINDOWS\system32\regsvr32.exe USERENV(594.88c) 12:09:06:203 GetProfileType: Profile already loaded. USERENV(594.88c) 12:09:06:218 GetProfileType: ProfileFlags is 1 USERENV(4fc.6e0) 12:09:06:234 LibMain: Process Name: C:\WINDOWS\system32\msiexec.exe USERENV(4fc.ed8) 12:09:06:281 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(4fc.b18) 12:09:06:312 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(4fc.b18) 12:09:06:312 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(4fc.b18) 12:09:06:328 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(4fc.b18) 12:09:06:328 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(4fc.b18) 12:09:06:343 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(4fc.b18) 12:09:06:343 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(4fc.b18) 12:09:06:375 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(4fc.b18) 12:09:06:375 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(4fc.b18) 12:09:06:390 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(4fc.b18) 12:09:06:390 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(4fc.b18) 12:09:06:406 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(4fc.b18) 12:09:06:406 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(4fc.b18) 12:09:06:421 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(4fc.b18) 12:09:06:421 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(4fc.b18) 12:09:06:437 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(4fc.b18) 12:09:06:437 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(4fc.b18) 12:09:06:453 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(4fc.b18) 12:09:06:453 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(4fc.b18) 12:09:06:468 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(4fc.b18) 12:09:06:468 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(60c.22c) 12:09:08:296 GetProfileType: Profile already loaded. USERENV(60c.22c) 12:09:08:296 GetProfileType: ProfileFlags is 1 USERENV(ebc.738) 12:09:09:000 LibMain: Process Name: C:\WINDOWS\system32\Rundll32.exe USERENV(1f8.bc8) 12:09:09:062 LibMain: Process Name: C:\WINDOWS\system32\ie4uinit.exe USERENV(ecc.c84) 12:09:09:265 LibMain: Process Name: C:\WINDOWS\system32\rundll32.exe USERENV(ecc.c1c) 12:09:09:375 GetProfileType: Profile already loaded. USERENV(ecc.c1c) 12:09:09:375 GetProfileType: ProfileFlags is 1 USERENV(e74.e64) 12:09:10:125 LibMain: Process Name: C:\WINDOWS\system32\RunDLL32.exe USERENV(804.e30) 12:09:10:296 LibMain: Process Name: C:\WINDOWS\system32\shmgrate.exe USERENV(804.e30) 12:09:10:375 GetProfileType: Profile already loaded. USERENV(804.e30) 12:09:10:375 GetProfileType: ProfileFlags is 1 USERENV(c50.a50) 12:09:10:656 GetProfileType: Profile already loaded. USERENV(c50.a50) 12:09:10:656 GetProfileType: ProfileFlags is 1 USERENV(c50.a50) 12:09:10:875 GetProfileType: Profile already loaded. USERENV(c50.a50) 12:09:10:921 GetProfileType: ProfileFlags is 1 USERENV(cf8.d94) 12:09:13:000 LibMain: Process Name: C:\WINDOWS\system32\RunDll32.exe USERENV(ef0.cb0) 12:09:13:078 LibMain: Process Name: C:\WINDOWS\system32\RUNDLL32.EXE USERENV(a2c.e60) 12:09:13:187 LibMain: Process Name: C:\WINDOWS\system32\RUNDLL32.EXE USERENV(d60.dbc) 12:09:13:406 LibMain: Process Name: C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe USERENV(7e8.620) 12:09:14:046 LibMain: Process Name: C:\Program Files\pdfforge Toolbar\SearchSettings.exe USERENV(7e8.ef4) 12:09:14:843 ImpersonateUser: Failed to impersonate user with 5. USERENV(7e8.ef4) 12:09:14:859 GetUserNameAndDomain Failed to impersonate user USERENV(7e8.ef4) 12:09:14:890 ImpersonateUser: Failed to impersonate user with 5. USERENV(7e8.ef4) 12:09:14:921 GetUserDNSDomainName: Failed to impersonate user USERENV(7e8.ef4) 12:09:14:953 ImpersonateUser: Failed to impersonate user with 5. USERENV(7e8.ef4) 12:09:14:968 GetUserNameAndDomain Failed to impersonate user USERENV(7e8.ef4) 12:09:15:000 ImpersonateUser: Failed to impersonate user with 5. USERENV(7e8.ef4) 12:09:15:015 GetUserDNSDomainName: Failed to impersonate user USERENV(7e8.ef4) 12:09:15:046 ImpersonateUser: Failed to impersonate user with 5. USERENV(7e8.ef4) 12:09:15:062 GetUserNameAndDomain Failed to impersonate user USERENV(7e8.ef4) 12:09:15:078 ImpersonateUser: Failed to impersonate user with 5. USERENV(7e8.ef4) 12:09:15:093 GetUserDNSDomainName: Failed to impersonate user USERENV(4bc.e8c) 12:09:15:328 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(4bc.e8c) 12:09:15:343 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(a2c.e60) 12:09:16:437 LoadUserProfile: Yes, we can impersonate the user. Running as self USERENV(a2c.e60) 12:09:16:437 ========================================================= USERENV(a2c.e60) 12:09:16:437 LoadUserProfile: Entering, hToken = <0xf0>, lpProfileInfo = 0x7f438 USERENV(a2c.e60) 12:09:16:453 LoadUserProfile: lpProfileInfo->dwFlags = <0x1> USERENV(a2c.e60) 12:09:16:453 LoadUserProfile: lpProfileInfo->lpUserName = USERENV(a2c.e60) 12:09:16:453 LoadUserProfile: NULL central profile path USERENV(a2c.e60) 12:09:16:468 LoadUserProfile: NULL default profile path USERENV(a2c.e60) 12:09:16:468 LoadUserProfile: NULL server name USERENV(a2c.e60) 12:09:16:468 LoadUserProfile: Failed to enable the restore privilege. error = c0000061 USERENV(a2c.e60) 12:09:16:468 LoadUserProfile: Returning FALSE. Error = 1314 USERENV(700.c90) 12:09:17:593 LibMain: Process Name: C:\WINDOWS\system32\imapi.exe USERENV(4bc.e8c) 12:09:17:812 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(2ec.eac) 12:09:21:343 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(820.740) 12:09:21:375 LibMain: Process Name: C:\WINDOWS\system32\userinit.exe USERENV(7e8.e68) 12:09:22:218 ImpersonateUser: Failed to impersonate user with 5. USERENV(7e8.e68) 12:09:22:218 GetUserNameAndDomain Failed to impersonate user