What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] I've Lost my Start Bar!

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I recognized the infection as soon as a rack of popups found their way onto my screen (they are normally effectively blocked). So I immediately ran scans with Malwarebytes, but found the more scans I tried to run, the worse the problem became (MWB could not remove some infected files, and when I ran it again, my computer shut down. Now it can't even open.) It's come to the point where my Start Bar has disappeared and I can't figure out how to restore it by any normal means. System Restore is also not working, even in Safe Mode. And to top it off, my internet connection seems to have been blocked by all of this nonsense.

I was able to run hijackthis and save it onto a flash drive in order to get online through another computer. The problem seems to have gotten progressively worse; the most recent log is posted below.

Any help would be greatly appreciated!! Thanks ~Rory
——————

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:55:29 PM, on 3/2/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Documents and Settings\meredith\Desktop\Anti-virus\HiJackThis.exe


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: BHO - {C9C42510-9B21-41c1-9DCD-8382A2D07C61} - C:\WINDOWS\system32\iehelper.dll (file missing)
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\meredith\Application Data\Macromedia\Common\3bbae0261.dll""
O4 - HKUS\S-1-5-21-3190460428-3815118845-2255937060-1006\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?')
O4 - HKUS\S-1-5-21-3190460428-3815118845-2255937060-1006\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\meredith\Application Data\Macromedia\Common\3bbae0261.dll"" (User '?')
O4 - HKUS\S-1-5-18\..\Run: [comidle] "C:\Documents and Settings\meredith\Application Data\comidle\comidle.exe" 61A847B5BBF728103B9D3B466188719AB689201522886B092CBD44BD8689220221DD3257 (User '?')
O4 - HKUS\.DEFAULT\..\Run: [comidle] "C:\Documents and Settings\meredith\Application Data\comidle\comidle.exe" 61A847B5BBF728103B9D3B466188719AB689201522886B092CBD44BD8689220221DD3257 (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Application Management (AppMgmt) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe (file missing)
O23 - Service: Windows Audio (AudioSrv) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Computer Browser (Browser) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)
O23 - Service: Cryptographic Services (CryptSvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)
O23 - Service: DCOM Server Process Launcher (DcomLaunch) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)
O23 - Service: DHCP Client (Dhcp) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: Logical Disk Manager (dmserver) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: DNS Client (Dnscache) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: Wired AutoConfig (Dot3svc) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Extensible Authentication Protocol Service (EapHost) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: Error Reporting Service (ERSvc) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: COM+ Event System (EventSystem) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: Fast User Switching Compatibility (FastUserSwitchingCompatibility) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: Help and Support (helpsvc) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: HID Input Service (HidServ) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: Health Key and Certificate Management Service (hkmsvc) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Server (lanmanserver) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)
O23 - Service: Workstation (lanmanworkstation) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: TCP/IP NetBIOS Helper (LmHosts) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)
O23 - Service: Network Access Protection Agent (napagent) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: Network Connections (Netman) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: Network Location Awareness (NLA) (Nla) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: Removable Storage (NtmsSvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)
O23 - Service: Remote Access Auto Connection Manager (RasAuto) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: Remote Access Connection Manager (RasMan) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: Remote Registry (RemoteRegistry) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)
O23 - Service: Remote Procedure Call (RPC) (RpcSs) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)
O23 - Service: Smart Card (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe (file missing)
O23 - Service: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: Secondary Logon (seclogon) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: System Event Notification (SENS) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)
O23 - Service: System Event Notification (SENS) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)
O23 - Service: Windows Firewall/Internet Connection Sharing (ICS) (SharedAccess) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: Shell Hardware Detection (ShellHWDetection) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: System Restore Service (srservice) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: SSDP Discovery Service (SSDPSRV) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: Windows Image Acquisition (WIA) (stisvc) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: Telephony (TapiSrv) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: Terminal Services (TermService) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: Themes - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: Distributed Link Tracking Client (TrkWks) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)
O23 - Service: Universal Plug and Play Device Host (upnphost) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: Uninterruptible Power Supply (UPS) - Unknown owner - C:\WINDOWS\System32\ups.exe (file missing)
O23 - Service: Windows Time (w32time) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: WebClient - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: Windows Management Instrumentation (winmgmt) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)
O23 - Service: Portable Media Serial Number Service (WmdmPmSN) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: Windows Management Instrumentation Driver Extensions (Wmi) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: Windows Driver Foundation - User-mode Driver Framework (WudfSvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)
O23 - Service: Wireless Zero Configuration (WZCSVC) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)
O23 - Service: Network Provisioning Service (xmlprov) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

–

End of file - 10569 bytes
Post #2
Hi RoryCalhoun, welcome to the forum.

Please be advised, as I'm still in training, all my replies will have to be approved by a teacher or expert before I can post them. This may cause some delays, but I will do my best to keep them as short as possible.

To make cleaning this machine easier
  • Please do not uninstall/install any programs unless asked to
    It is more difficult when files/programs are appearing in/disappearing from the logs.
  • Please do not run any scans other than those requested
  • Please follow all instructions in the order posted
  • All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
  • Do not attach any logs/reports, etc.. unless specifically requested to do so.
  • If you have problems with or do not understand the instructions, Please ask before continuing.
  • Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.
I will post back soon with additional instructions.


Thanks
Post #3
Hi RoryCalhoun,

I need you to download some tools. Since you will be using a different computer to transfer things to and from the infected computer we should try to protect it and the USB device you will be using.


Download Flash_Disinfector.exe by sUBs and save it to your desktop.
  • Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
  • The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
  • Wait until it has finished scanning and then exit the program.
Reboot your computer when done.
Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder…it will help protect your drives from future infection.



Now you will need these tools. If you don't have access to both computers at the same time, copy and paste the rest of these instructions into a notepad and save them to the USB device along with the tools.


Please download SystemLook from one of the links below and save it to your USB device.
Download Mirror #1
Download Mirror #2

Download OTListIt2 save it to your USB Device.


Please transfer all the tools to the Desktop of the infected machine.


Start with SystemLook
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
  • Do Not copy the word CODE
    :filefind
svchost.exe
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt



Next Obtain the OTListIt2 logs
  • Double click on OTList2.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt. These are saved in the same location as OTListIt2.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

Please post back with
  • SystemLook log
  • OTListIt2 logs
No need for a Hijackthis log this time.

Thanks
Post #5
oldman960,

Yes, I still need help with this. Thank you. I ran the scans you requested, which are posted below. The problem is that OTListit2 only popped up with one report. I did not get an extras.txt file. I've posted the other two logs below. Thanks for your help!!

SystemLook

SystemLook v1.0 by jpshortstuff (02.03.09)
Log created at 23:06 on 08/03/2009 by meredith (Administrator - Elevation successful)

========== filefind ==========

Searching for "svchost.exe"
C:\I386\SVCHOST.EXE –a— 29696 bytes [03:31 16/03/2004] [11:00 29/08/2002] 8A93B46E419C75233C4C5E2DBDE1D652
C:\WINDOWS\$NtServicePackUninstall$\svchost.exe —–c 31744 bytes [01:16 07/09/2008] [07:56 04/08/2004] 80820FDB78E53C5DE5FBEB8C91EBD5EF
C:\WINDOWS\ServicePackFiles\i386\svchost.exe —— 31744 bytes [07:56 04/08/2004] [00:12 14/04/2008] 47C5AA9DC237D38245FE90C4287CCF6B

-=End Of File=-


OTListit2
OTListIt logfile created on: 3/8/2009 11:17:57 PM - Run 5
OTListIt2 by OldTimer - Version 2.0.3.5 Folder = H:\Antivirus
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy


510.98 Mb Total Physical Memory | 181.61 Mb Available Physical Memory | 35.54% Memory free
1.22 Gb Paging File | 0.97 Gb Available in Paging File | 79.32% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.47 Gb Total Space | 36.72 Gb Free Space | 49.31% Space Free | Partition Type: NTFS
Drive D: | 7.73 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 1.88 Gb Total Space | 1.82 Gb Free Space | 96.42% Space Free | Partition Type: FAT
I: Drive not present or media not loaded

Computer Name: PARIS
Current User Name: meredith
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - C:\WINDOWS\system32\Ati2evxx.exe (ATI Technologies Inc.)

PRC - C:\WINDOWS\system32\Ati2evxx.exe (ATI Technologies Inc.)

PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)

PRC - C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)

PRC - C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)

PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)

PRC - C:\Program Files\AVG\AVG8\avgrsx.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files\AVG\AVG8\avgnsx.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe (Musicmatch, Inc.)

PRC - C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)

PRC - C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)

PRC - C:\Program Files\Digital Line Detect\DLG.exe (BVRP Software)

PRC - H:\Antivirus\OTListIt2.exe (OldTimer Tools)


========== Win32 Services (SafeList) ==========

SRV - (Apple Mobile Device [Auto | Running]) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)

SRV - (aspnet_state [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (Microsoft Corporation)

SRV - (Ati HotKey Poller [Auto | Running]) – C:\WINDOWS\system32\Ati2evxx.exe (ATI Technologies Inc.)

SRV - (ATI Smart [Auto | Stopped]) – File not found

SRV - (avg8emc [Auto | Stopped]) – C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)

SRV - (avg8wd [Auto | Running]) – C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)

SRV - (Bonjour Service [Auto | Running]) – C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)

SRV - (DSBrokerService [On_Demand | Stopped]) – C:\Program Files\DellSupport\brkrsvc.exe ()

SRV - (helpsvc [Auto | Stopped]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)

SRV - (iPod Service [On_Demand | Stopped]) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)

SRV - (SCardSvr [On_Demand | Stopped]) – File not found

SRV - (sprtsvc_dellsupportcenter [Auto | Running]) – C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)

SRV - (UPS [On_Demand | Stopped]) – File not found

SRV - (WinDefend [Auto | Stopped]) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)

SRV - (WMPNetworkSvc [On_Demand | Stopped]) – C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (aeaudio [On_Demand | Running]) – C:\WINDOWS\system32\drivers\aeaudio.sys (Andrea Electronics Corporation)

DRV - (AliIde [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\aliide.sys (Acer Laboratories Inc.)

DRV - (amdagp [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)

DRV - (asc [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\asc.sys (Advanced System Products, Inc.)

DRV - (asc3550 [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)

DRV - (ati2mtag [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ati2mtag.sys (ATI Technologies Inc.)

DRV - (AvgLdx86 [System | Running]) – C:\WINDOWS\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)

DRV - (AvgMfx86 [System | Running]) – C:\WINDOWS\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)

DRV - (AvgTdiX [System | Running]) – C:\WINDOWS\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)

DRV - (bcm4sbxp [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\bcm4sbxp.sys (Broadcom Corporation)

DRV - (CmdIde [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\cmdide.sys (CMD Technology, Inc.)

DRV - (dac2w2k [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\dac2w2k.sys (Mylex Corporation)

DRV - (drvmcdb [Boot | Running]) – C:\WINDOWS\system32\drivers\drvmcdb.sys (Sonic Solutions)

DRV - (drvnddm [Auto | Running]) – C:\WINDOWS\system32\drivers\drvnddm.sys (Sonic Solutions)

DRV - (DSproct [On_Demand | Stopped]) – C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys (Gteko Ltd.)

DRV - (dsunidrv [Auto | Running]) – C:\WINDOWS\system32\DRIVERS\dsunidrv.sys (Gteko Ltd.)

DRV - (EL90XBC [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\el90xbc5.sys (3Com Corporation)

DRV - (GEARAspiWDM [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys (GEAR Software Inc.)

DRV - (HSFHWBS2 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\HSFHWBS2.sys (Conexant Systems, Inc.)

DRV - (HSF_DP [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\HSF_DP.sys (Conexant Systems, Inc.)

DRV - (i81x [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\i81xnt5.sys (Intel® Corporation)

DRV - (iAimFP0 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\wADV01nt.sys (Intel® Corporation)

DRV - (iAimFP1 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\wADV02NT.sys (Intel® Corporation)

DRV - (iAimFP2 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\wADV05NT.sys (Intel® Corporation)

DRV - (iAimFP3 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\wSiINTxx.sys (Intel® Corporation)

DRV - (iAimFP4 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\wVchNTxx.sys (Intel® Corporation)

DRV - (iAimTV0 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\wATV01nt.sys (Intel® Corporation)

DRV - (iAimTV1 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\wATV02NT.sys (Intel® Corporation)

DRV - (iAimTV3 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\wATV04nt.sys (Intel® Corporation)

DRV - (iAimTV4 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\wCh7xxNT.sys (Intel® Corporation)

DRV - (ialm [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\ialmnt5.sys (Intel Corporation)

DRV - (MBAMSwissArmy [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)

DRV - (mdmxsdk [Auto | Running]) – C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys (Conexant)

DRV - (mraid35x [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\mraid35x.sys (American Megatrends Inc.)

DRV - (MxlW2k [On_Demand | Running]) – C:\WINDOWS\System32\drivers\MxlW2k.sys (MusicMatch, Inc.)

DRV - (Ndisprot [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\Ndisprot.sys (Windows ® Codename Longhorn DDK provider)

DRV - (nv [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)

DRV - (omci [System | Running]) – C:\WINDOWS\System32\DRIVERS\omci.sys (Dell Computer Corporation)

DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)

DRV - (PxHelp20 [Boot | Running]) – C:\WINDOWS\System32\DRIVERS\PxHelp20.sys (Sonic Solutions)

DRV - (ql1080 [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\ql1080.sys (QLogic Corporation)

DRV - (ql12160 [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\ql12160.sys (QLogic Corporation)

DRV - (ql1280 [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\ql1280.sys (QLogic Corporation)

DRV - (Secdrv [Auto | Running]) – C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)

DRV - (sisagp [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)

DRV - (smwdm [On_Demand | Running]) – C:\WINDOWS\system32\drivers\smwdm.sys (Analog Devices, Inc.)

