Code:C:\Program Files\Symantec\Ghost\ngctw32.exe 11.0.0.15028:37:22 AM Tuesday, May 01, 20078:37:27 AM 10.10.21.234:1346 polling for bound server cslab113-168:37:37 AM 10.10.21.234:1346 polling for bound server cslab113-168:37:57 AM 10.10.21.234:1346 polling for bound server cslab113-168:38:37 AM 10.10.21.234:1346 polling for bound server cslab113-168:39:57 AM 10.10.21.234:1346 polling for bound server cslab113-168:39:58 AM 10.10.21.234:1346 sending status to 10.10.43.0:13478:39:58 AM 10.10.21.234:1346 acknowledged by 10.10.43.0:13478:40:18 AM 10.10.21.234:1346 sending status to 10.10.43.0:13478:40:18 AM 10.10.21.234:1346 acknowledged by 10.10.43.0:13478:40:38 AM 10.10.21.234:1346 sending status to 10.10.43.0:13478:40:38 AM 10.10.21.234:1346 acknowledged by 10.10.43.0:13478:40:58 AM 10.10.21.234:1346 sending status to 10.10.43.0:13478:40:58 AM 10.10.21.234:1346 acknowledged by 10.10.43.0:13478:41:18 AM 10.10.21.234:1346 sending status to 10.10.43.0:13478:41:18 AM 10.10.21.234:1346 acknowledged by 10.10.43.0:13478:41:38 AM 10.10.21.234:1346 sending status to 10.10.43.0:13478:41:38 AM 10.10.21.234:1346 acknowledged by 10.10.43.0:13478:41:58 AM 10.10.21.234:1346 sending status to 10.10.43.0:13478:41:58 AM 10.10.21.234:1346 acknowledged by 10.10.43.0:13478:42:18 AM 10.10.21.234:1346 sending status to 10.10.43.0:13478:42:18 AM 10.10.21.234:1346 acknowledged by 10.10.43.0:13478:42:18 AM 10.10.21.234:1346 TCP connecting to 10.10.43.0:1347Received message Message<HasGhostBootPartition>{}Received message Message<WarnShutdown>{ Shutdown = 1, Timeout = 10, Platform = DOS, Cancel = 0 }8:42:18 AM 10.10.21.234:1346 disconnecting from 10.10.43.0:13478:42:38 AM 10.10.21.234:1346 sending status to 10.10.43.0:13478:42:38 AM 10.10.21.234:1346 acknowledged by 10.10.43.0:13478:42:38 AM 10.10.21.234:1346 TCP connecting to 10.10.43.0:1347Received message Message<WarnShutdown>{ Shutdown = 1, Timeout = 10, Platform = DOS, Cancel = 0 }Received message Message<DoesClientFileExist>{ Name = "GHCONFIG.EXE" }Received message Message<DoesClientFileExist>{ Name = "GHSTWALK.EXE" }Received message Message<DoesClientFileExist>{ Name = "GHOST.EXE" }Received message Message<GetNetworkDriverCRC>{ Name = "incoming\\dos" }Received message Message<GetNetworkDriverCRC>{ Name = "incoming\\template" }Received message Message<UpdateProtocolIni>{ Name = "incoming\\template/protocol.ini", ServerConnectionDeviceId = "{490DF7F7-8B93-4053-B3C2-9EFDFAAB85D1}" }Received message Message<QueryAttributes>{}Received message Message<Open>{ Name = "%systemdrive%\\sysprep\\wfinf_guide.doc", What = File, Mode = Write }Received message Message<Open>{ Name = "%systemdrive%\\sysprep\\sysprep.txt", What = File, Mode = Write }Received message Message<Open>{ Name = "%systemdrive%\\sysprep\\sysprep.inf", What = File, Mode = Write }Received message Message<Open>{ Name = "%systemdrive%\\sysprep\\sysprep.exe", What = File, Mode = Write }Received message Message<Open>{ Name = "%systemdrive%\\sysprep\\setupmgr.exe", What = File, Mode = Write }Received message Message<Open>{ Name = "%systemdrive%\\sysprep\\setupcl.exe", What = File, Mode = Write }Received message Message<Open>{ Name = "%systemdrive%\\sysprep\\ref.chm", What = File, Mode = Write }Received message Message<Open>{ Name = "%systemdrive%\\sysprep\\readme.txt", What = File, Mode = Write }Received message Message<Open>{ Name = "%systemdrive%\\sysprep\\oformat.com", What = File, Mode = Write }Received message Message<Open>{ Name = "%systemdrive%\\sysprep\\factory.exe", What = File, Mode = Write }Received message Message<Open>{ Name = "%systemdrive%\\sysprep\\deploy.chm", What = File, Mode = Write }Received message Message<Open>{ Name = "%systemdrive%\\sysprep\\cvtarea.exe", What = File, Mode = Write }Received message Message<Open>{ Name = "%systemdrive%\\Sysprep\\sysprep.inf", What = File, Mode = Write }Received message Message<SetGhostBoot>{ VirtualPartitionSize = 15 }Received message Message<Command>{ Name = "%systemdrive%\\Sysprep\\sysprep.exe -reboot -mini -quiet -reseal -nosidgen " }8:42:45 AM 10.10.21.234:1346 disconnecting from 10.10.43.0:13478:42:58 AM 10.10.21.234:1346 sending status to 10.10.43.0:13478:42:58 AM 10.10.21.234:1346 acknowledged by 10.10.43.0:13478:42:58 AM 10.10.21.234:1346 TCP connecting to 10.10.43.0:13478:42:58 AM 10.10.21.234:1346 disconnecting from 10.10.43.0:13478:43:10 AM 127.0.0.1:1346 polling for bound server cslab113-168:43:30 AM 127.0.0.1:1346 polling for bound server cslab113-16----------------------------------------C:\Program Files\Symantec\Ghost\ngctw32.exe 11.0.0.150210:50:07 AM Tuesday, May 01, 2007Checking for Sysprep. Process id: 812, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\SMSS.EXEChecking for Sysprep. Process id: 860, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\CSRSS.EXEChecking for Sysprep. Process id: 884, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\WINLOGON.EXEChecking for Sysprep. Process id: 928, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\SERVICES.EXEChecking for Sysprep. Process id: 940, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\LSASS.EXEChecking for Sysprep. Process id: 1124, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\SVCHOST.EXEChecking for Sysprep. Process id: 1208, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\SVCHOST.EXEChecking for Sysprep. Process id: 1332, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\SVCHOST.EXEChecking for Sysprep. Process id: 1428, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\SVCHOST.EXEChecking for Sysprep. Process id: 1580, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\SVCHOST.EXEChecking for Sysprep. Process id: 1652, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXEChecking for Sysprep. Process id: 1736, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXEChecking for Sysprep. Process id: 1900, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\SPOOLSV.EXEChecking for Sysprep. Process id: 828, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\SYMANTEC ANTIVIRUS\DEFWATCH.EXEChecking for Sysprep. Process id: 1012, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\INETSRV\INETINFO.EXEChecking for Sysprep. Process id: 1168, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\MICROSOFT SQL SERVER\90\DTS\BINN\MSDTSSRVR.EXEChecking for Sysprep. Process id: 1520, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL.2\MSSQL\BINN\MSFTESQL.EXEChecking for Sysprep. Process id: 1548, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL.1\MSSQL\BINN\SQLSERVR.EXEChecking for Sysprep. Process id: 1676, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\SYMANTEC\GHOST\NGCTW32.EXEChecking for Sysprep. Process id: 1964, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\NUTSRV4.EXEChecking