USERENV(7e8.e68) 12:09:22:218 ImpersonateUser: Failed to impersonate user with 5. USERENV(7e8.e68) 12:09:22:234 GetUserDNSDomainName: Failed to impersonate user USERENV(3e4.894) 12:09:44:703 GetUserDNSDomainName: MyGetUserNameEx failed for NameDnsDomain style name with 1332 USERENV(2ec.2f0) 12:09:56:953 UnloadUserProfile: Entering, hProfile = <0x7e8> USERENV(2ec.2f0) 12:09:56:953 UnloadUserProfile: In console winlogon process USERENV(2ec.2f0) 12:09:56:953 UnloadUserProfileP: Entering, hProfile = <0x7e8> USERENV(2ec.2f0) 12:09:56:968 AbleToBypassCSC: Try to bypass CSC USERENV(2ec.2f0) 12:10:06:000 AbleToBypassCSC: tried NPAddConnection3ForCSCAgent. Error 53 USERENV(2ec.2f0) 12:10:10:500 UnLoadUserProfileP: CSC bypassed failed. Ignoring Roaming profile path USERENV(2ec.2f0) 12:10:10:500 GetExclusionListFromRegistry: Policy list is empty, returning user list = USERENV(2ec.2f0) 12:10:10:500 CSyncManager::EnterLock USERENV(2ec.2f0) 12:10:10:500 CSyncManager::EnterLock: No existing entry found USERENV(2ec.2f0) 12:10:10:515 CSyncManager::EnterLock: New entry created USERENV(2ec.2f0) 12:10:10:515 CHashTable::HashAdd: S-1-5-21-914212253-3526360373-1445599473-21010 added in bucket 7 USERENV(2ec.2f0) 12:10:10:515 UnloadUserProfileP: Wait succeeded. In critical section. USERENV(2ec.2f0) 12:10:10:750 MyRegUnLoadKey: Returning 1. USERENV(2ec.2f0) 12:10:10:765 UnloadUserProfileP: Succesfully unloaded profile USERENV(2ec.2f0) 12:10:10:796 MyRegUnLoadKey: Returning 1. USERENV(2ec.2f0) 12:10:10:812 UnLoadClassHive: Successfully unmounted S-1-5-21-914212253-3526360373-1445599473-21010_Classes USERENV(2ec.2f0) 12:10:10:812 UnloadUserProfileP: Successfully unloaded user classes USERENV(2ec.2f0) 12:10:10:812 UnloadUserProfileP: Impersonated user USERENV(2ec.2f0) 12:10:10:812 UnloadUserProfileP: Writing local ini file USERENV(2ec.2f0) 12:10:10:828 UnloadUserProfileP: Reverting to Self USERENV(2ec.2f0) 12:10:10:828 DeleteProfileEx: Failed to query profile guid with error 2 USERENV(2ec.2f0) 12:10:10:843 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP> USERENV(2ec.2f0) 12:10:10:843 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:10:843 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:10:843 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:10:859 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Application Data> USERENV(2ec.2f0) 12:10:10:859 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:10:859 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:10:875 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:10:875 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:10:875 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Application Data\Identities> USERENV(2ec.2f0) 12:10:10:890 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:10:890 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:10:890 Delnode_Recurse: FindFile found: <{2946267F-4ECB-4B8C-96F9-FE64EFBAD280}> USERENV(2ec.2f0) 12:10:10:890 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Application Data\Identities\{2946267F-4ECB-4B8C-96F9-FE64EFBAD280}> USERENV(2ec.2f0) 12:10:10:906 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:10:906 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:10:906 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Application Data\Identities\{2946267F-4ECB-4B8C-96F9-FE64EFBAD280}\*.*> USERENV(2ec.2f0) 12:10:10:921 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Application Data\Identities\{2946267F-4ECB-4B8C-96F9-FE64EFBAD280}> USERENV(2ec.2f0) 12:10:10:921 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:10:921 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Application Data\Microsoft> USERENV(2ec.2f0) 12:10:10:921 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:10:937 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:10:937 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:10:937 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Application Data\Microsoft\Internet Explorer> USERENV(2ec.2f0) 12:10:10:953 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:10:953 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:10:953 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:10:968 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:10:968 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:10:968 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:10:984 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Application Data\Microsoft\Internet Explorer\Quick Launch> USERENV(2ec.2f0) 12:10:10:984 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:10:984 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:10:984 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:000 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:000 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:000 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf> USERENV(2ec.2f0) 12:10:11:031 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Application Data\Microsoft\Internet Explorer\Quick Launch> USERENV(2ec.2f0) 12:10:11:046 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:046 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Application Data\Microsoft\Media Player> USERENV(2ec.2f0) 12:10:11:046 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:11:046 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:11:062 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Application Data\Microsoft\Media Player\*.