DRV - (Sparrow [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\sparrow.sys (Adaptec, Inc.)

DRV - (sptd [Boot | Running]) – C:\WINDOWS\System32\Drivers\sptd.sys ()

DRV - (sscdbhk5 [System | Running]) – C:\WINDOWS\system32\drivers\sscdbhk5.sys (Sonic Solutions)

DRV - (ssrtln [System | Running]) – C:\WINDOWS\system32\drivers\ssrtln.sys (Sonic Solutions)

DRV - (symc810 [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\symc810.sys (Symbios Logic Inc.)

DRV - (symc8xx [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\symc8xx.sys (LSI Logic)

DRV - (sym_hi [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\sym_hi.sys (LSI Logic)

DRV - (sym_u3 [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\sym_u3.sys (LSI Logic)

DRV - (tfsnboio [Auto | Running]) – C:\WINDOWS\system32\dla\tfsnboio.sys (Sonic Solutions)

DRV - (tfsncofs [Auto | Running]) – C:\WINDOWS\system32\dla\tfsncofs.sys (Sonic Solutions)

DRV - (tfsndrct [Auto | Running]) – C:\WINDOWS\system32\dla\tfsndrct.sys (Sonic Solutions)

DRV - (tfsndres [Auto | Running]) – C:\WINDOWS\system32\dla\tfsndres.sys (Sonic Solutions)

DRV - (tfsnifs [Auto | Running]) – C:\WINDOWS\system32\dla\tfsnifs.sys (Sonic Solutions)

DRV - (tfsnopio [Auto | Running]) – C:\WINDOWS\system32\dla\tfsnopio.sys (Sonic Solutions)

DRV - (tfsnpool [Auto | Running]) – C:\WINDOWS\system32\dla\tfsnpool.sys (Sonic Solutions)

DRV - (tfsnudf [Auto | Running]) – C:\WINDOWS\system32\dla\tfsnudf.sys (Sonic Solutions)

DRV - (tfsnudfa [Auto | Running]) – C:\WINDOWS\system32\dla\tfsnudfa.sys (Sonic Solutions)

DRV - (ultra [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\ultra.sys (Promise Technology, Inc.)

DRV - (USBAAPL [On_Demand | Stopped]) – C:\WINDOWS\System32\Drivers\usbaapl.sys (Apple, Inc.)

DRV - (usbaudio [On_Demand | Running]) – C:\WINDOWS\system32\drivers\usbaudio.sys (Microsoft Corporation)

DRV - (winachsf [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys (Conexant Systems, Inc.)

DRV - ({6080A529-897E-4629-A488-ABA0C29B635E} [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\ialmsbw.sys (Intel Corporation)

DRV - ({D31A0762-0CEB-444e-ACFF-B049A1F6FE91} [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\ialmkchw.sys (Intel Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.startup.homepage: "http://www.msn.com/"

FF - prefs.js..extensions.enabledItems: {07910FC2-3D75-4F9E-A5C3-172FDC662C14}:1.0

FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:8.0

FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.6

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71} -> %ProgramFiles%\AVG\AVG8\FIREFOX [C:\PROGRAM FILES\AVG\AVG8\FIREFOX] -> [2009/02/09 00:52:28 00,000,000 | —D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.0.6\extensions\\Components -> %ProgramFiles%\MOZILLA FIREFOX\COMPONENTS [C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS] -> [2009/02/10 19:51:03 00,000,000 | —D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.0.6\extensions\\Plugins -> %ProgramFiles%\MOZILLA FIREFOX\PLUGINS [C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS] -> [2009/02/04 18:32:48 00,000,000 | —D | M]

FF - C:\Documents and Settings\meredith\Application Data\mozilla\Extensions [2008/12/02 00:38:05 00,000,000 | —D | M]

FF - C:\Documents and Settings\meredith\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2008/12/02 00:38:05 00,000,000 | —D | M]

FF - C:\Documents and Settings\meredith\Application Data\mozilla\Firefox\Profiles\ay6h9aav.default\extensions [2008/12/02 00:38:09 00,000,000 | —D | M]

FF - C:\Program Files\mozilla firefox\extensions [2009/03/02 17:15:29 00,000,000 | —D | M]

FF - C:\Program Files\mozilla firefox\extensions\{07910FC2-3D75-4F9E-A5C3-172FDC662C14} [2009/03/01 21:59:58 00,000,000 | —D | M]

FF - C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009/02/04 18:32:48 00,000,000 | —D | M]


O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (BHO) - {C9C42510-9B21-41c1-9DCD-8382A2D07C61} - C:\WINDOWS\system32\iehelper.dll File not found

O4 - HKLM..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter (SupportSoft, Inc.)

O4 - HKLM..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" (Apple Inc.)

O4 - HKLM..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe (Musicmatch, Inc.)

O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (Apple Inc.)

O4 - HKLM..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide (Microsoft Corporation)

O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot (BillP Studios)

O4 - HKCU..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (Microsoft Corporation)

O4 - HKCU..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\meredith\Application Data\Macromedia\Common\3bbae0261.dll"" File not found

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe (BVRP Software)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 227

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 36

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = FF FF FF FF [binary data]

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [mdnsNSP] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.

O15 - HKCU\..Trusted Domains: 22 domain(s) and sub-domain(s) not assigned to a zone.

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/8/b…heckControl.cab (Windows Genuine Advantage Validation Tool)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)

O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp Reg Error: Value error. - Reg Error: Key error. File not found

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp Reg Error: Value error. - Reg Error: Key error. File not found

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\system32\Ati2evxx.dll (ATI Technologies Inc.)

O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\system32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)

O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\system32\igfxsrvc.dll (Intel Corporation)

O24 - Desktop Components:0 (My Current Home Page) - About:Home

O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)

O31 - SafeBoot: AlternateShell - cmd.exe

O32 - HKLM CDRom: AutoRun - 1

O32 - Autorun File - C:\AUTOEXEC.BAT () - [ NTFS ]

O32 - Autorun File - C:\autorun.inf [2008/12/02 19:47:02 00,000,000 | RHSD | M] - [ NTFS ]

O32 - Autorun File - H:\autorun.inf [2008/12/02 18:47:04 00,000,000 | RHSD | M] - [ FAT ]

O33 - MountPoints2\{19cd689a-8023-11dc-9f24-000d56826c83}\Shell - "" = AutoRun

O33 - MountPoints2\{19cd689a-8023-11dc-9f24-000d56826c83}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{19cd689a-8023-11dc-9f24-000d56826c83}\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found

O33 - MountPoints2\{1fd03526-493d-11dc-9f07-00038a000015}\Shell - "" = Autorun

O33 - MountPoints2\{1fd03526-493d-11dc-9f07-00038a000015}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{1fd03526-493d-11dc-9f07-00038a000015}\Shell\Open\command - "" = E:\resycled\boot.com – File not found


========== Files/Folders - Created Within 30 Days ==========

[13 C:\WINDOWS\System32\*.tmp files]

[2 C:\WINDOWS\*.tmp files]

[2009/03/03 00:09:46 | 00,000,611 | —- | C] () – C:\Documents and Settings\meredith\Desktop\NTREGOPT.lnk

[2009/03/03 00:09:46 | 00,000,592 | —- | C] () – C:\Documents and Settings\meredith\Desktop\ERUNT.lnk

[2009/03/03 00:09:45 | 00,000,000 | —D | C] – C:\Program Files\ERUNT

[2009/03/02 22:51:56 | 53,587,5584 | -HS- | C] () – C:\hiberfil.sys

[2009/03/02 14:31:56 | 00,400,396 | —- | C] () – C:\WINDOWS\sysguard.exe

[2009/03/02 14:31:33 | 00,059,904 | —- | C] (Analog Devices Inc.) – C:\WINDOWS\Llovipoberebeva.dll

[2009/03/02 11:44:56 | 01,629,035 | -HS- | C] () – C:\WINDOWS\System32\idagebup.ini

[2009/03/02 11:44:43 | 00,578,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\uazzzigr

[2009/03/02 09:31:58 | 00,578,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\qnnkhjv

[2009/03/02 08:52:02 | 00,578,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dkozbmb

[2009/03/02 08:51:15 | 00,000,000 | —D | C] – C:\WINDOWS\Minidump

[2009/03/01 23:40:07 | 00,262,144 | —- | C] () – C:\WINDOWS\System32\nvtpm32.dll

[2009/03/01 22:48:32 | 00,578,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\efivjct

[2009/03/01 22:16:26 | 00,000,000 | —- | C] () – C:\WINDOWS\mqcd.dbt

[2009/03/01 22:15:29 | 00,028,672 | —- | C] () – C:\WINDOWS\System32\kdoqmn.sr

[2009/03/01 22:15:28 | 00,032,768 | —- | C] () – C:\WINDOWS\System32\odjan.wa

[2009/03/01 22:15:26 | 00,032,768 | —- | C] () – C:\WINDOWS\System32\kei1w.an

[2009/03/01 22:15:25 | 00,028,672 | —- | C] () – C:\WINDOWS\System32\doqkm.zt

[2009/03/01 22:15:24 | 00,077,312 | —- | C] () – C:\WINDOWS\System32\rkoq.pxf

[2009/03/01 22:15:21 | 00,578,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\user32.dll

[2009/03/01 22:15:13 | 00,000,000 | —D | C] – C:\Documents and Settings\meredith\Application Data\comidle

[2009/03/01 22:15:10 | 00,105,984 | —- | C] () – C:\WINDOWS\System32\azton.mt

[2009/03/01 22:15:05 | 00,036,352 | —- | C] () – C:\WINDOWS\xccdf16_090131a.dll

[2009/03/01 22:14:58 | 00,000,433 | —- | C] () – C:\WINDOWS\xccwinsys.ini

[2009/03/01 22:14:58 | 00,000,000 | —D | C] – C:\WINDOWS\System32\inf

[2009/03/01 22:14:32 | 00,000,000 | -HSD | C] – C:\Documents and Settings\meredith\Local Settings\Application Data\.#

[2009/02/26 21:45:41 | 00,038,400 | —- | C] () – C:\Documents and Settings\meredith\Desktop\Memo Outline.doc

[2009/02/26 19:30:07 | 00,001,864 | —- | C] () – C:\Documents and Settings\meredith\Desktop\The Rosetta Stone v2.0.6.lnk

[2009/02/14 03:41:12 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ptpusb.dll

[2009/02/14 03:41:10 | 00,015,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\usbscan.sys

[2009/02/14 03:41:10 | 00,015,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbscan.sys

[2009/02/14 03:41:00 | 00,159,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ptpusd.dll


========== Files - Modified Within 30 Days ==========

[13 C:\WINDOWS\System32\*.tmp files]

[2 C:\WINDOWS\*.tmp files]

[2009/03/08 23:07:04 | 00,002,483 | —- | M] () – C:\Documents and Settings\meredith\Desktop\Microsoft Word.lnk

[2009/03/08 23:03:28 | 00,002,048 | –S- | M] () – C:\WINDOWS\BOOTSTAT.DAT

[2009/03/08 23:03:23 | 53,587,5584 | -HS- | M] () – C:\hiberfil.sys

[2009/03/08 21:59:00 | 00,001,170 | —- | M] () – C:\WINDOWS\System32\WPA.DBL

[2009/03/03 00:16:38 | 04,842,938 | -H– | M] () – C:\Documents and Settings\meredith\Local Settings\Application Data\IconCache.db

[2009/03/03 00:09:46 | 00,000,611 | —- | M] () – C:\Documents and Settings\meredith\Desktop\NTREGOPT.lnk

[2009/03/03 00:09:46 | 00,000,592 | —- | M] () – C:\Documents and Settings\meredith\Desktop\ERUNT.lnk

[2009/03/02 16:26:28 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT

[2009/03/02 16:20:11 | 00,006,456 | -H– | M] () – C:\WINDOWS\System32\vayisude

[2009/03/02 14:31:33 | 00,059,904 | —- | M] (Analog Devices Inc.) – C:\WINDOWS\Llovipoberebeva.dll

[2009/03/02 14:31:07 | 00,400,396 | —- | M] () – C:\WINDOWS\sysguard.exe

[2009/03/02 12:08:19 | 00,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job

[2009/03/02 12:06:06 | 01,629,035 | -HS- | M] () – C:\WINDOWS\System32\idagebup.ini

[2009/03/02 11:47:04 | 00,028,672 | —- | M] () – C:\WINDOWS\System32\kdoqmn.sr

[2009/03/02 11:47:03 | 00,032,768 | —- | M] () – C:\WINDOWS\System32\odjan.wa

[2009/03/02 11:47:03 | 00,032,768 | —- | M] () – C:\WINDOWS\System32\kei1w.an

[2009/03/02 11:47:02 | 00,077,312 | —- | M] () – C:\WINDOWS\System32\rkoq.pxf

[2009/03/02 11:47:02 | 00,028,672 | —- | M] () – C:\WINDOWS\System32\doqkm.zt

[2009/03/02 11:44:40 | 00,105,984 | —- | M] () – C:\WINDOWS\System32\azton.mt

[2009/03/02 00:30:00 | 00,034,504 | —- | M] () – C:\Documents and Settings\meredith\Application Data\wklnhst.dat

[2009/03/01 23:40:07 | 00,578,560 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\user32.DLL

[2009/03/01 23:40:07 | 00,578,560 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\uazzzigr

[2009/03/01 23:40:07 | 00,578,560 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\qnnkhjv

[2009/03/01 23:40:07 | 00,578,560 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\user32.dll

[2009/03/01 23:40:07 | 00,578,560 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dkozbmb

[2009/03/01 23:40:07 | 00,262,144 | —- | M] () – C:\WINDOWS\System32\nvtpm32.dll

[2009/03/01 23:20:54 | 00,578,560 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\fxahuq

[2009/03/01 23:11:09 | 00,578,560 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ivsugsl

