[Resolved] Laptop sometimes hang on start up

BennyLCB, It's not important if it doesn't exist. If it does, it's infected and can re-infect the rest of your computer. Could it be a Thumb drive?

do u mean during the scan a tumb drive was placed in the usb? if yes, i did not have any tumb drive in the usb.. but i do use tumb drives for my assignment, movies etc..

BennyLCB,

What ever the J: drive is was not plugged in during the scan. Therefore, the contaminated files were not cleaned from it.

Please plug your thumb drive in and then look in My Computer. If it shows a J: drive DO NOT OPEN ANY OF THE FILES ON IT.

Let me know and we will re-run a partial script with the thumb drive installed so that we can clean it.

i've tried inserting thumbdrives in.. but doesnt show J drive.. only H.. what do i do now?

BennyLCB,

Please download Flash Disinfector.exe by sUBs and save it to your desktop.

• Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
  
• The utility may ask you to insert your flash drive and/or other removable drives. Please do so and allow the
  utility to clean up those drives as well. Hold down the Shift key when inserting the drive until Windows detects it to keep autorun.inf from executing if it is present.
  
• Wait until it has finished scanning and then exit the program.
  
• Reboot your computer when done.

Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive that is plugged in when you ran it. Don't delete this folder…it will help protect your drives from future infection.

Then please give me a new HijackThis log.

oh ya, there's smthg i forgot to report to u.. since the 1st time i start using combofix, my sound card smtimes go undetected, no sound files can be played.. and i need to restart my laptop to get the sound back.. any way to fix it too? and 1 more thing. what is 'NMIndexingService.exe' from system? this .exe is causing my laptop to hang on startup, i comfirmed it by holding Ctrl+Alt+Del to see what process is causing the hang during start up.. and whenever its this .exe to load, it'll hang around 8/10 times.

BennyLCB,

NMIndexingService.exe is part of Nero. It works in the background to "index" all of your media files. It basically searches your drives for media files and then "writes down" where they are found at just in case you should want to access them with Nero. This is supposed to speed up access time but it can be a bit of a resource hog.

Worse than that is you are partially re-infected. Let's see if we can find out where that came from.

Download Rooter.exe to your desktop

• Then doubleclick it to start the tool
  
• A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt. Post that here

Next

COMBOFIX-Script

• Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
  
  

  File::
  C:\WINDOWS\system32\olhrwef.exe

• Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
  
  [external image: Posted Image]
  
• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
• ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
• When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 2 X86-based PC ( Multiprocessor Free : Genuine Intel® CPU T2300 @ 1.66GHz ) BIOS : Ver 1.00PARTTBLq USER : User ( Administrator ) BOOT : Normal boot Antivirus : AVG 7.5.557 7.5.557 (Activated) C:\ (Local Disk) - NTFS - Total:39 Go (Free:9 Go) D:\ (CD or DVD) E:\ (Local Disk) - NTFS - Total:35 Go (Free:7 Go) F:\ (CD or DVD) G:\ (CD or DVD) Sun 03/01/2009|22:59 ———————-\\ Search.. No infections found ! 1 - "C:\Rooter$\Rooter_1.txt" - Thu 02/19/2009|23:49 2 - "C:\Rooter$\Rooter_2.txt" - Sun 03/01/2009|23:00 ———————-\\ Scan completed at 23:00

BennyLCB, How about ComboFix?

BennyLCB,

It looks like you were recontaminated by your flash drive. Did you run Flash Disninfector on it?

COMBOFIX-Script

• Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
  
  

  File::
  C:\gi2ky.exe
  C:\ur0.com
  c:\windows\system32\olhrwef.exe
  H:\ur0.com
  I:\ur0.com
  H:\svdioajm.cmd
  
  Registry::
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "cdoosoft"=-
  [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
  [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4c1ecf76-f9df-11dd-b49f-001302017674}]
  [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dfc78c34-eb16-11dd-b45d-001302017674}]

• Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
  
  [external image: Posted Image]
• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
• ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
• When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Then

Please go to Kaspersky website and perform an online antivirus scan.

• Read through the requirements and privacy statement and click on Accept button.
• It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
• When the downloads have finished, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, Adware, Dialers, and other potentially dangerous programs
    Archives
    Mail databases
• Click on My Computer under Scan.
• Once the scan is complete, it will display the results. Click on View Scan Report.
• You will see a list of infected items there. Click on Save Report As….
• Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
• Please post this log in your next reply.