*> USERENV(2ec.2f0) 12:10:11:062 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:062 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Application Data\Microsoft\SystemCertificates> USERENV(2ec.2f0) 12:10:11:078 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:11:078 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:11:078 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:093 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Application Data\Microsoft\SystemCertificates\My> USERENV(2ec.2f0) 12:10:11:093 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:11:093 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:11:093 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:109 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Application Data\Microsoft\SystemCertificates\My\Certificates> USERENV(2ec.2f0) 12:10:11:109 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:11:109 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:11:125 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Application Data\Microsoft\SystemCertificates\My\Certificates\*.*> USERENV(2ec.2f0) 12:10:11:156 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:171 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Application Data\Microsoft\SystemCertificates\My\CRLs> USERENV(2ec.2f0) 12:10:11:171 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:11:171 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:11:171 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Application Data\Microsoft\SystemCertificates\My\CRLs\*.*> USERENV(2ec.2f0) 12:10:11:203 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:203 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Application Data\Microsoft\SystemCertificates\My\CTLs> USERENV(2ec.2f0) 12:10:11:218 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:11:218 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:11:218 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Application Data\Microsoft\SystemCertificates\My\CTLs\*.*> USERENV(2ec.2f0) 12:10:11:218 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Application Data\Microsoft\SystemCertificates\My\CTLs> USERENV(2ec.2f0) 12:10:11:234 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Application Data\Microsoft\SystemCertificates\My> USERENV(2ec.2f0) 12:10:11:265 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Application Data\Microsoft\SystemCertificates> USERENV(2ec.2f0) 12:10:11:281 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Application Data\Microsoft> USERENV(2ec.2f0) 12:10:11:281 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:281 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Cookies> USERENV(2ec.2f0) 12:10:11:281 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:11:296 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:11:296 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:296 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Cookies\index.dat> USERENV(2ec.2f0) 12:10:11:312 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:312 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Desktop> USERENV(2ec.2f0) 12:10:11:312 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:11:328 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:11:328 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Desktop\*.*> USERENV(2ec.2f0) 12:10:11:359 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:359 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Favorites> USERENV(2ec.2f0) 12:10:11:375 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:11:375 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:11:375 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:390 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:390 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Favorites\Links> USERENV(2ec.2f0) 12:10:11:390 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:11:390 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:11:406 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:406 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:406 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Favorites\Links\Web Slice Gallery.url> USERENV(2ec.2f0) 12:10:11:421 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:421 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Favorites\Microsoft Websites> USERENV(2ec.2f0) 12:10:11:421 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:11:437 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:11:437 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:437 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:453 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:453 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:453 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:468 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Favorites\Microsoft Websites\Microsoft Store.url> USERENV(2ec.2f0) 12:10:11:468 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Favorites\Microsoft Websites> USERENV(2ec.2f0) 12:10:11:500 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:500 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\IETldCache> USERENV(2ec.2f0) 12:10:11:515 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:11:515 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:11:515 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:531 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\IETldCache\index.dat> USERENV(2ec.2f0) 12:10:11:531 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:531 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings> USERENV(2ec.2f0) 12:10:11:546 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:11:546 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:11:546 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:562 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data> USERENV(2ec.2f0) 12:10:11:562 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:11:562 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:11:578 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:578 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:578 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:593 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft> USERENV(2ec.2f0) 12:10:11:593 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:11:593 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:11:609 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:609 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\CD Burning> USERENV(2ec.2f0) 12:10:11:609 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:11:625 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:11:625 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\CD Burning\*.