[2009/03/01 23:01:25 | 00,578,560 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\qycl

[2009/03/01 22:16:26 | 00,000,000 | —- | M] () – C:\WINDOWS\mqcd.dbt

[2009/03/01 22:16:00 | 00,000,433 | —- | M] () – C:\WINDOWS\xccwinsys.ini

[2009/03/01 22:15:19 | 00,578,560 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\zmzbmv

[2009/03/01 22:15:19 | 00,578,560 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\efivjct

[2009/03/01 22:15:05 | 00,036,352 | —- | M] () – C:\WINDOWS\xccdf16_090131a.dll

[2009/03/01 20:44:25 | 33,651,768 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm

[2009/02/28 19:13:23 | 00,024,151 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\microavi.avg

[2009/02/26 22:30:19 | 00,038,400 | —- | M] () – C:\Documents and Settings\meredith\Desktop\Memo Outline.doc

[2009/02/26 19:30:07 | 00,001,864 | —- | M] () – C:\Documents and Settings\meredith\Desktop\The Rosetta Stone v2.0.6.lnk

[2009/02/19 10:56:40 | 02,560,188 | —- | M] () – C:\mmjb.DDF

[2009/02/18 20:05:26 | 00,401,372 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\miniavi.avg

[2009/02/11 04:03:59 | 00,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK

[2009/02/07 10:48:40 | 00,325,128 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgldx86.sys

[2009/02/07 10:48:40 | 00,027,656 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgmfx86.sys

[2009/02/07 10:48:40 | 00,010,520 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\avgrsstx.dll

[2009/02/07 10:48:39 | 00,107,272 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgtdix.sys


========== LOP Check ==========

[2008/12/14 21:26:30 | 00,000,000 | RH-D | M] – C:\Documents and Settings\All Users\Application Data

[2008/12/03 13:16:12 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

[2008/12/14 21:26:30 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\1E261

[2008/04/06 12:07:16 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Adobe

[2007/08/13 09:24:21 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AOL

[2007/09/30 23:36:37 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Apple

[2008/12/03 13:10:54 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Apple Computer

[2009/03/02 18:27:49 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg8

[2008/03/16 16:50:00 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Dell

[2008/11/23 22:05:52 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EmailNotifier

[2008/09/28 12:28:50 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ESRI

[2008/03/10 20:21:03 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Flood Light Games

[2008/03/13 23:28:32 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Google

[2007/08/10 00:01:38 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Grisoft

[2005/05/20 20:54:16 | 00,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\GTek

[2005/04/10 12:43:03 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Intuit

[2008/09/01 20:52:07 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Macromedia

[2008/12/02 19:58:08 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Malwarebytes

[2008/11/23 22:05:53 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Megaupload

[2008/12/14 21:39:06 | 00,000,000 | –SD | M] – C:\Documents and Settings\All Users\Application Data\Microsoft

[2005/03/06 18:55:23 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Mindjet

[2008/05/06 22:02:29 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Musicnotes

[2005/03/16 10:16:44 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Napster

[2004/03/11 05:48:20 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\QuickTime

[2004/03/11 05:43:36 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SBSI

[2008/11/25 16:40:20 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

[2008/02/03 19:48:34 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SupportSoft

[2008/03/10 20:50:23 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP

[2007/08/09 22:39:06 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage

[2009/03/02 00:30:38 | 00,000,000 | RH-D | M] – C:\Documents and Settings\meredith\Application Data

[2008/08/15 23:17:39 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\Adobe

[2008/08/15 23:17:40 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\AdobeAUM

[2008/04/06 12:01:39 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\AdobeUM

[2007/08/13 09:31:00 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\Aim

[2009/02/14 03:42:15 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\Apple Computer

[2004/11/27 02:52:46 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\ATI

[2009/03/01 22:46:24 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\comidle

[2004/03/16 00:09:05 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\CyberLink

[2008/08/15 23:42:59 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\DAEMON Tools

[2008/11/23 22:06:03 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\EmailNotifier

[2008/10/05 17:38:33 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\ESRI

[2008/03/10 20:21:03 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\Flood Light Games

[2007/08/28 19:34:56 | 00,000,000 | -H-D | M] – C:\Documents and Settings\meredith\Application Data\GTek

[2004/04/03 23:48:32 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\Help

[2004/03/11 05:05:28 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\Identities

[2005/04/10 12:45:15 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\Intuit

[2007/09/30 23:33:56 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\iScreensaver

[2004/03/11 05:56:51 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\Jasc Software Inc

[2004/07/29 23:35:13 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\Leadertech

[2009/03/02 14:31:56 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\Macromedia

[2008/12/02 19:58:15 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\Malwarebytes

[2008/09/28 12:56:44 | 00,000,000 | –SD | M] – C:\Documents and Settings\meredith\Application Data\Microsoft

[2008/12/02 00:38:05 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\Mozilla

[2004/04/18 22:59:20 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\Real

[2005/03/16 10:13:58 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\Roxio

[2004/03/11 05:53:22 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\Sonic

[2004/03/11 05:34:37 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\Sun

[2004/11/18 22:51:52 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\Talkback

[2008/11/25 16:43:07 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\Twain

[2008/02/09 00:23:03 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\U3

[2008/12/14 21:43:29 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\WinPatrol

[2008/11/23 22:45:24 | 00,000,000 | —D | M] – C:\Documents and Settings\meredith\Application Data\WinRAR

[2009/02/03 16:55:10 | 00,000,284 | —- | M] () – C:\WINDOWS\Tasks\AppleSoftwareUpdate.job

[2002/08/29 07:00:00 | 00,000,065 | RH– | M] () – C:\WINDOWS\Tasks\DESKTOP.INI

[2004/03/16 23:45:00 | 00,000,258 | —- | M] () – C:\WINDOWS\Tasks\ISP signup reminder 1.job

[2009/03/02 12:08:19 | 00,000,330 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job

[2009/03/02 16:26:28 | 00,000,006 | -H– | M] () – C:\WINDOWS\Tasks\SA.DAT


========== Purity Check ==========


========== Alternate Data Streams ==========

@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F65733F1<
Post #6
Hi RoryCalhoun,



Please download Dr.Web CureIt to the USB device.Then transer it to the desktop of the infected computer.

  • Doubleclick the drweb-cureit.exe file and Allow to run the express scan
  • This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
  • Once the short scan has finished, mark the drives that you want to scan.
  • Select all drives. A red dot shows which drives have been chosen.
  • Click the green arrow at the right, and the scan will start.
  • Click 'Yes to all' if it asks if you want to cure/move the file.
  • When the scan has finished, in the menu, click file and choose save report list
  • Save the report to your desktop. The report will be called DrWeb.csv
  • Close Dr.Web Cureit.

Please post the DrWeb log and a new HJT log in your next reply.

Thanks
Post #7
Hi oldman960,

I ran the scans as you requested. When I closed DrWeb Cureit after the scans, it said it had detected threats that had no action applied to them; it suggested that I neutralize these, but I left them alone since I was unsure whether to delete, rename, or move them. The two logs are posted below.