for Sysprep. Process id: 200, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\SYMANTEC ANTIVIRUS\SAVROAM.EXEChecking for Sysprep. Process id: 256, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\MICROSOFT SQL SERVER\90\SHARED\SQLBROWSER.EXEChecking for Sysprep. Process id: 320, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\MICROSOFT SQL SERVER\90\SHARED\SQLWRITER.EXEChecking for Sysprep. Process id: 372, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\SVCHOST.EXEChecking for Sysprep. Process id: 496, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\SYMANTEC ANTIVIRUS\RTVSCAN.EXEChecking for Sysprep. Process id: 2132, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\ALG.EXEC:\Program Files\Symantec\Ghost\ngctw32.exe 11.0.0.150210:50:13 AM Tuesday, May 01, 2007------------- Shutting down ----------------------------------------------------C:\Program Files\Symantec\Ghost\ngctw32.exe 11.0.0.150210:51:31 AM Tuesday, May 01, 200710:51:32 AM 10.10.22.211:1346 sending status to 10.10.43.0:134710:51:32 AM 10.10.22.211:1346 acknowledged by 10.10.43.0:134710:51:32 AM 10.10.22.211:1346 TCP connecting to 10.10.43.0:1347Received message Message<taskInProgess>{ Cancel = 1 }Received message Message<PreventLoginTask>{ DisableLogin = 0 }Received message Message<Shutdown>{ Name = () }10:51:32 AM 10.10.22.211:1346 disconnecting from 10.10.43.0:134710:50:09 AM 10.10.22.211:1346 sending status to 10.10.43.0:134710:50:09 AM 10.10.22.211:1346 acknowledged by 10.10.43.0:134710:50:29 AM 10.10.22.211:1346 sending status to 10.10.43.0:134710:50:29 AM 10.10.22.211:1346 acknowledged by 10.10.43.0:134710:59:49 AM 10.10.22.211:1346 acknowledged by 10.10.43.0:134711:00:09 AM 10.10.22.211:1346 sending status to 10.10.43.0:134711:00:09 AM 10.10.22.211:1346 acknowledged by 10.10.43.0:134711:00:29 AM 10.10.22.211:1346 sending status to 10.10.43.0:134711:00:29 AM 10.10.22.211:1346 acknowledged by 10.10.43.0:1347----------------------------------------C:\Program Files\Symantec\Ghost\ngctw32.exe 11.0.0.150211:01:26 AM Tuesday, May 01, 200711:01:27 AM 10.10.22.211:1346 sending status to 10.10.43.0:134711:01:27 AM 10.10.22.211:1346 acknowledged by 10.10.43.0:134711:01:48 AM 10.10.22.211:1346 sending status to 10.10.43.0:134711:01:48 AM 10.10.22.211:1346 acknowledged by 10.10.43.0:134711:02:12 AM 10.10.22.211:1346 sending status to 10.10.43.0:13471:03:41 PM 10.10.22.211:1346 acknowledged by 10.10.43.0:13471:04:01 PM 10.10.22.211:1346 sending status to 10.10.43.0:13471:04:01 PM 10.10.22.211:1346 acknowledged by 10.10.43.0:13471:04:21 PM 10.10.22.211:1346 sending status to 10.10.43.0:13471:04:21 PM 10.10.22.211:1346 acknowledged by 10.10.43.0:13471:04:41 PM 10.10.22.211:1346 sending status to 10.10.43.0:13471:22:38 PM 10.10.22.211:1346 sending status to 10.10.43.0:13471:22:58 PM 10.10.22.211:1346 sending status to 10.10.43.0:13471:23:18 PM 10.10.22.211:1346 lost contact with 10.10.43.0:13471:23:28 PM 10.10.22.211:1346 polling for bound server cslab113-161:23:48 PM 10.10.22.211:1346 polling for bound server cslab113-161:24:28 PM 10.10.22.211:1346 polling for bound server cslab113-161:25:48 PM 10.10.22.211:1346 polling for bound server cslab113-161:27:48 PM 10.10.22.211:1346 polling for bound server cslab113-162:34:02 PM 10.10.22.211:1346 polling for bound server cslab113-162:36:06 PM 10.10.22.211:1346 polling for bound server cslab113-16