*> USERENV(2ec.2f0) 12:10:11:625 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:640 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Feeds> USERENV(2ec.2f0) 12:10:11:640 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:11:640 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:11:640 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:656 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:656 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Feeds\Microsoft Feeds~> USERENV(2ec.2f0) 12:10:11:656 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:11:671 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:11:671 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:671 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:687 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms> USERENV(2ec.2f0) 12:10:11:687 Delnode_Recurse: FindFile found: <{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~> USERENV(2ec.2f0) 12:10:11:687 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~> USERENV(2ec.2f0) 12:10:11:703 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:11:703 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:11:703 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:718 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlic es~> USERENV(2ec.2f0) 12:10:11:718 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:11:718 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:11:734 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:734 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlic es~\Web Slice Gallery~.feed-ms> USERENV(2ec.2f0) 12:10:11:796 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlic es~> USERENV(2ec.2f0) 12:10:11:796 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~> USERENV(2ec.2f0) 12:10:11:812 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:812 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Feeds Cache> USERENV(2ec.2f0) 12:10:11:812 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:11:828 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:11:828 Delnode_Recurse: FindFile found: <884LEN4X> USERENV(2ec.2f0) 12:10:11:828 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Feeds Cache\884LEN4X> USERENV(2ec.2f0) 12:10:11:843 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:11:843 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:11:843 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:859 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Feeds Cache\884LEN4X\desktop.ini> USERENV(2ec.2f0) 12:10:11:875 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:890 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Feeds Cache\BJAN35W9> USERENV(2ec.2f0) 12:10:11:890 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:11:906 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:11:906 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:906 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:921 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Feeds Cache\BJAN35W9\fwlink[1]> USERENV(2ec.2f0) 12:10:11:921 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:921 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:937 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:937 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Feeds Cache\MUT7V4TY> USERENV(2ec.2f0) 12:10:11:953 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:11:953 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:11:953 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:953 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:11:968 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Feeds Cache\MUT7V4TY\fwlink[1]> USERENV(2ec.2f0) 12:10:12:000 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:000 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Feeds Cache\Q9EVIGJP> USERENV(2ec.2f0) 12:10:12:015 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:12:015 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:12:015 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:031 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:031 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Feeds Cache\Q9EVIGJP\fwlink[1]> USERENV(2ec.2f0) 12:10:12:031 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Feeds Cache\Q9EVIGJP> USERENV(2ec.2f0) 12:10:12:046 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:046 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Internet Explorer> USERENV(2ec.2f0) 12:10:12:062 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:12:062 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:12:062 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:078 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:078 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Internet Explorer\brndlog.txt> USERENV(2ec.2f0) 12:10:12:109 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:125 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Media Player> USERENV(2ec.2f0) 12:10:12:125 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:12:125 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:12:140 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:140 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_59R.wmdb> USERENV(2ec.2f0) 12:10:12:140 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:156 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Office> USERENV(2ec.2f0) 12:10:12:156 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:12:156 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:12:171 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Office\*.