Thanks again for your help!
~Rory


Dr. Web CureIt Log
comidle.exe;c:\documents and settings\meredith\application data\comidle;Win32.Virut.56;Cured.;
comidle.exe;c:\documents and settings\meredith\application data\comidle;Trojan.DownLoader.origin;Incurable.Moved.;
dlg.exe;c:\program files\digital line detect;Win32.Virut.56;Cured.;
msmsgs.exe;c:\program files\messenger;Win32.Virut.56;Cured.;
mm_tray.exe;c:\program files\musicmatch\musicmatch jukebox;Win32.Virut.56;Cured.;
setup50.exe;c:\program files\outlook express;Win32.Virut.56;Cured.;
qttask.exe;c:\program files\quicktime;Win32.Virut.56;Cured.;
wmpnetwk.exe;c:\program files\windows media player;Win32.Virut.56;Cured.;
explorer.exe;c:\windows;Win32.Virut.56;Cured.;
unregmp2.exe;c:\windows\inf;Win32.Virut.56;Cured.;
aspnet_state.exe;c:\windows\microsoft.net\framework\v1.1.4322;Win32.Virut.56;Cured.;
alg.exe;c:\windows\system32;Win32.Virut.56;Cured.;
ati2evxx.exe;c:\windows\system32;Win32.Virut.56;Cured.;
cisvc.exe;c:\windows\system32;Win32.Virut.56;Cured.;
clipsrv.exe;c:\windows\system32;Win32.Virut.56;Cured.;
dllhost.exe;c:\windows\system32;Win32.Virut.56;Cured.;
dmadmin.exe;c:\windows\system32;Win32.Virut.56;Cured.;
seneka.sys;c:\windows\system32\drivers;Trojan.NtRootKit.2733;Deleted.;
senekatkberxdq.sys;c:\windows\system32\drivers;Trojan.NtRootKit.2733;Deleted.;
fxssvc.exe;c:\windows\system32;Win32.Virut.56;Cured.;
ie4uinit.exe;c:\windows\system32;Win32.Virut.56;Cured.;
ieudinit.exe;c:\windows\system32;Win32.Virut.56;Cured.;
imapi.exe;c:\windows\system32;Win32.Virut.56;Cured.;
locator.exe;c:\windows\system32;Win32.Virut.56;Cured.;
logon.scr;c:\windows\system32;Win32.Virut.56;Cured.;
logonui.exe;c:\windows\system32;Win32.Virut.56;Cured.;
mnmsrvc.exe;c:\windows\system32;Win32.Virut.56;Cured.;
msiexec.exe;c:\windows\system32;Win32.Virut.56;Cured.;
netdde.exe;c:\windows\system32;Win32.Virut.56;Cured.;
ntsd.exe;c:\windows\system32;Win32.Virut.56;Cured.;
oobebaln.exe;c:\windows\system32\oobe;Win32.Virut.56;Cured.;
regsvr32.exe;c:\windows\system32;Win32.Virut.56;Cured.;
rsvp.exe;c:\windows\system32;Win32.Virut.56;Cured.;
rundll32.exe;c:\windows\system32;Win32.Virut.56;Cured.;
sessmgr.exe;c:\windows\system32;Win32.Virut.56;Cured.;
shmgrate.exe;c:\windows\system32;Win32.Virut.56;Cured.;
smlogsvc.exe;c:\windows\system32;Win32.Virut.56;Cured.;
spoolsv.exe;c:\windows\system32;Win32.Virut.56;Cured.;
tlntsvr.exe;c:\windows\system32;Win32.Virut.56;Cured.;
user32.dll;c:\windows\system32;BackDoor.Zapinit;Cured.;
userinit.exe;c:\windows\system32;Win32.Virut.56;Cured.;
vssvc.exe;c:\windows\system32;Win32.Virut.56;Cured.;
winmgmt.exe;c:\windows\system32\wbem;Win32.Virut.56;Cured.;
wmiapsrv.exe;c:\windows\system32\wbem;Win32.Virut.56;Cured.;
AtiCimUn.exe;C:\ATI\SUPPORT\wxp-w2k-catalyst-8-071-041026a-018719c;Win32.Virut.56;Cured.;
CheckVer.exe;C:\ATI\SUPPORT\wxp-w2k-catalyst-8-071-041026a-018719c;Win32.Virut.56;Cured.;
issetup.exe;C:\ATI\SUPPORT\wxp-w2k-catalyst-8-071-041026a-018719c;Win32.Virut.56;Cured.;
Setup.exe;C:\ATI\SUPPORT\wxp-w2k-catalyst-8-071-041026a-018719c;Win32.Virut.56;Cured.;
EnumDev.exe;C:\ATI\SUPPORT\wxp-w2k-catalyst-8-071-041026a-018719c\BIN;Win32.Virut.56;Cured.;
Setup.exe;C:\ATI\SUPPORT\wxp-w2k-catalyst-8-071-041026a-018719c\CPanel;Win32.Virut.56;Cured.;
Setup.exe;C:\ATI\SUPPORT\wxp-w2k-catalyst-8-071-041026a-018719c\Driver;Win32.Virut.56;Cured.;
Setup.exe;C:\ATI\SUPPORT\wxp-w2k-catalyst-8-071-041026a-018719c\WDM;Win32.Virut.56;Cured.;
AtiCimUn.exe;C:\ATI\SUPPORT\wxp-w2k-ccc-8-071-041026a-018719c-english;Win32.Virut.56;Cured.;
CheckVer.exe;C:\ATI\SUPPORT\wxp-w2k-ccc-8-071-041026a-018719c-english;Win32.Virut.56;Cured.;
issetup.exe;C:\ATI\SUPPORT\wxp-w2k-ccc-8-071-041026a-018719c-english;Win32.Virut.56;Cured.;
Setup.exe;C:\ATI\SUPPORT\wxp-w2k-ccc-8-071-041026a-018719c-english;Win32.Virut.56;Cured.;
EnumDev.exe;C:\ATI\SUPPORT\wxp-w2k-ccc-8-071-041026a-018719c-english\BIN;Win32.Virut.56;Cured.;
Setup.exe;C:\ATI\SUPPORT\wxp-w2k-ccc-8-071-041026a-018719c-english\Driver;Win32.Virut.56;Cured.;
Setup.exe;C:\ATI\SUPPORT\wxp-w2k-ccc-8-071-041026a-018719c-english\WDM;Win32.Virut.56;Cured.;
Vse800UpdateForEPO30.exe;C:\CIS\McAfee;Win32.Virut.56;Cured.;
UWAKEOFF.EXE;C:\DELL;Win32.Virut.56;Cured.;
UWAKEON.EXE;C:\DELL;Win32.Virut.56;Cured.;
TransferAgent.exe;C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent;Win32.Virut.56;Cured.;
ds3r.exe;C:\Documents and Settings\All Users\Application Data\SupportSoft\DellSupportCenter\SYSTEM\exec;Win32.Virut.56;Cured.;
NOTEPAD.EXE;C:\Documents and Settings\All Users\Application Data\SupportSoft\DellSupportCenter\_default\data\f9cd5860-4b46-43fa-aa04-46ba9e;Win32.Virut.56;Cured.;
DellSupportLauncher.exe;C:\Documents and Settings\meredith\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u1\HTML\fix;Win32.Virut.56;Cured.;
DellSupportODBK.exe;C:\Documents and Settings\meredith\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u1\HTML\fix;Win32.Virut.56;Cured.;
RunGdp.exe;C:\Documents and Settings\meredith\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u4\HTML\item_templ\coach;Win32.Virut.56;Cured.;
cleanup.exe;C:\Documents and Settings\meredith\Application Data\U3\temp;Win32.Virut.56;Cured.;
Launchpad Removal.exe;C:\Documents and Settings\meredith\Application Data\U3\temp;Win32.Virut.56;Cured.;
ATF-Cleaner.exe;C:\Documents and Settings\meredith\Desktop;Win32.Virut.56;Cured.;
backup-20081202-184836-195-PowerReg Scheduler V3.exe;C:\Documents and Settings\meredith\Desktop\Anti-virus\backups;Win32.Virut.56;Cured.;
172.exe;C:\Documents and Settings\meredith\Local Settings\temp;Win32.Virut.56;Cured.;
172.exe;C:\Documents and Settings\meredith\Local Settings\temp;Probably DLOADER.Trojan;;
adv.exe;C:\Documents and Settings\meredith\Local Settings\temp;Win32.Virut.56;Cured.;
traff.exe;C:\Documents and Settings\meredith\Local Settings\temp;Win32.Virut.56;Cured.;
traff.exe;C:\Documents and Settings\meredith\Local Settings\temp;Trojan.DownLoad.28462;Deleted.;
wJQs.exe;C:\Documents and Settings\meredith\Local Settings\temp;Win32.Virut.56;Cured.;
wJQs.exe;C:\Documents and Settings\meredith\Local Settings\temp;Trojan.DownLoad.31760;Deleted.;
maga[1].htm;C:\Documents and Settings\meredith\Local Settings\Temporary Internet Files\Content.IE5\7STLD3VM;Trojan.DownLoad.31760;Deleted.;
traff[1].exe;C:\Documents and Settings\meredith\Local Settings\Temporary Internet Files\Content.IE5\DA2U2LO9;Win32.Virut.56;Cured.;
traff[1].exe;C:\Documents and Settings\meredith\Local Settings\Temporary Internet Files\Content.IE5\DA2U2LO9;Trojan.DownLoad.28462;Deleted.;
172[1].exe;C:\Documents and Settings\meredith\Local Settings\Temporary Internet Files\Content.IE5\EW1K18UX;Win32.Virut.56;Cured.;
172[1].exe;C:\Documents and Settings\meredith\Local Settings\Temporary Internet Files\Content.IE5\EW1K18UX;Probably DLOADER.Trojan;;
adv[1].exe;C:\Documents and Settings\meredith\Local Settings\Temporary Internet Files\Content.IE5\Y123FZE5;Win32.Virut.56;Cured.;
sound tribe sector 9 MTV.mp3;C:\Documents and Settings\meredith\My Documents\BearShare;Trojan.WMALoader;Cured.;
ATF-Cleaner.exe;C:\Documents and Settings\meredith\My Documents\Flash Drive\Backup 01202009\Anti-virus;Win32.Virut.56;Cured.;
keygen.exe;C:\Documents and Settings\meredith\My Documents\From Dustin;Win32.Virut.56;Cured.;
autorun.exe;C:\Documents and Settings\meredith\My Documents\Rosetta Stone;Win32.Virut.56;Cured.;
SETUP.EXE;C:\Documents and Settings\meredith\My Documents\Rosetta Stone\Support\DRIVERS\S3\W9510103;Win32.Virut.56;Cured.;
SRSTRAY.EXE;C:\Documents and Settings\meredith\My Documents\Rosetta Stone\Support\DRIVERS\S3\W9510103;Win32.Virut.56;Cured.;
START.EXE;C:\Documents and Settings\meredith\My Documents\Rosetta Stone\Support\DRIVERS\S3\W9510103;Win32.Virut.56;Cured.;
update.exe;C:\ea934aafb74f6482194ff39b34b25562\sp2\update;Win32.Virut.56;Cured.;
IE4UINIT.EXE;C:\I386;Trojan.Packed.140;Deleted.;
LABEL.EXE;C:\I386;Win32.Virut.56;Cured.;
LIGHTS.EXE;C:\I386;Win32.Virut.56;Cured.;
LNKSTUB.EXE;C:\I386;Win32.Virut.56;Cured.;
LOCATOR.EXE;C:\I386;Win32.Virut.56;Cured.;
LODCTR.EXE;C:\I386;Win32.Virut.56;Cured.;
logagent.exe;C:\I386;Win32.Virut.56;Cured.;
LOGMAN.EXE;C:\I386;Win32.Virut.56;Cured.;
LOGOFF.EXE;C:\I386;Win32.Virut.56;Cured.;
LOGON.SCR;C:\I386;Win32.Virut.56;Cured.;
LOGONUI.EXE;C:\I386;Win32.Virut.56;Cured.;
LPQ.EXE;C:\I386;Win32.Virut.56;Cured.;
LPR.EXE;C:\I386;Win32.Virut.56;Cured.;
LSASS.EXE;C:\I386;Win32.Virut.56;Cured.;
MAGNIFY.EXE;C:\I386;Win32.Virut.56;Cured.;
MAKECAB.EXE;C:\I386;Win32.Virut.56;Cured.;
MIGLOAD.EXE;C:\I386;Win32.Virut.56;Cured.;
MIGPWD.EXE;C:\I386;Win32.Virut.56;Cured.;
MIGWIZ.EXE;C:\I386;Win32.Virut.56;Cured.;
MIGWIZ_A.EXE;C:\I386;Win32.Virut.56;Cured.;
MMC.EXE;C:\I386;Win32.Virut.56;Cured.;
MNMSRVC.EXE;C:\I386;Win32.Virut.56;Cured.;
MOBSYNC.EXE;C:\I386;Win32.Virut.56;Cured.;
MOFCOMP.EXE;C:\I386;Win32.Virut.56;Cured.;
MOUNTVOL.EXE;C:\I386;Win32.Virut.56;Cured.;
MPLAY32.EXE;C:\I386;Win32.Virut.56;Cured.;
MPLAYER2.EXE;C:\I386;Win32.Virut.56;Cured.;
MPNOTIFY.EXE;C:\I386;Win32.Virut.56;Cured.;
MQBKUP.EXE;C:\I386;Win32.Virut.56;Cured.;
MQSVC.EXE;C:\I386;Win32.Virut.56;Cured.;
MQTGSVC.EXE;C:\I386;Win32.Virut.56;Cured.;
MRINFO.EXE;C:\I386;Win32.Virut.56;Cured.;
MSDTC.EXE;C:\I386;Win32.Virut.56;Cured.;
MSG.EXE;C:\I386;Win32.Virut.56;Cured.;
MSHEARTS.EXE;C:\I386;Win32.Virut.56;Cured.;
MSHTA.EXE;C:\I386;Win32.Virut.56;Cured.;
MSIEXEC.EXE;C:\I386;Win32.Virut.56;Cured.;
MSIMN.EXE;C:\I386;Win32.Virut.56;Cured.;
MSINFO32.EXE;C:\I386;Win32.Virut.56;Cured.;
MSOOBE.EXE;C:\I386;Win32.Virut.56;Cured.;
MSPAINT.EXE;C:\I386;Win32.Virut.56;Cured.;
MSSWCHX.EXE;C:\I386;Win32.Virut.56;Cured.;
MSTINIT.EXE;C:\I386;Win32.Virut.56;Cured.;
MSTSC.EXE;C:\I386;Win32.Virut.56;Cured.;
NARRATOR.EXE;C:\I386;Win32.Virut.56;Cured.;
NBTSTAT.EXE;C:\I386;Win32.Virut.56;Cured.;
NDDEAPIR.EXE;C:\I386;Win32.Virut.56;Cured.;
NET.EXE;C:\I386;Win32.Virut.56;Cured.;
NET1.EXE;C:\I386;Win32.Virut.56;Cured.;
NETDDE.EXE;C:\I386;Win32.Virut.56;Cured.;
NETSETUP.EXE;C:\I386;Win32.Virut.56;Cured.;
NETSH.EXE;C:\I386;Win32.Virut.56;Cured.;
NETSTAT.EXE;C:\I386;Win32.Virut.56;Cured.;
NOTEPAD.EXE;C:\I386;Win32.Virut.56;Cured.;
NPPAGENT.EXE;C:\I386;Win32.Virut.56;Cured.;
NSLOOKUP.EXE;C:\I386;Win32.Virut.56;Cured.;
NTBACKUP.EXE;C:\I386;Win32.Virut.56;Cured.;
NTSD.EXE;C:\I386;Win32.Virut.56;Cured.;
NTVDM.EXE;C:\I386;Win32.Virut.56;Cured.;
NWSCRIPT.EXE;C:\I386;Win32.Virut.56;Cured.;
ODBCAD32.EXE;C:\I386;Win32.Virut.56;Cured.;
ODBCCONF.EXE;C:\I386;Win32.Virut.56;Cured.;
OEMIG50.EXE;C:\I386;Win32.Virut.56;Cured.;
OFFPRV10.EXE;C:\I386;Win32.Virut.56;Cured.;
OOBEBALN.EXE;C:\I386;Win32.Virut.56;Cured.;
openfiles.exe;C:\I386;Win32.Virut.56;Cured.;
orun32.exe;C:\I386;Win32.Virut.56;Cured.;
osk.exe;C:\I386;Win32.Virut.56;Cured.;
OSUNINST.EXE;C:\I386;Win32.Virut.56;Cured.;
ounins32_s.exe;C:\I386;Win32.Virut.56;Cured.;
PACKAGER.EXE;C:\I386;Win32.Virut.56;Cured.;
PATHPING.EXE;C:\I386;Win32.Virut.56;Cured.;
PENTNT.EXE;C:\I386;Win32.Virut.56;Cured.;
PERFMON.EXE;C:\I386;Win32.Virut.56;Cured.;
PINBALL.EXE;C:\I386;Win32.Virut.56;Cured.;
PING.EXE;C:\I386;Win32.Virut.56;Cured.;
PING6.EXE;C:\I386;Win32.Virut.56;Cured.;
PRINT.EXE;C:\I386;Win32.Virut.56;Cured.;
PROGMAN.EXE;C:\I386;Win32.Virut.56;Cured.;
PROQUOTA.EXE;C:\I386;Win32.Virut.56;Cured.;
PROXYCFG.EXE;C:\I386;Win32.Virut.56;Cured.;
QAPPSRV.EXE;C:\I386;Win32.Virut.56;Cured.;
QPROCESS.EXE;C:\I386;Win32.Virut.56;Cured.;