In your next reply please provide:

• ComboFix.txt
• Kaspersky report
• New HijackThis log taken after everything else completed

tomk, i cant use kaspersky for some reason, im using panda activescan instead.. is it ok? here's the log.. ;******************************************************************************* ********************************************************************************* ******************* ANALYSIS: 2009-03-03 15:15:35 PROTECTIONS: 1 MALWARE: 32 SUSPECTS: 0 ;******************************************************************************* ********************************************************************************* ******************* PROTECTIONS Description Version Active Updated ;=============================================================================== ================================================================================= =================== AVG 7.5.557 7.5.557 Yes Yes ;=============================================================================== ================================================================================= =================== MALWARE Id Description Type Active Severity Disinfectable Disinfected Location ;=============================================================================== ================================================================================= =================== 00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\User\Cookies\user@doubleclick[1].txt 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\User\Cookies\user@atdmt[2].txt 00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\User\Cookies\user@mediaplex[1].txt 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\User\Cookies\user@serving-sys[1].txt 00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\User\Cookies\[removed]-sys[2].txt 00366244 Application/NirCmd.A HackTools No 0 No No C:\Documents and Settings\User\Desktop\Virus fix\Flash_Disinfector.exe[C:\Documents and Settings\User\Desktop\Virus fix\Flash_Disinfector.exe][nircmd.exe] 00390584 W32/Gamania.gen Virus No 0 Yes No C:\Qoobox\Quarantine\H\svdioajm.cmd.vir 00390584 W32/Gamania.gen Virus No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000023.exe 00390584 W32/Gamania.gen Virus No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000024.dll 00390584 W32/Gamania.gen Virus No 0 Yes No C:\Qoobox\Quarantine\C\1rfw8hjr.com.vir 00390584 W32/Gamania.gen Virus No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000030.cmd 00390584 W32/Gamania.gen Virus No 0 Yes No C:\Qoobox\Quarantine\C\svdioajm.cmd.vir 00390584 W32/Gamania.gen Virus No 0 Yes No E:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000035.cmd 00390584 W32/Gamania.gen Virus No 0 Yes No C:\Qoobox\Quarantine\E\1rfw8hjr.com.vir 00390584 W32/Gamania.gen Virus No 0 Yes No C:\Qoobox\Quarantine\C\WINDOWS\system32\ckvo.exe.vir 00390584 W32/Gamania.gen Virus No 0 Yes No C:\Qoobox\Quarantine\C\WINDOWS\system32\ckvo0.dll.vir 00390584 W32/Gamania.gen Virus No 0 Yes No C:\Qoobox\Quarantine\C\WINDOWS\system32\ckvo1.dll.vir 00390584 W32/Gamania.gen Virus No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000025.dll 00390584 W32/Gamania.gen Virus No 0 Yes No C:\Qoobox\Quarantine\E\svdioajm.cmd.vir 00429440 W32/Lineage.KAJ.worm Virus/Trojan No 1 Yes No C:\Qoobox\Quarantine\C\WINDOWS\system32\ckvo2.dll.vir 00429441 W32/Lineage.KAJ.worm Virus/Trojan No 1 Yes No C:\Qoobox\Quarantine\E\av11.zip[Qoobox/Quarantine/E/xlk9.com.vir] 00429441 W32/Lineage.KAJ.worm Virus/Trojan No 1 Yes No E:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP18\A0002449.com 00429441 W32/Lineage.KAJ.worm Virus/Trojan No 1 Yes No C:\Qoobox\Quarantine\C\xlk9.com.vir 00432608 W32/Lineage.KAY.worm Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\C\autorun.inf.vir 00432608 W32/Lineage.KAY.worm Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\E\autorun.inf.vir 00439042 W32/Lineage.KAY.worm Virus/Worm No 1 Yes No E:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000036.cmd 00439042 W32/Lineage.KAY.worm Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\E\xih9.cmd.vir 00439042 W32/Lineage.KAY.worm Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\C\xih9.cmd.vir 00443985 W32/Lineage.KDD Virus/Worm No 1 Yes No E:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000033.cmd 00443985 W32/Lineage.KDD Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\E\nq0cq.cmd.vir 00444033 W32/Autorun.ALJ.worm Virus/Worm No 1 Yes No E:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP18\A0002448.com 00444033 W32/Autorun.ALJ.worm Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\C\whi.com.vir 