*> USERENV(2ec.2f0) 12:10:12:171 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:171 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Windows> USERENV(2ec.2f0) 12:10:12:187 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:12:187 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:12:187 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:203 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:203 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG> USERENV(2ec.2f0) 12:10:12:218 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:218 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Windows Media> USERENV(2ec.2f0) 12:10:12:234 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:12:234 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:12:234 Delnode_Recurse: FindFile found: <9.0> USERENV(2ec.2f0) 12:10:12:250 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Windows Media\9.0> USERENV(2ec.2f0) 12:10:12:250 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:12:250 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:12:265 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:265 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:265 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.XML> USERENV(2ec.2f0) 12:10:12:281 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Windows Media\9.0> USERENV(2ec.2f0) 12:10:12:281 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\Microsoft\Windows Media> USERENV(2ec.2f0) 12:10:12:312 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:328 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\TSVNCache> USERENV(2ec.2f0) 12:10:12:328 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:12:328 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:12:343 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:343 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\TSVNCache\cache> USERENV(2ec.2f0) 12:10:12:359 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Application Data\TSVNCache> USERENV(2ec.2f0) 12:10:12:359 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:359 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:375 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\History> USERENV(2ec.2f0) 12:10:12:375 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:12:375 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:12:390 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:390 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:406 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\History\History.IE5> USERENV(2ec.2f0) 12:10:12:406 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:12:406 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:12:421 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:453 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:453 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:468 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\History\History.IE5\MSHist012010080320100804> USERENV(2ec.2f0) 12:10:12:468 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:12:468 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:12:484 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:484 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\History\History.IE5\MSHist012010080320100804\index.dat> USERENV(2ec.2f0) 12:10:12:484 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\History\History.IE5\MSHist012010080320100804> USERENV(2ec.2f0) 12:10:12:500 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\History\History.IE5> USERENV(2ec.2f0) 12:10:12:500 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:500 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Temp> USERENV(2ec.2f0) 12:10:12:515 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:12:515 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:12:515 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:531 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Temp\AdobeARM.log> USERENV(2ec.2f0) 12:10:12:562 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:578 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Temporary Internet Files> USERENV(2ec.2f0) 12:10:12:578 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:12:578 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:12:593 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:593 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Temporary Internet Files\Content.IE5> USERENV(2ec.2f0) 12:10:12:593 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:12:609 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:12:609 Delnode_Recurse: FindFile found: <0CH4UJGO> USERENV(2ec.2f0) 12:10:12:625 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Temporary Internet Files\Content.IE5\0CH4UJGO> USERENV(2ec.2f0) 12:10:12:625 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:12:625 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:12:640 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:640 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Temporary Internet Files\Content.IE5\0CH4UJGO\desktop.ini> USERENV(2ec.2f0) 12:10:12:640 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:656 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:656 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Temporary Internet Files\Content.IE5\FMP7MR2X> USERENV(2ec.2f0) 12:10:12:671 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:12:671 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:12:671 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:687 