QTPluginInstaller.exe;C:\I386;Win32.Virut.56;Cured.;
QuickTimeUpdateHelper.exe;C:\I386;Win32.Virut.56;Cured.;
QuitRemote.exe;C:\I386;Win32.Virut.56;Cured.;
QWINSTA.EXE;C:\I386;Win32.Virut.56;Cured.;
RASAUTOU.EXE;C:\I386;Win32.Virut.56;Cured.;
RASDIAL.EXE;C:\I386;Win32.Virut.56;Cured.;
RASPHONE.EXE;C:\I386;Win32.Virut.56;Cured.;
RCIMLBY.EXE;C:\I386;Win32.Virut.56;Cured.;
RCP.EXE;C:\I386;Win32.Virut.56;Cured.;
RDPCLIP.EXE;C:\I386;Win32.Virut.56;Cured.;
RDSADDIN.EXE;C:\I386;Win32.Virut.56;Cured.;
RDSHOST.EXE;C:\I386;Win32.Virut.56;Cured.;
RECOVER.EXE;C:\I386;Win32.Virut.56;Cured.;
REGEDIT.EXE;C:\I386;Win32.Virut.56;Cured.;
REGEDT32.EXE;C:\I386;Win32.Virut.56;Cured.;
REGINI.EXE;C:\I386;Win32.Virut.56;Cured.;
REGSVR32.EXE;C:\I386;Win32.Virut.56;Cured.;
regtlib.exe;C:\I386;Win32.Virut.56;Cured.;
REGWIZ.EXE;C:\I386;Win32.Virut.56;Cured.;
RELOG.EXE;C:\I386;Win32.Virut.56;Cured.;
REPLACE.EXE;C:\I386;Win32.Virut.56;Cured.;
RESET.EXE;C:\I386;Win32.Virut.56;Cured.;
REXEC.EXE;C:\I386;Win32.Virut.56;Cured.;
ROUTE.EXE;C:\I386;Win32.Virut.56;Cured.;
ROUTEMON.EXE;C:\I386;Win32.Virut.56;Cured.;
RSH.EXE;C:\I386;Win32.Virut.56;Cured.;
RSM.EXE;C:\I386;Win32.Virut.56;Cured.;
RSMSINK.EXE;C:\I386;Win32.Virut.56;Cured.;
RSMUI.EXE;C:\I386;Win32.Virut.56;Cured.;
RSNOTIFY.EXE;C:\I386;Win32.Virut.56;Cured.;
RSOPPROV.EXE;C:\I386;Win32.Virut.56;Cured.;
RSTRUI.EXE;C:\I386;Win32.Virut.56;Cured.;
RSVP.EXE;C:\I386;Win32.Virut.56;Cured.;
RTCSHARE.EXE;C:\I386;Win32.Virut.56;Cured.;
RUNAS.EXE;C:\I386;Win32.Virut.56;Cured.;
RUNDLL32.EXE;C:\I386;Win32.Virut.56;Cured.;
RUNONCE.EXE;C:\I386;Win32.Virut.56;Cured.;
RWINSTA.EXE;C:\I386;Win32.Virut.56;Cured.;
SAPISVR.EXE;C:\I386;Win32.Virut.56;Cured.;
SAVEDUMP.EXE;C:\I386;Win32.Virut.56;Cured.;
SC.EXE;C:\I386;Win32.Virut.56;Cured.;
SCARDSVR.EXE;C:\I386;Win32.Virut.56;Cured.;
SCHTASKS.EXE;C:\I386;Win32.Virut.56;Cured.;
SCRCONS.EXE;C:\I386;Win32.Virut.56;Cured.;
SCRNSAVE.SCR;C:\I386;Win32.Virut.56;Cured.;
SDBINST.EXE;C:\I386;Win32.Virut.56;Cured.;
SECEDIT.EXE;C:\I386;Win32.Virut.56;Cured.;
SERVICES.EXE;C:\I386;Win32.Virut.56;Cured.;
SESSMGR.EXE;C:\I386;Win32.Virut.56;Cured.;
SETHC.EXE;C:\I386;Win32.Virut.56;Cured.;
SETUP.EXE;C:\I386;Win32.Virut.56;Cured.;
SETUP50.EXE;C:\I386;Win32.Virut.56;Cured.;
SETUP_WM.EXE;C:\I386;Win32.Virut.56;Cured.;
SFC.EXE;C:\I386;Win32.Virut.56;Cured.;
SHADOW.EXE;C:\I386;Win32.Virut.56;Cured.;
SHMGRATE.EXE;C:\I386;Win32.Virut.56;Cured.;
SHRPUBW.EXE;C:\I386;Win32.Virut.56;Cured.;
SHUTDOWN.EXE;C:\I386;Win32.Virut.56;Cured.;
SIGVERIF.EXE;C:\I386;Win32.Virut.56;Cured.;
SKEYS.EXE;C:\I386;Win32.Virut.56;Cured.;
SMLOGSVC.EXE;C:\I386;Win32.Virut.56;Cured.;
SNDREC32.EXE;C:\I386;Win32.Virut.56;Cured.;
SNDVOL32.EXE;C:\I386;Win32.Virut.56;Cured.;
SOL.EXE;C:\I386;Win32.Virut.56;Cured.;
SORT.EXE;C:\I386;Win32.Virut.56;Cured.;
SPIDER.EXE;C:\I386;Win32.Virut.56;Cured.;
SPIISUPD.EXE;C:\I386;Win32.Virut.56;Cured.;
SPOOLSV.EXE;C:\I386;Win32.Virut.56;Cured.;
SRDIAG.EXE;C:\I386;Win32.Virut.56;Cured.;
SS3DFO.SCR;C:\I386;Win32.Virut.56;Cured.;
SSBEZIER.SCR;C:\I386;Win32.Virut.56;Cured.;
SSFLWBOX.SCR;C:\I386;Win32.Virut.56;Cured.;
SSMARQUE.SCR;C:\I386;Win32.Virut.56;Cured.;
SSMYPICS.SCR;C:\I386;Win32.Virut.56;Cured.;
SSMYST.SCR;C:\I386;Win32.Virut.56;Cured.;
SSPIPES.SCR;C:\I386;Win32.Virut.56;Cured.;
SSSTARS.SCR;C:\I386;Win32.Virut.56;Cured.;
SSTEXT3D.SCR;C:\I386;Win32.Virut.56;Cured.;
STIMON.EXE;C:\I386;Win32.Virut.56;Cured.;
SUBST.EXE;C:\I386;Win32.Virut.56;Cured.;
SVCHOST.EXE;C:\I386;Win32.Virut.56;Cured.;
SwInit.exe;C:\I386;Win32.Virut.56;Cured.;
SYNCAPP.EXE;C:\I386;Win32.Virut.56;Cured.;
SYSKEY.EXE;C:\I386;Win32.Virut.56;Cured.;
SYSOCMGR.EXE;C:\I386;Win32.Virut.56;Cured.;
SYSPARSE.EXE;C:\I386;Win32.Virut.56;Cured.;
systeminfo.exe;C:\I386;Win32.Virut.56;Cured.;
SYSTRAY.EXE;C:\I386;Win32.Virut.56;Cured.;
TASKKILL.EXE;C:\I386;Win32.Virut.56;Cured.;
TASKLIST.EXE;C:\I386;Win32.Virut.56;Cured.;
TASKMAN.EXE;C:\I386;Win32.Virut.56;Cured.;
TASKMGR.EXE;C:\I386;Win32.Virut.56;Cured.;
TCMSETUP.EXE;C:\I386;Win32.Virut.56;Cured.;
TCPSVCS.EXE;C:\I386;Win32.Virut.56;Cured.;
TELNET.EXE;C:\I386;Win32.Virut.56;Cured.;
tfswcmd.exe;C:\I386;Win32.Virut.56;Cured.;
tfswctrl.exe;C:\I386;Win32.Virut.56;Cured.;
TFTP.EXE;C:\I386;Win32.Virut.56;Cured.;
TLNTADMN.EXE;C:\I386;Win32.Virut.56;Cured.;
TLNTSESS.EXE;C:\I386;Win32.Virut.56;Cured.;
TLNTSVR.EXE;C:\I386;Win32.Virut.56;Cured.;
tourstart.exe;C:\I386;Win32.Virut.56;Cured.;
TRACERPT.EXE;C:\I386;Win32.Virut.56;Cured.;
TRACERT.EXE;C:\I386;Win32.Virut.56;Cured.;
TRACERT6.EXE;C:\I386;Win32.Virut.56;Cured.;
TSCON.EXE;C:\I386;Win32.Virut.56;Cured.;
TSCUPGRD.EXE;C:\I386;Win32.Virut.56;Cured.;
TSDISCON.EXE;C:\I386;Win32.Virut.56;Cured.;
TSKILL.EXE;C:\I386;Win32.Virut.56;Cured.;
TSSHUTDN.EXE;C:\I386;Win32.Virut.56;Cured.;
TYPEPERF.EXE;C:\I386;Win32.Virut.56;Cured.;
UNLODCTR.EXE;C:\I386;Win32.Virut.56;Cured.;
UNREGMP2.EXE;C:\I386;Win32.Virut.56;Cured.;
UNSECAPP.EXE;C:\I386;Win32.Virut.56;Cured.;
UNWISE.EXE;C:\I386;Win32.Virut.56;Cured.;
UPNPCONT.EXE;C:\I386;Win32.Virut.56;Cured.;
UPS.EXE;C:\I386;Win32.Virut.56;Cured.;
USERINIT.EXE;C:\I386;Win32.Virut.56;Cured.;
usersid.exe;C:\I386;Win32.Virut.56;Cured.;
USRMLNKA.EXE;C:\I386;Win32.Virut.56;Cured.;
USRPRBDA.EXE;C:\I386;Win32.Virut.56;Cured.;
USRSHUTA.EXE;C:\I386;Win32.Virut.56;Cured.;
UTILMAN.EXE;C:\I386;Win32.Virut.56;Cured.;
VERIFIER.EXE;C:\I386;Win32.Virut.56;Cured.;
VSSADMIN.EXE;C:\I386;Win32.Virut.56;Cured.;
VSSVC.EXE;C:\I386;Win32.Virut.56;Cured.;
W32TM.EXE;C:\I386;Win32.Virut.56;Cured.;
WAB.EXE;C:\I386;Win32.Virut.56;Cured.;
WABMIG.EXE;C:\I386;Win32.Virut.56;Cured.;
WB32.EXE;C:\I386;Win32.Virut.56;Cured.;
WBEMTEST.EXE;C:\I386;Win32.Virut.56;Cured.;
WEXTRACT.EXE;C:\I386;Win32.Virut.56;Cured.;
WIAACMGR.EXE;C:\I386;Win32.Virut.56;Cured.;
WINHLP32.EXE;C:\I386;Win32.Virut.56;Cured.;
WINLOGON.EXE;C:\I386;Win32.Virut.56;Cured.;
WINMGMT.EXE;C:\I386;Win32.Virut.56;Cured.;
WINMINE.EXE;C:\I386;Win32.Virut.56;Cured.;
WINMSD.EXE;C:\I386;Win32.Virut.56;Cured.;
WINNT32.EXE;C:\I386;Win32.Virut.56;Cured.;
WINVER.EXE;C:\I386;Win32.Virut.56;Cured.;
WMIADAP.EXE;C:\I386;Win32.Virut.56;Cured.;
WMIAPSRV.EXE;C:\I386;Win32.Virut.56;Cured.;
WMIC.EXE;C:\I386;Win32.Virut.56;Cured.;
WMIPRVSE.EXE;C:\I386;Win32.Virut.56;Cured.;
WMPLAYER.EXE;C:\I386;Win32.Virut.56;Cured.;
WMPSTUB.EXE;C:\I386;Win32.Virut.56;Cured.;
WPABALN.EXE;C:\I386;Win32.Virut.56;Cured.;
WPNPINST.EXE;C:\I386;Win32.Virut.56;Cured.;
WRITE.EXE;C:\I386;Win32.Virut.56;Cured.;
WSCRIPT.EXE;C:\I386;Win32.Virut.56;Cured.;
WUAUCLT.EXE;C:\I386;Win32.Virut.56;Cured.;
WUPDMGR.EXE;C:\I386;Win32.Virut.56;Cured.;
XCOPY.EXE;C:\I386;Win32.Virut.56;Cured.;
xpsp1hfm.exe;C:\I386;Win32.Virut.56;Cured.;
UNVM.EXE;C:\I386\JAVA;Win32.Virut.56;Cured.;
ahv.exe;C:\Program Files\Adobe\Adobe Help Viewer\1.0;Win32.Virut.56;Cured.;
AdobeUpdateManager.exe;C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps;Win32.Virut.56;Cured.;
apdproxy.exe;C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps;Win32.Virut.56;Cured.;
Photoshop Album Starter Edition.exe;C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps;Win32.Virut.56;Cured.;
PsaProxy.exe;C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps;Win32.Virut.56;Cured.;
ADB2.EXE;C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Shared_Assets\locales\en_us;Win32.Virut.56;Cured.;
HotFix64.exe;C:\Program Files\Adobe\Security Update;Win32.Virut.56;Cured.;
AolAod.exe;C:\Program Files\AOD;Win32.Virut.56;Cured.;
GenGMsg.exe;C:\Program Files\ArcGIS\ArcToolBox\Scripts;Win32.Virut.56;Cured.;
KFuncMsg.exe;C:\Program Files\ArcGIS\ArcToolBox\Scripts;Win32.Virut.56;Cured.;
MoranMsg.exe;C:\Program Files\ArcGIS\ArcToolBox\Scripts;Win32.Virut.56;Cured.;
NNMsg.exe;C:\Program Files\ArcGIS\ArcToolBox\Scripts;Win32.Virut.56;Cured.;
TestGPRAM.exe;C:\Program Files\ArcGIS\ArcToolBox\Scripts;Win32.Virut.56;Cured.;
ZRenderer.exe;C:\Program Files\ArcGIS\ArcToolBox\Scripts;Win32.Virut.56;Cured.;
agfshp.exe;C:\Program Files\ArcGIS\Bin;Win32.Virut.56;Cured.;
aisdtslist.exe;C:\Program Files\ArcGIS\Bin;Win32.Virut.56;Cured.;
aisdtsp2a.exe;C:\Program Files\ArcGIS\Bin;Win32.Virut.56;Cured.;
aisdtsr2g.exe;C:\Program Files\ArcGIS\Bin;Win32.Virut.56;Cured.;
AppESRIPrintLocal.exe;C:\Program Files\ArcGIS\Bin;Win32.Virut.56;Cured.;
AppLockMgr.exe;C:\Program Files\ArcGIS\Bin;Win32.Virut.56;Cured.;
AppROT.exe;C:\Program Files\ArcGIS\Bin;Win32.Virut.56;Cured.;
ArcCatalog.exe;C:\Program Files\ArcGIS\Bin;Win32.Virut.56;Cured.;
ArcGISAppLauncher.exe;C:\Program Files\ArcGIS\Bin;Win32.Virut.56;Cured.;
ArcGlobe.exe;C:\Program Files\ArcGIS\Bin;Win32.Virut.56;Cured.;
ArcMap.exe;C:\Program Files\ArcGIS\Bin;Win32.Virut.56;Cured.;
ARConfig.exe;C:\Program Files\ArcGIS\Bin;Win32.Virut.56;Cured.;
ArcReader.exe;C:\Program Files\ArcGIS\Bin;Win32.Virut.56;Cured.;
ArcReaderHost.exe;C:\Program Files\ArcGIS\Bin;Win32.Virut.56;Cured.;
ArcScene.exe;C:\Program Files\ArcGIS\Bin;Win32.Virut.56;Cured.;
avmifshp.exe;C:\Program Files\ArcGIS\Bin;Win32.Virut.56;Cured.;
categories.exe;C:\Program Files\ArcGIS\Bin;Win32.Virut.56;Cured.;
CatInstall.exe;C:\Program Files\ArcGIS\Bin;Win32.Virut.56;Cured.;
ESRIErrorReporter.exe;C:\Program Files\ArcGIS\Bin;Win32.Virut.56;Cured.;
esriRegSvr32.exe;C:\Program Files\ArcGIS\Bin;Win32.Virut.56;Cured.;
RegCat.exe;C:\Program Files\ArcGIS\Bin;Win32.Virut.56;Cured.;
SchematicDesigner.exe;C:\Program Files\ArcGIS\Bin;Win32.Virut.56;Cured.;
SetupSDB.exe;C:\Program Files\ArcGIS\Bin;Win32.Virut.56;Cured.;
SHAPEDXF.EXE;C:\Program Files\ArcGIS\Bin;Win32.Virut.56;Cured.;
shpagf.exe;C:\Program Files\ArcGIS\Bin;Win32.Virut.56;Cured.;
fme.exe;C:\Program Files\ArcGIS\Data Interoperability Extension;Win32.Virut.56;Cured.;
fmeview.exe;C:\Program Files\ArcGIS\Data Interoperability Extension;Win32.Virut.56;Cured.;
ora8ilist.exe;C:\Program Files\ArcGIS\Data Interoperability Extension;Win32.Virut.56;Cured.;
ora8list.exe;C:\Program Files\ArcGIS\Data Interoperability Extension;Win32.Virut.56;Cured.;
workbench.exe;C:\Program Files\ArcGIS\Data Interoperability Extension;Win32.Virut.56;Cured.;
RunTool.exe;C:\Program Files\ArcGIS\help;Win32.Virut.56;Cured.;
RunTool.exe;C:\Program Files\ArcGIS\help\gp;Win32.Virut.56;Cured.;
ISOEditContacts.exe;C:\Program Files\ArcGIS\Metadata\ISOWizard;Win32.Virut.56;Cured.;
PILauncher.exe;C:\Program Files\ArcGIS\Support;Win32.Virut.56;Cured.;
msregmso.exe;C:\Program Files\ArcGIS\Support\VBA;Win32.Virut.56;Cured.;
AdvancedArcMapSettings.exe;C:\Program Files\ArcGIS\Utilities;Win32.Virut.56;Cured.;
MakeServerStyleSet.exe;C:\Program Files\ArcGIS\Utilities;Win32.Virut.56;Cured.;
MetaIDChecker.exe;C:\Program Files\ArcGIS\Utilities;Win32.Virut.56;Cured.;
atiadaxx.exe;C:\Program Files\ATI Technologies\ATI Control Panel;Win32.Virut.56;Cured.;
atiiprxx.exe;C:\Program Files\ATI Technologies\ATI Control Panel;Win32.Virut.56;Cured.;
atiphexx.exe;C:\Program Files\ATI Technologies\ATI Control Panel;Win32.Virut.56;Cured.;
atiprbxx.exe;C:\Program Files\ATI Technologies\ATI Control Panel;Win32.Virut.56;Cured.;
atiptaxx.exe;C:\Program Files\ATI Technologies\ATI Control Panel;Win32.Virut.56;Cured.;
AtiCimUn.exe;C:\Program Files\ATI Technologies\UninstallAll;Win32.Virut.56;Cured.;
audacity.exe;C:\Program Files\Audacity;Win32.Virut.56;Cured.;
BearShare.exe;C:\Program Files\BearShare;Win32.Virut.56;Cured.;
RunMSC.dll;C:\Program Files\BearShare;Adware.SearchAid.40;;
UNWISE.EXE;C:\Program Files\BearShare;Win32.Virut.56;Cured.;