00444033 W32/Autorun.ALJ.worm Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\E\av11.zip[Qoobox/Quarantine/E/whi.com.vir] 00444033 W32/Autorun.ALJ.worm Virus/Worm No 1 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP18\A0002442.com 00445556 W32/Lineage.KDJ Virus No 0 Yes No C:\Qoobox\Quarantine\C\sq.com.vir 00445556 W32/Lineage.KDJ Virus No 0 Yes No C:\Qoobox\Quarantine\E\sq.com.vir 00445556 W32/Lineage.KDJ Virus No 0 Yes No E:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000034.com 00445556 W32/Lineage.KDJ Virus No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000022.com 00531079 W32/Autorun.AQG.worm Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\C\WINDOWS\system32\msqpdxrwallywq.dll.vir 00531079 W32/Autorun.AQG.worm Virus/Worm No 1 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000002.dll 00534172 Rootkit/Conficker.C Virus/Worm No 0 Yes No C:\Qoobox\Quarantine\[4]-[removed][02.tmp] 00534172 Rootkit/Conficker.C Virus/Worm No 0 Yes No C:\Qoobox\Quarantine\[4]-[removed][03.tmp] 00534172 Rootkit/Conficker.C Virus/Worm No 0 Yes No C:\Qoobox\Quarantine\[4]-[removed][01.tmp] 00534172 Rootkit/Conficker.C Virus/Worm No 0 Yes No C:\Qoobox\Quarantine\[4]-[removed][04.tmp] 00534496 W32/Conficker.C.worm Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\[4]-[removed][cgnmgrks.dll] 00585524 W32/Lineage.KMF.worm Virus/Worm No 1 Yes No E:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000031.bat 00585524 W32/Lineage.KMF.worm Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\C\1utbfd.bat.vir 00585524 W32/Lineage.KMF.worm Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\E\1utbfd.bat.vir 00585524 W32/Lineage.KMF.worm Virus/Worm No 1 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000020.bat 00586395 W32/Lineage.KNK.worm Virus/Worm No 1 Yes No E:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000032.exe 00586395 W32/Lineage.KNK.worm Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\E\2aaxaiy.exe.vir 00586395 W32/Lineage.KNK.worm Virus/Worm No 1 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000021.exe 00586395 W32/Lineage.KNK.worm Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\C\2aaxaiy.exe.vir 00587511 W32/Lineage.KMF.worm Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\E\av11.zip[Qoobox/Quarantine/E/opgde.exe.vir] 00587511 W32/Lineage.KMF.worm Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\[4]-[removed][opgde.exe] 00587511 W32/Lineage.KMF.worm Virus/Worm No 1 Yes No E:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP18\A0002445.exe 00594518 W32/Lineage.KFS Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\C\ur0.com.vir 00594518 W32/Lineage.KFS Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\[4]-[removed][ur0.com] 00594518 W32/Lineage.KFS Virus/Worm No 1 Yes No E:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP18\A0002447.com 00594518 W32/Lineage.KFS Virus/Worm No 1 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP25\A0015972.com 00594518 W32/Lineage.KFS Virus/Worm No 1 Yes No E:\ur0.com 00594518 W32/Lineage.KFS Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\E\av11.zip[Qoobox/Quarantine/E/ur0.com.vir] 00595867 W32/Lineage.KNS Virus No 0 Yes No E:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP18\A0002446.com 00595867 W32/Lineage.KNS Virus No 0 Yes No C:\Qoobox\Quarantine\[4]-[removed][qphdin.com] 00595867 W32/Lineage.KNS Virus No 0 Yes No C:\Qoobox\Quarantine\E\av11.zip[Qoobox/Quarantine/E/qphdin.com.vir] 00598764 W32/Lineage.KNV Virus No 0 Yes No C:\Qoobox\Quarantine\[4]-[removed][hyetn1i.exe] 00598764 W32/Lineage.KNV Virus No 0 Yes No E:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP18\A0002444.exe 00598764 W32/Lineage.KNV Virus No 0 Yes No C:\Qoobox\Quarantine\E\av11.zip[Qoobox/Quarantine/E/hyetn1i.exe.vir] 00599130 W32/Lineage.KNV.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP22\A0004599.dll 00602363 W32/Lineage.KNV.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000026.dll 00602363 W32/Lineage.KNV.