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Temporary Internet Files\Content.IE5\FMP7MR2X\desktop.ini> USERENV(2ec.2f0) 12:10:12:718 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:718 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:718 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Temporary Internet Files\Content.IE5\JPE64RK5> USERENV(2ec.2f0) 12:10:12:734 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:12:734 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:12:734 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:750 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Temporary Internet Files\Content.IE5\JPE64RK5\desktop.ini> USERENV(2ec.2f0) 12:10:12:750 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:750 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Local Settings\Temporary Internet Files\Content.IE5\MHKG8I59> USERENV(2ec.2f0) 12:10:12:765 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:12:765 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:12:765 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:781 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Temporary Internet Files\Content.IE5\MHKG8I59\desktop.ini> USERENV(2ec.2f0) 12:10:12:843 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Temporary Internet Files\Content.IE5\MHKG8I59> USERENV(2ec.2f0) 12:10:12:843 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:843 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Temporary Internet Files\desktop.ini> USERENV(2ec.2f0) 12:10:12:859 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Local Settings\Temporary Internet Files> USERENV(2ec.2f0) 12:10:12:890 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:906 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\My Documents> USERENV(2ec.2f0) 12:10:12:906 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:12:906 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:12:921 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:921 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:921 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\My Documents\My Music> USERENV(2ec.2f0) 12:10:12:937 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:12:937 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:12:953 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:953 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:953 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\My Documents\My Music\Sample Music.lnk> USERENV(2ec.2f0) 12:10:12:968 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:968 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\My Documents\My Pictures> USERENV(2ec.2f0) 12:10:12:968 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:12:984 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:12:984 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:12:984 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:000 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\My Documents\My Pictures\Sample Pictures.lnk> USERENV(2ec.2f0) 12:10:13:031 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\My Documents\My Pictures> USERENV(2ec.2f0) 12:10:13:031 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:046 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\NetHood> USERENV(2ec.2f0) 12:10:13:046 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:13:062 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:13:062 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\NetHood\*.*> USERENV(2ec.2f0) 12:10:13:062 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:078 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:078 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:078 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:093 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\PrintHood> USERENV(2ec.2f0) 12:10:13:093 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:13:093 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:13:109 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\PrintHood\*.*> USERENV(2ec.2f0) 12:10:13:109 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:109 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Recent> USERENV(2ec.2f0) 12:10:13:125 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:13:125 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:13:140 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:171 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:187 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:187 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Recent\Startup.lnk> USERENV(2ec.2f0) 12:10:13:187 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:203 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\SendTo> USERENV(2ec.2f0) 12:10:13:203 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:13:203 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:13:218 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:250 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:250 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:250 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:265 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:265 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\SendTo\My Documents.mydocs> USERENV(2ec.2f0) 12:10:13:281 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:281 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Start Menu> USERENV(2ec.2f0) 12:10:13:296 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:13:296 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:13:296 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:312 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:312 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Start Menu\Programs> USERENV(2ec.2f0) 12:10:13:312 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:13:328 