Webstats.exe;C:\Program Files\BearShare;Win32.Virut.56;Cured.;
Setup.exe;C:\Program Files\BillP Studios\WinPatrol;Win32.Virut.56;Cured.;
IDriver.exe;C:\Program Files\Common Files\InstallShield\Driver\10\Intel 32;Win32.Virut.56;Cured.;
IDriver.exe;C:\Program Files\Common Files\InstallShield\Driver\7\Intel 32;Win32.Virut.56;Cured.;
IDriver.exe;C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32;Win32.Virut.56;Cured.;
IDriver2.exe;C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32;Win32.Virut.56;Cured.;
IDriver.exe;C:\Program Files\Common Files\InstallShield\Driver\9\Intel 32;Win32.Virut.56;Cured.;
IDriver2.exe;C:\Program Files\Common Files\InstallShield\Driver\9\Intel 32;Win32.Virut.56;Cured.;
IKernel.exe;C:\Program Files\Common Files\InstallShield\engine\6\Intel 32;Win32.Virut.56;Cured.;
knlwrap.exe;C:\Program Files\Common Files\InstallShield\engine\6\Intel 32;Win32.Virut.56;Cured.;
DotNetInstaller.exe;C:\Program Files\Common Files\InstallShield\Professional\RunTime\0701\Intel32;Win32.Virut.56;Cured.;
EQNEDT32.EXE;C:\Program Files\Common Files\Microsoft Shared\Equation;Win32.Virut.56;Cured.;
msdraw.exe;C:\Program Files\Common Files\Microsoft Shared\MSDraw;Win32.Virut.56;Cured.;
MSINFO32.EXE;C:\Program Files\Common Files\Microsoft Shared\MSInfo;Win32.Virut.56;Cured.;
OFFPRV10.EXE;C:\Program Files\Common Files\Microsoft Shared\MSInfo;Win32.Virut.56;Cured.;
SrchAdmStp.exe;C:\Program Files\Common Files\Microsoft Shared\MSSearch\Bin;Win32.Virut.56;Cured.;
MSO7FTP.EXE;C:\Program Files\Common Files\Microsoft Shared\Office10;Win32.Virut.56;Cured.;
MSO7FTPA.EXE;C:\Program Files\Common Files\Microsoft Shared\Office10;Win32.Virut.56;Cured.;
MSO7FTPS.EXE;C:\Program Files\Common Files\Microsoft Shared\Office10;Win32.Virut.56;Cured.;
MSOICONS.EXE;C:\Program Files\Common Files\Microsoft Shared\Office10;Win32.Virut.56;Cured.;
ImprtWiz.exe;C:\Program Files\Common Files\Microsoft Shared\Picture It!;Win32.Virut.56;Cured.;
ENCCA.EXE;C:\Program Files\Common Files\Microsoft Shared\Reference 2004;Win32.Virut.56;Cured.;
piolch.exe;C:\Program Files\Common Files\Microsoft Shared\Shoebox;Win32.Virut.56;Cured.;
SAPISVR.EXE;C:\Program Files\Common Files\Microsoft Shared\Speech;Win32.Virut.56;Cured.;
Wrdart32.exe;C:\Program Files\Common Files\Microsoft Shared\WordArt;Win32.Virut.56;Cured.;
WkCalRem.exe;C:\Program Files\Common Files\Microsoft Shared\Works Shared;Win32.Virut.56;Cured.;
wkscal.exe;C:\Program Files\Common Files\Microsoft Shared\Works Shared;Win32.Virut.56;Cured.;
WkUFind.exe;C:\Program Files\Common Files\Microsoft Shared\Works Shared;Win32.Virut.56;Cured.;
WkUpdat2.exe;C:\Program Files\Common Files\Microsoft Shared\Works Shared;Win32.Virut.56;Cured.;
AOLMediaPlaybackControl.exe;C:\Program Files\Common Files\Nullsoft\ActiveX;Win32.Virut.56;Cured.;
realevent.exe;C:\Program Files\Common Files\Real\Update_OB;Win32.Virut.56;Cured.;
realsched.exe;C:\Program Files\Common Files\Real\Update_OB;Win32.Virut.56;Cured.;
rnathchk.exe;C:\Program Files\Common Files\Real\Update_OB;Win32.Virut.56;Cured.;
rnuninst.exe;C:\Program Files\Common Files\Real\Update_OB;Win32.Virut.56;Cured.;
rnxproc.exe;C:\Program Files\Common Files\Real\Update_OB;Win32.Virut.56;Cured.;
upgrdhlp.exe;C:\Program Files\Common Files\Real\Update_OB;Win32.Virut.56;Cured.;
sgtray.exe;C:\Program Files\Common Files\Sonic\Update Manager;Win32.Virut.56;Cured.;
SCANPST.EXE;C:\Program Files\Common Files\System\Mapi\1033;Win32.Virut.56;Cured.;
HXFSetup.exe;C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV_2702;Win32.Virut.56;Cured.;
HXFSetup.exe;C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1;Win32.Virut.56;Cured.;
CLTEST.EXE;C:\Program Files\CyberLink\PowerDVD;Win32.Virut.56;Cured.;
DDTESTER.EXE;C:\Program Files\CyberLink\PowerDVD;Win32.Virut.56;Cured.;
PowerDVD.exe;C:\Program Files\CyberLink\PowerDVD;Win32.Virut.56;Cured.;
daemon.exe;C:\Program Files\DAEMON Tools Lite;Win32.Virut.56;Cured.;
CtDrvIns.exe;C:\Program Files\Dell\Digital Jukebox Drivers;Win32.Virut.56;Cured.;
CtDrvStp.exe;C:\Program Files\Dell\Digital Jukebox Drivers;Win32.Virut.56;Cured.;
PdeSrv2.exe;C:\Program Files\Dell\Digital Jukebox Drivers;Win32.Virut.56;Cured.;
PdeSrv2.exe;C:\Program Files\Dell\JBSeries2Drv;Win32.Virut.56;Cured.;
PCM2.exe;C:\Program Files\Dell\Media Experience;Win32.Virut.56;Cured.;
PCMService.exe;C:\Program Files\Dell\Media Experience;Win32.Virut.56;Cured.;
DellSC.exe;C:\Program Files\Dell\SolutionCenter;Win32.Virut.56;Cured.;
NetWiz.exe;C:\Program Files\Dell\SolutionCenter;Win32.Virut.56;Cured.;
recycle.exe;C:\Program Files\Dell\SolutionCenter;Win32.Virut.56;Cured.;
Register.exe;C:\Program Files\Dell\SolutionCenter;Win32.Virut.56;Cured.;
launch.exe;C:\Program Files\Dell Computer\Dell Picture Studio v2.0;Win32.Virut.56;Cured.;
dsca.exe;C:\Program Files\Dell Support Center\gs_agent\custom;Win32.Virut.56;Cured.;
PcdrEngine.exe;C:\Program Files\Dell Support Center\HWDiag\bin;Win32.Virut.56;Cured.;
Direct.exe;C:\Program Files\DellSupport;Win32.Virut.56;Cured.;
DSHelp.exe;C:\Program Files\DellSupport;Win32.Virut.56;Cured.;
AUTOBACK.EXE;C:\Program Files\ERUNT;Win32.Virut.56;Cured.;
ERDNT.E_E;C:\Program Files\ERUNT;Win32.Virut.56;Cured.;
ERUNT.EXE;C:\Program Files\ERUNT;Win32.Virut.56;Cured.;
NTREGOPT.EXE;C:\Program Files\ERUNT;Win32.Virut.56;Cured.;
Setup.exe;C:\Program Files\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C};Win32.Virut.56;Cured.;
Setup.exe;C:\Program Files\InstallShield Installation Information\{2637C347-9DAD-11D6-9EA2-00055D0CA761};Win32.Virut.56;Cured.;
Setup.exe;C:\Program Files\InstallShield Installation Information\{3F92ABBB-6BBF-11D5-B229-002078017FBF};Win32.Virut.56;Cured.;
Setup.exe;C:\Program Files\InstallShield Installation Information\{43801800-CFEE-11D2-A41B-006097B55AD3};Win32.Virut.56;Cured.;
Setup.exe;C:\Program Files\InstallShield Installation Information\{45EBDA59-D33B-433A-956E-B2F236468B56};Win32.Virut.56;Cured.;
Setup.exe;C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1};Win32.Virut.56;Cured.;
Setup.exe;C:\Program Files\InstallShield Installation Information\{7F142D56-3326-11D5-B229-002078017FBF};Win32.Virut.56;Cured.;
Setup.exe;C:\Program Files\InstallShield Installation Information\{9B94BE6F-7CA3-4C40-A266-62667FF746CC};Win32.Virut.56;Cured.;
Setup.exe;C:\Program Files\InstallShield Installation Information\{E646DCF0-5A68-11D5-B229-002078017FBF};Win32.Virut.56;Cured.;
iedw.exe;C:\Program Files\Internet Explorer;Win32.Virut.56;Cured.;
icwconn1.exe;C:\Program Files\Internet Explorer\Connection Wizard;Win32.Virut.56;Cured.;
icwconn2.exe;C:\Program Files\Internet Explorer\Connection Wizard;Win32.Virut.56;Cured.;
icwrmind.exe;C:\Program Files\Internet Explorer\Connection Wizard;Win32.Virut.56;Cured.;
ICWTUTOR.EXE;C:\Program Files\Internet Explorer\Connection Wizard;Win32.Virut.56;Cured.;
inetwiz.exe;C:\Program Files\Internet Explorer\Connection Wizard;Win32.Virut.56;Cured.;
ISIGNUP.EXE;C:\Program Files\Internet Explorer\Connection Wizard;Win32.Virut.56;Cured.;
Anim.exe;C:\Program Files\Jasc Software Inc\Animation Shop 3;Win32.Virut.56;Cured.;
ConvertDB.exe;C:\Program Files\Jasc Software Inc\Paint Shop Photo Album;Win32.Virut.56;Cured.;
MovieProjector.exe;C:\Program Files\Jasc Software Inc\Paint Shop Photo Album;Win32.Virut.56;Cured.;
player.exe;C:\Program Files\Jasc Software Inc\Paint Shop Photo Album;Win32.Virut.56;Cured.;
pspa.exe;C:\Program Files\Jasc Software Inc\Paint Shop Photo Album;Win32.Virut.56;Cured.;
scandrv.exe;C:\Program Files\Jasc Software Inc\Paint Shop Photo Album;Win32.Virut.56;Cured.;
BurnCD.exe;C:\Program Files\Jasc Software Inc\Paint Shop Photo Album\system;Win32.Virut.56;Cured.;
register.exe;C:\Program Files\Jasc Software Inc\Paint Shop Photo Album\system;Win32.Virut.56;Cured.;
SplitHtml.exe;C:\Program Files\Jasc Software Inc\Paint Shop Photo Album\WebLayout\utils;Win32.Virut.56;Cured.;
Paint Shop Pro.exe;C:\Program Files\Jasc Software Inc\Paint Shop Pro 8;Win32.Virut.56;Cured.;
register.exe;C:\Program Files\Jasc Software Inc\Paint Shop Pro 8;Win32.Virut.56;Cured.;
TourSync.exe;C:\Program Files\Jasc Software Inc\Paint Shop Pro 8\Learning Center;Win32.Virut.56;Cured.;
w9xpopen.exe;C:\Program Files\Jasc Software Inc\Paint Shop Pro 8\Python Libraries;Win32.Virut.56;Cured.;
Ad-aware.exe;C:\Program Files\Lavasoft\Ad-aware 6;Win32.Virut.56;Cured.;
unregaaw.exe;C:\Program Files\Lavasoft\Ad-aware 6;Win32.Virut.56;Cured.;
UNWISE.EXE;C:\Program Files\Lavasoft\Ad-aware 6;Win32.Virut.56;Cured.;
STRunner.exe;C:\Program Files\Learn2.com\StRunner;Win32.Virut.56;Cured.;
stuninst.exe;C:\Program Files\Learn2.com\StRunner;Win32.Virut.56;Cured.;
Fireworks.exe;C:\Program Files\Macromedia\Fireworks 8;Win32.Virut.56;Cured.;
mbam.exe;C:\Program Files\Malwarebytes' Anti-Malware;Win32.Virut.56;Cured.;
setup.exe;C:\Program Files\McAfee AntiSpyware 1.00 Install;Win32.Virut.56;Cured.;
McAppins.exe;C:\Program Files\McAfee AntiSpyware 1.00 Install\MSC;Win32.Virut.56;Cured.;
setup.exe;C:\Program Files\McAfee AntiSpyware 1.00 Install\MSC;Win32.Virut.56;Cured.;
McRegWiz.exe;C:\Program Files\McAfee AntiSpyware 1.00 Install\RGW;Win32.Virut.56;Cured.;
MSMSGSIN.EXE;C:\Program Files\Messenger;Win32.Virut.56;Cured.;
encarta.exe;C:\Program Files\Microsoft Encarta\Encarta Encyclopedia Standard Edition 2004;Win32.Virut.56;Cured.;
mnyexpr.exe;C:\Program Files\Microsoft Money\System;Win32.Virut.56;Cured.;
msmoney.exe;C:\Program Files\Microsoft Money\System;Win32.Virut.56;Cured.;
MCDLC.EXE;C:\Program Files\Microsoft Office\Office10;Win32.Virut.56;Cured.;
WAVTOASF.EXE;C:\Program Files\Microsoft Office\Office10;Win32.Virut.56;Cured.;
pi.exe;C:\Program Files\Microsoft Picture It! 9;Win32.Virut.56;Cured.;
Streets.exe;C:\Program Files\Microsoft Streets and Trips;Win32.Virut.56;Cured.;
MsWorks.exe;C:\Program Files\Microsoft Works;Win32.Virut.56;Cured.;
WkDStore.exe;C:\Program Files\Microsoft Works;Win32.Virut.56;Cured.;
wkpdfsnf.exe;C:\Program Files\Microsoft Works;Win32.Virut.56;Cured.;
wkplmstp.exe;C:\Program Files\Microsoft Works;Win32.Virut.56;Cured.;
wksab.exe;C:\Program Files\Microsoft Works;Win32.Virut.56;Cured.;
wksdb.exe;C:\Program Files\Microsoft Works;Win32.Virut.56;Cured.;
wkssb.exe;C:\Program Files\Microsoft Works;Win32.Virut.56;Cured.;
wksss.exe;C:\Program Files\Microsoft Works;Win32.Virut.56;Cured.;
WksWP.exe;C:\Program Files\Microsoft Works;Win32.Virut.56;Cured.;
wkwcestp.exe;C:\Program Files\Microsoft Works;Win32.Virut.56;Cured.;
WkWdStub.exe;C:\Program Files\Microsoft Works;Win32.Virut.56;Cured.;
LAUNCHER.EXE;C:\Program Files\Microsoft Works Suite 2004\Setup;Win32.Virut.56;Cured.;
MindManager.exe;C:\Program Files\Mindjet\MindManager 5;Win32.Virut.56;Cured.;
sfxfe32.exe;C:\Program Files\Mindjet\MindManager 5;Win32.Virut.56;Cured.;
MDM_Util.exe;C:\Program Files\Modem Helper;Win32.Virut.56;Cured.;
moviemk.exe;C:\Program Files\Movie Maker;Win32.Virut.56;Cured.;
MSN6.EXE;C:\Program Files\MSN\MSNCoreFiles;Win32.Virut.56;Cured.;
BCKGZM.EXE;C:\Program Files\MSN Gaming Zone\Windows;Win32.Virut.56;Cured.;
CHKRZM.EXE;C:\Program Files\MSN Gaming Zone\Windows;Win32.Virut.56;Cured.;
HRTZZM.EXE;C:\Program Files\MSN Gaming Zone\Windows;Win32.Virut.56;Cured.;
Rvsezm.exe;C:\Program Files\MSN Gaming Zone\Windows;Win32.Virut.56;Cured.;
SHVLZM.EXE;C:\Program Files\MSN Gaming Zone\Windows;Win32.Virut.56;Cured.;
MMComReg.exe;C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox;Trojan.Packed.140;Deleted.;