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000027.dll 00602372 W32/Lineage.KNV Virus No 0 Yes No C:\Qoobox\Quarantine\E\av11.zip[Qoobox/Quarantine/E/cv22.cmd.vir] 00602372 W32/Lineage.KNV Virus No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000028.exe 00602372 W32/Lineage.KNV Virus No 0 Yes No E:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP18\A0002443.cmd 00602372 W32/Lineage.KNV Virus No 0 Yes No C:\Qoobox\Quarantine\[4]-[removed][cv22.cmd] 01185375 Application/Psexec.A HackTools No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP24\A0015793.EXE 01185375 Application/Psexec.A HackTools No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP18\A0002482.EXE 01185375 Application/Psexec.A HackTools No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP4\A0001338.EXE 02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP3\A0001282.sys 02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP18\A0002457.sys 02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000003.sys 02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP4\A0001310.sys 02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP24\A0015770.sys 03931361 Generic Trojan Virus/Trojan No 0 No No C:\Qoobox\Quarantine\E\av11.zip[Qoobox/Quarantine/E/App/Witcobber_RM_to_AVI_MPEG_WMV_VCD_SVCD_DVD_Converter.rar.vir][Witcobber RM to AVI MPEG WMV VCD SVCD DVD Converter\SuperRmtoAlKeygen.exe] 04199562 Generic Trojan Virus/Trojan No 0 No No C:\Qoobox\Quarantine\C\Documents and Settings\User\Desktop\5800\Smartphoneware Best Reminder v1.0.S60v5.SymbianOS9.4.Incl Keygen-HSpda.rar.vir[Smartphoneware Best Reminder v1.0.S60v5.SymbianOS9 .4.Incl Keygen-HSpda\keygen.exe] 05089776 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP24\A0015762.dll 05089776 Generic Malware Virus/Trojan No 0 Yes No C:\Qoobox\Quarantine\C\WINDOWS\system32\nmdfgds1.dll.vir 05089776 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP24\A0015763.dll 05089776 Generic Malware Virus/Trojan No 0 Yes No C:\Qoobox\Quarantine\C\WINDOWS\system32\nmdfgds0.dll.vir 05089776 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP23\A0015714.dll 05089776 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP22\A0005601.dll 05089776 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP23\A0014715.dll 05089776 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP23\A0006648.dll 05089776 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP23\A0009648.dll 05089776 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP23\A0012649.dll 05089776 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP23\A0007647.dll 05089791 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP23\A0012652.exe 05089791 Generic Malware Virus/Trojan No 0 Yes No E:\gi2ky.exe 05089791 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP22\A0002607.exe 05089791 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP23\A0015715.exe 05089791 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP24\A0015748.exe 05089791 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP25\A0015971.exe 05089791 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP24\A0015764.exe 05089791 Generic Malware Virus/Trojan No 0 Yes No C:\Qoobox\Quarantine\C\gi2ky.exe.vir 05089791 Generic Malware Virus/Trojan No 0 Yes No E:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP22\A0002608.exe 05089791 Generic Malware Virus/Trojan No 0 Yes No E:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP23\A0012653.exe 05089791 Generic Malware Virus/Trojan No 0 Yes No E:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP23\A0015716.exe 05089791 Generic Malware Virus/Trojan No 0 Yes No E:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP24\A0015749.exe 05089791 Generic Malware Virus/Trojan No 0 Yes No C:\Qoobox\Quarantine\C\WINDOWS\system32\olhrwef.exe.vir ;=============================================================================== ================================================================================= =================== SUSPECTS Sent Location ;=============================================================================== ================================================================================= =================== ;=============================================================================== ================================================================================= =================== VULNERABILITIES Id Severity Description ;=============================================================================== ================================================================================= =================== 184380 MEDIUM MS08-002 184379 MEDIUM MS08-001 182048 HIGH MS07-069 182046 HIGH MS07-067 182043 HIGH MS07-064 179553 HIGH MS07-061 176382 HIGH MS07-057 176383 HIGH MS07-058 170911 HIGH MS07-050 170907 HIGH MS07-046 170906 HIGH MS07-045 170904 HIGH MS07-043 150243 HIGH MS07-008 126087 HIGH MS06-046 120825 MEDIUM MS06-032 120823 MEDIUM MS06-030 108743 MEDIUM MS06-007 93394 HIGH MS05-050 93454 MEDIUM MS05-049 ;=============================================================================== ================================================================================= ===================