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:13:328 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:343 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Start Menu\Programs\Accessories> USERENV(2ec.2f0) 12:10:13:343 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:13:343 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:13:359 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:359 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Start Menu\Programs\Accessories\Accessibility> USERENV(2ec.2f0) 12:10:13:375 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:13:375 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:13:375 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:390 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:437 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:453 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:453 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:453 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Start Menu\Programs\Accessories\Accessibility\Utility Manager.lnk> USERENV(2ec.2f0) 12:10:13:468 Delnode_Recurse: FindFile found:
USERENV(2ec.2f0) 12:10:13:468 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:484 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:531 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:531 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Start Menu\Programs\Accessories\Entertainment> USERENV(2ec.2f0) 12:10:13:531 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:13:546 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:13:546 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:546 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:562 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Start Menu\Programs\Accessories\Entertainment\Windows Media Player.lnk> USERENV(2ec.2f0) 12:10:13:562 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:562 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:578 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:578 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:578 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Start Menu\Programs\Accessories\System Tools> USERENV(2ec.2f0) 12:10:13:593 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:13:593 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:13:609 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:828 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk> USERENV(2ec.2f0) 12:10:13:828 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:843 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:843 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Start Menu\Programs\Accessories\Windows Explorer.lnk> USERENV(2ec.2f0) 12:10:13:843 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:859 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:921 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:921 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:937 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:937 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Start Menu\Programs\Startup> USERENV(2ec.2f0) 12:10:13:953 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:13:953 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:13:953 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:968 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Start Menu\Programs\Startup\desktop.ini> USERENV(2ec.2f0) 12:10:13:968 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:13:984 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Start Menu\Programs\Windows Media Player.lnk> USERENV(2ec.2f0) 12:10:13:984 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Start Menu\Programs> USERENV(2ec.2f0) 12:10:14:046 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:14:046 Delnode_Recurse: Entering, lpDir = <\\?\C:\Documents and Settings\TEMP\Templates> USERENV(2ec.2f0) 12:10:14:046 Delnode_Recurse: FindFile found: <.> USERENV(2ec.2f0) 12:10:14:062 Delnode_Recurse: FindFile found: <..> USERENV(2ec.2f0) 12:10:14:062 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:14:062 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:14:078 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:14:078 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:14:078 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:14:093 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:14:093 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:14:109 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:14:125 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:14:125 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:14:140 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:14:140 Delnode_Recurse: FindFile found: USERENV(2ec.2f0) 12:10:14:140 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Templates\wordpfct.wpg> USERENV(2ec.2f0) 12:10:14:156 Delnode_Recurse: Leaving <\\?\C:\Documents and Settings\TEMP\Templates> USERENV(2ec.2f0) 12:10:14:156 Delnode: Deleted directory successfully. USERENV(2ec.2f0) 12:10:14:171 UnloadUserProfileP: exitting and cleaning up USERENV(2ec.2f0) 12:10:14:171 CSyncManager::LeaveLock USERENV(2ec.2f0) 12:10:14:171 CSyncManager::LeaveLock: Lock released USERENV(2ec.2f0) 12:10:14:187 CHashTable::HashDelete: S-1-5-21-914212253-3526360373-1445599473-21010 deleted USERENV(2ec.2f0) 12:10:14:187 CSyncManager::LeaveLock: Lock deleted USERENV(2ec.2f0) 12:10:14:203 UnloadUserProfileP: Leave critical section. USERENV(2ec.2f0) 12:10:14:203 UnloadUserProfileP: Leaving with a return value of 1 USERENV(2ec.2f0) 12:10:14:203 UnloadUserProfile: UnloadUserProfileP succeeded USERENV(2ec.2f0) 12:10:14:218 UnloadUserProfile: returning 1 USERENV(2ec.2f0) 12:10:30:593 LoadUserProfile: Yes, we can impersonate the user. Running as self USERENV(2ec.2f0) 12:10:30:593