mmdiag.exe;C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox;Win32.Virut.56;Cured.;
MMFWLaunch.exe;C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox;Win32.Virut.56;Cured.;
mmjb.exe;C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox;Win32.Virut.56;Cured.;
MMJBLaunch.exe;C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox;Win32.Virut.56;Cured.;
ti.exe;C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox;Win32.Virut.56;Cured.;
unmatch.exe;C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox;Win32.Virut.56;Cured.;
UNWISE.EXE;C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox;Win32.Virut.56;Cured.;
MMDiag.exe;C:\Program Files\MUSICMATCH\MUSICMATCH Update\MMJB;Win32.Virut.56;Cured.;
MMFWLaunch.exe;C:\Program Files\MUSICMATCH\MUSICMATCH Update\MMJB;Win32.Virut.56;Cured.;
mmjb.exe;C:\Program Files\MUSICMATCH\MUSICMATCH Update\MMJB;Win32.Virut.56;Cured.;
MMJBBurn.exe;C:\Program Files\MUSICMATCH\MUSICMATCH Update\MMJB;Win32.Virut.56;Cured.;
mmjblaunch.exe;C:\Program Files\MUSICMATCH\MUSICMATCH Update\MMJB;Win32.Virut.56;Cured.;
MMJBPortables.exe;C:\Program Files\MUSICMATCH\MUSICMATCH Update\MMJB;Win32.Virut.56;Cured.;
MMJBPortablesLaunch.exe;C:\Program Files\MUSICMATCH\MUSICMATCH Update\MMJB;Win32.Virut.56;Cured.;
mmjbrun.exe;C:\Program Files\MUSICMATCH\MUSICMATCH Update\MMJB;Win32.Virut.56;Cured.;
mmtask.exe;C:\Program Files\MUSICMATCH\MUSICMATCH Update\MMJB;Win32.Virut.56;Cured.;
mm_director.exe;C:\Program Files\MUSICMATCH\MUSICMATCH Update\MMJB;Win32.Virut.56;Cured.;
mm_server.exe;C:\Program Files\MUSICMATCH\MUSICMATCH Update\MMJB;Win32.Virut.56;Cured.;
mm_tray.exe;C:\Program Files\MUSICMATCH\MUSICMATCH Update\MMJB;Win32.Virut.56;Cured.;
PhilipsRemote.exe;C:\Program Files\MUSICMATCH\MUSICMATCH Update\MMJB;Win32.Virut.56;Cured.;
pxsetup.exe;C:\Program Files\MUSICMATCH\MUSICMATCH Update\MMJB;Win32.Virut.56;Cured.;
RefreshIcon.exe;C:\Program Files\MUSICMATCH\MUSICMATCH Update\MMJB;Win32.Virut.56;Cured.;
StopPhilipsRemote.exe;C:\Program Files\MUSICMATCH\MUSICMATCH Update\MMJB;Win32.Virut.56;Cured.;
TI.exe;C:\Program Files\MUSICMATCH\MUSICMATCH Update\MMJB;Win32.Virut.56;Cured.;
CB32.EXE;C:\Program Files\NetMeeting;Win32.Virut.56;Cured.;
conf.exe;C:\Program Files\NetMeeting;Win32.Virut.56;Cured.;
WB32.EXE;C:\Program Files\NetMeeting;Win32.Virut.56;Cured.;
netwaiting.exe;C:\Program Files\NetWaiting;Win32.Virut.56;Cured.;
msimn.exe;C:\Program Files\Outlook Express;Win32.Virut.56;Cured.;
oemig50.exe;C:\Program Files\Outlook Express;Win32.Virut.56;Cured.;
wab.exe;C:\Program Files\Outlook Express;Win32.Virut.56;Cured.;
wabmig.exe;C:\Program Files\Outlook Express;Win32.Virut.56;Cured.;
PictureViewer.exe;C:\Program Files\QuickTime;Win32.Virut.56;Cured.;
md5check.exe;C:\Program Files\R\R-2.7.2\bin;Win32.Virut.56;Cured.;
R.exe;C:\Program Files\R\R-2.7.2\bin;Win32.Virut.56;Cured.;
Rcmd.exe;C:\Program Files\R\R-2.7.2\bin;Win32.Virut.56;Cured.;
Rgui.exe;C:\Program Files\R\R-2.7.2\bin;Win32.Virut.56;Cured.;
Rscript.exe;C:\Program Files\R\R-2.7.2\bin;Win32.Virut.56;Cured.;
RSetReg.exe;C:\Program Files\R\R-2.7.2\bin;Win32.Virut.56;Cured.;
Rterm.exe;C:\Program Files\R\R-2.7.2\bin;Win32.Virut.56;Cured.;
tclsh85.exe;C:\Program Files\R\R-2.7.2\Tcl\bin;Win32.Virut.56;Cured.;
wish85.exe;C:\Program Files\R\R-2.7.2\Tcl\bin;Win32.Virut.56;Cured.;
realplay.exe;C:\Program Files\Real\RealPlayer;Win32.Virut.56;Cured.;
.r1pclean.exe;C:\Program Files\Real\RealPlayer\Setup;Win32.Virut.56;Cured.;
Snood.exe;C:\Program Files\Snood;Win32.Virut.56;Cured.;
dlaunin.exe;C:\Program Files\Sonic\DLA;Win32.Virut.56;Cured.;
stax.exe;C:\Program Files\Sonic\Express Labeler;Win32.Virut.56;Cured.;
RecordNow.exe;C:\Program Files\Sonic\RecordNow!;Win32.Virut.56;Cured.;
sbautoupdate.exe;C:\Program Files\SpywareBlaster;Win32.Virut.56;Cured.;
spywareblaster.exe;C:\Program Files\SpywareBlaster;Win32.Virut.56;Cured.;
pdfSaver3.exe;C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver;Win32.Virut.56;Cured.;
dlimport.exe;C:\Program Files\Windows Media Player;Win32.Virut.56;Cured.;
migrate.exe;C:\Program Files\Windows Media Player;Win32.Virut.56;Cured.;
mplayer2.exe;C:\Program Files\Windows Media Player;Win32.Virut.56;Cured.;
setup_wm.exe;C:\Program Files\Windows Media Player;Win32.Virut.56;Cured.;
wmdbexport.exe;C:\Program Files\Windows Media Player;Win32.Virut.56;Cured.;
wmlaunch.exe;C:\Program Files\Windows Media Player;Win32.Virut.56;Cured.;
wmpenc.exe;C:\Program Files\Windows Media Player;Win32.Virut.56;Cured.;
wmplayer.exe;C:\Program Files\Windows Media Player;Win32.Virut.56;Cured.;
wmpnscfg.exe;C:\Program Files\Windows Media Player;Win32.Virut.56;Cured.;
wmpshare.exe;C:\Program Files\Windows Media Player;Win32.Virut.56;Cured.;
wmsetsdk.exe;C:\Program Files\Windows Media Player;Win32.Virut.56;Cured.;
dialer.exe;C:\Program Files\Windows NT;Win32.Virut.56;Cured.;
HYPERTRM.EXE;C:\Program Files\Windows NT;Win32.Virut.56;Cured.;
wordpad.exe;C:\Program Files\Windows NT\Accessories;Win32.Virut.56;Cured.;
pinball.exe;C:\Program Files\Windows NT\Pinball;Win32.Virut.56;Cured.;
WinRAR.exe;C:\Program Files\WinRAR;Win32.Virut.56;Cured.;
python.exe;C:\Python25;Win32.Virut.56;Cured.;
pythonw.exe;C:\Python25;Win32.Virut.56;Cured.;
w9xpopen.exe;C:\Python25;Win32.Virut.56;Cured.;
AUTOBACK.EXE;C:\RECYCLER\S-1-5-21-3190460428-3815118845-2255937060-1006\Dc1;Win32.Virut.56;Cured.;
ERDNT.EXE;C:\RECYCLER\S-1-5-21-3190460428-3815118845-2255937060-1006\Dc1;Win32.Virut.56;Cured.;
ERUNT.EXE;C:\RECYCLER\S-1-5-21-3190460428-3815118845-2255937060-1006\Dc1;Win32.Virut.56;Cured.;
NTREGOPT.EXE;C:\RECYCLER\S-1-5-21-3190460428-3815118845-2255937060-1006\Dc1;Win32.Virut.56;Cured.;
beautiful garbage.scr;C:\WINDOWS;Win32.Virut.56;Cured.;
dla.exe;C:\WINDOWS;Win32.Virut.56;Cured.;
fdsv.exe;C:\WINDOWS;Win32.Virut.56;Cured.;
flashax.exe;C:\WINDOWS;Win32.Virut.56;Cured.;
grep.exe;C:\WINDOWS;Win32.Virut.56;Cured.;
hh.exe;C:\WINDOWS;Win32.Virut.56;Cured.;
ieuninst.exe;C:\WINDOWS;Win32.Virut.56;Cured.;
IsUninst.exe;C:\WINDOWS;Win32.Virut.56;Cured.;
Llovipoberebeva.dll;C:\WINDOWS;Trojan.DownLoad.28462;Deleted.;
muninst.exe;C:\WINDOWS;Win32.Virut.56;Cured.;
NCUNINST.EXE;C:\WINDOWS;Win32.Virut.56;Cured.;
NIRCMD.exe;C:\WINDOWS;Win32.Virut.56;Cured.;
notepad.exe;C:\WINDOWS;Win32.Virut.56;Cured.;
oeuninst.exe;C:\WINDOWS;Win32.Virut.56;Cured.;
Q330994.exe;C:\WINDOWS;Win32.Virut.56;Cured.;
regedit.exe;C:\WINDOWS;Win32.Virut.56;Cured.;
sed.exe;C:\WINDOWS;Win32.Virut.56;Cured.;
slrundll.exe;C:\WINDOWS;Win32.Virut.56;Cured.;
SWREG.exe;C:\WINDOWS;Win32.Virut.56;Cured.;
SWSC.exe;C:\WINDOWS;Win32.Virut.56;Cured.;
SWXCACLS.exe;C:\WINDOWS;Win32.Virut.56;Cured.;
sysguard.exe;C:\WINDOWS;Win32.Virut.56;Cured.;
sysguard.exe;C:\WINDOWS;Probably DLOADER.Trojan;;
TASKMAN.EXE;C:\WINDOWS;Win32.Virut.56;Cured.;
TWUNK_32.EXE;C:\WINDOWS;Win32.Virut.56;Cured.;
unvise32.exe;C:\WINDOWS;Win32.Virut.56;Cured.;
UNWISE.EXE;C:\WINDOWS;Win32.Virut.56;Cured.;
VFIND.exe;C:\WINDOWS;Win32.Virut.56;Cured.;
winhlp32.exe;C:\WINDOWS;Win32.Virut.56;Cured.;
xccdf16_090131a.dll;C:\WINDOWS;Trojan.Hitpop.1898;Deleted.;
zip.exe;C:\WINDOWS;Win32.Virut.56;Cured.;
update.exe;C:\WINDOWS\$hf_mig$\KB834707\update;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$hf_mig$\KB867282;Win32.Virut.56;Cured.;
update.exe;C:\WINDOWS\$hf_mig$\KB867282\update;Win32.Virut.56;Cured.;
update.exe;C:\WINDOWS\$hf_mig$\KB873333\update;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$hf_mig$\KB873339;Win32.Virut.56;Cured.;
update.exe;C:\WINDOWS\$hf_mig$\KB873339\update;Win32.Virut.56;Cured.;
iedw.exe;C:\WINDOWS\$hf_mig$\KB883939\SP2QFE;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$hf_mig$\KB885250;Win32.Virut.56;Cured.;
update.exe;C:\WINDOWS\$hf_mig$\KB885250\update;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$hf_mig$\KB885835;Win32.Virut.56;Cured.;
update.exe;C:\WINDOWS\$hf_mig$\KB885835\update;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$hf_mig$\KB885836;Win32.Virut.56;Cured.;
update.exe;C:\WINDOWS\$hf_mig$\KB885836\update;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$hf_mig$\KB886185;Win32.Virut.56;Cured.;
update.exe;C:\WINDOWS\$hf_mig$\KB886185\update;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$hf_mig$\KB887472;Win32.Virut.56;Cured.;
msmsgs.exe;C:\WINDOWS\$hf_mig$\KB887472\SP2QFE;Win32.Virut.56;Cured.;
update.exe;C:\WINDOWS\$hf_mig$\KB887472\update;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$hf_mig$\KB887742;Win32.Virut.56;Cured.;
update.exe;C:\WINDOWS\$hf_mig$\KB887742\update;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$hf_mig$\KB888113;Win32.Virut.56;Cured.;
update.exe;C:\WINDOWS\$hf_mig$\KB888113\update;Win32.Virut.56;Cured.;
update.exe;C:\WINDOWS\$hf_mig$\KB888302\update;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$hf_mig$\KB890047;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$hf_mig$\KB890175;Win32.Virut.56;Cured.;
update.exe;C:\WINDOWS\$hf_mig$\KB890175\update;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$hf_mig$\KB891781;Win32.Virut.56;Cured.;
arpidfix.exe;C:\WINDOWS\$hf_mig$\KB893756\update;Win32.Virut.56;Cured.;
hh.exe;C:\WINDOWS\$hf_mig$\KB896358\SP2QFE;Win32.Virut.56;Cured.;
spoolsv.exe;C:\WINDOWS\$hf_mig$\KB896423\SP2QFE;Win32.Virut.56;Cured.;
arpidfix.exe;C:\WINDOWS\$hf_mig$\KB896423\update;Win32.Virut.56;Cured.;
telnet.exe;C:\WINDOWS\$hf_mig$\KB896428\SP2QFE;Win32.Virut.56;Cured.;
iedw.exe;C:\WINDOWS\$hf_mig$\KB896688\SP2QFE;Win32.Virut.56;Cured.;
iedw.exe;C:\WINDOWS\$hf_mig$\KB896727\SP2QFE;Win32.Virut.56;Cured.;
arpidfix.exe;C:\WINDOWS\$hf_mig$\KB896727\update;Win32.Virut.56;Cured.;
arpidfix.exe;C:\WINDOWS\$hf_mig$\KB899587\update;Win32.Virut.56;Cured.;
arpidfix.exe;C:\WINDOWS\$hf_mig$\KB899588\update;Win32.Virut.56;Cured.;
arpidfix.exe;C:\WINDOWS\$hf_mig$\KB899589\update;Win32.Virut.56;Cured.;
arpidfix.exe;C:\WINDOWS\$hf_mig$\KB899591\update;Win32.Virut.56;Cured.;
arpidfix.exe;C:\WINDOWS\$hf_mig$\KB901017\update;Win32.Virut.56;Cured.;
migregdb.exe;C:\WINDOWS\$hf_mig$\KB902400\SP2QFE;Win32.Virut.56;Cured.;
arpidfix.exe;C:\WINDOWS\$hf_mig$\KB902400\update;Win32.Virut.56;Cured.;
arpidfix.exe;C:\WINDOWS\$hf_mig$\KB904706\update;Win32.Virut.56;Cured.;
arpidfix.exe;C:\WINDOWS\$hf_mig$\KB905414\update;Win32.Virut.56;Cured.;
arpidfix.exe;C:\WINDOWS\$hf_mig$\KB905749\update;Win32.Virut.56;Cured.;
verclsid.exe;C:\WINDOWS\$hf_mig$\KB908531\SP2QFE;Win32.Virut.56;Cured.;
agentsvr.exe;C:\WINDOWS\$hf_mig$\KB920213\SP2QFE;Win32.Virut.56;Cured.;
fltmc.exe;C:\WINDOWS\$hf_mig$\KB922582\SP2QFE;Win32.Virut.56;Cured.;
tzchange.exe;C:\WINDOWS\$hf_mig$\KB931836\SP2QFE;Win32.Virut.56;Cured.;
tzchange.exe;C:\WINDOWS\$hf_mig$\KB933360\SP2QFE;Win32.Virut.56;Cured.;
iedw.exe;C:\WINDOWS\$hf_mig$\KB933566\SP2QFE;Win32.Virut.56;Cured.;
iedw.exe;C:\WINDOWS\$hf_mig$\KB937143\SP2QFE;Win32.Virut.56;Cured.;
explorer.exe;C:\WINDOWS\$hf_mig$\KB938828\SP2QFE;Win32.Virut.56;Cured.;
iedw.exe;C:\WINDOWS\$hf_mig$\KB939653\SP2QFE;Win32.Virut.56;Cured.;
ie4uinit.exe;C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE;Win32.Virut.56;Cured.;
ieudinit.exe;C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE;Win32.Virut.56;Cured.;
iexplore.exe;C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE;Win32.Virut.56;Cured.;
ie4uinit.exe;C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE;Win32.Virut.56;Cured.;
ieudinit.exe;C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE;Win32.Virut.56;Cured.;
iexplore.exe;C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE;Win32.Virut.56;Cured.;
tzchange.exe;C:\WINDOWS\$hf_mig$\KB942763\SP2QFE;Win32.Virut.56;Cured.;
ie4uinit.exe;C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE;Win32.Virut.56;Cured.;
ieudinit.exe;C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE;Win32.Virut.56;Cured.;
iexplore.exe;C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE;Win32.Virut.56;Cured.;
ie4uinit.exe;C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE;Win32.Virut.56;Cured.;
ieudinit.exe;C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE;Win32.Virut.56;Cured.;
iexplore.exe;C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE;Win32.Virut.56;Cured.;
ie4uinit.exe;C:\WINDOWS\$hf_mig$\KB950759-IE7\SP2QFE;Win32.Virut.56;Cured.;
ieudinit.exe;C:\WINDOWS\$hf_mig$\KB950759-IE7\SP2QFE;Win32.Virut.56;Cured.;
iexplore.exe;C:\WINDOWS\$hf_mig$\KB950759-IE7\SP2QFE;Win32.Virut.56;Cured.;
tzchange.exe;C:\WINDOWS\$hf_mig$\KB951072-v2\SP2QFE;Win32.Virut.56;Cured.;
tzchange.exe;C:\WINDOWS\$hf_mig$\KB951072-v2\SP3GDR;Win32.Virut.56;Cured.;
tzchange.exe;C:\WINDOWS\$hf_mig$\KB951072-v2\SP3QFE;Win32.Virut.56;Cured.;
cscript.exe;C:\WINDOWS\$hf_mig$\KB951978\SP3QFE;Win32.Virut.56;Cured.;
wscript.exe;C:\WINDOWS\$hf_mig$\KB951978\SP3QFE;Win32.Virut.56;Cured.;
ie4uinit.exe;C:\WINDOWS\$hf_mig$\KB953838-IE7\SP2QFE;Win32.Virut.56;Cured.;
ieudinit.exe;C:\WINDOWS\$hf_mig$\KB953838-IE7\SP2QFE;Win32.Virut.56;Cured.;
iexplore.exe;C:\WINDOWS\$hf_mig$\KB953838-IE7\SP2QFE;Win32.Virut.56;Cured.;
tzchange.exe;C:\WINDOWS\$hf_mig$\KB955839\SP3QFE;Win32.Virut.56;Cured.;
ie4uinit.exe;C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE;Win32.Virut.56;Cured.;
ieudinit.exe;C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE;Win32.Virut.56;Cured.;
ie4uinit.exe;C:\WINDOWS\$hf_mig$\KB958215-IE7\SP2QFE;Win32.Virut.56;Cured.;
ieudinit.exe;C:\WINDOWS\$hf_mig$\KB958215-IE7\SP2QFE;Win32.Virut.56;Cured.;
ie4uinit.exe;C:\WINDOWS\$hf_mig$\KB961260-IE7\SP2QFE;Win32.Virut.56;Cured.;
ieudinit.exe;C:\WINDOWS\$hf_mig$\KB961260-IE7\SP2QFE;Win32.Virut.56;Cured.;
msiexec.exe;C:\WINDOWS\$MSI31Uninstall_KB893803$;Win32.Virut.56;Cured.;
actmovie.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
agentsvr.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
ahui.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
alg.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
aspnet_regiis.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
aspnet_wp.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
asr_fmt.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
asr_pfu.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
at.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
atmadm.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
attrib.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
auditusr.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
blastcln.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
bootcfg.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
cacls.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
cfgwiz.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
cipher.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
cisvc.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
cliconfg.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
clipbrd.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
clipsrv.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
cmd.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
cmdl32.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
cmmon32.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
cmstp.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
comrepl.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
comrereg.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
comsdupd.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
conf.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
conime.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
cscript.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
davcdata.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
dcomcnfg.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
defrag.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
dfrgfat.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
dfrgntfs.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
dialer.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
diantz.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
diskpart.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
dlimport.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
dmadmin.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
dmremote.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
dplaysvr.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
dpnsvr.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
dpvsetup.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
driverquery.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
dumprep.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
dvdupgrd.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
dwwin.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
dxdiag.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
eudcedit.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
evcreate.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
eventcreate.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
eventtriggers.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
evntcmd.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
evntwin.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
explorer.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
extrac32.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
faxpatch.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
findstr.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
fontview.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
forcedos.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
fp98sadm.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
fp98swin.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
fpadmcgi.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
fpcount.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
fpsrvadm.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
fsquirt.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
ftp.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
fxsclnt.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
fxssvc.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
getmac.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
grpconv.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
help.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
helpctr.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
helpsvc.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
hh.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
hscupd.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
icwconn1.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
icwconn2.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
icwrmind.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
ie4uinit.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
iedw.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
ieexec.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
iexplore.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
iexpress.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
iisrstas.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
imapi.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
inetin51.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
inetwiz.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
ipv6.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
ipxroute.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
irftp.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
locator.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
logman.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
logon.scr;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
logonui.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
lsass.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
magnify.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
makecab.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
migload.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
migwiz.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
mmc.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
mnmsrvc.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
mofcomp.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
moviemk.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
mplay32.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
mplayer2.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
mqbkup.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
mqsvc.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
mqtgsvc.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
msconfig.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
msdtc.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
mshta.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
msiexec.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
msimn.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
msiregmv.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
msmsgs.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
msoobe.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
mspaint.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
mstsc.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
muisetup.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
narrator.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
nddeapir.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
net.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
netfxupdate.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
netsetup.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
netsh.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
netstat.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
notepad.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
nslookup.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
ntbackup.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
ntvdm.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
odbcconf.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
oemig50.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
oobebaln.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
openfiles.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
opnfiles.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
osk.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
packager.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
perfmon.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
pinball.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
ping.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
pintlphr.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
powercfg.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
progman.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
proquota.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
proxycfg.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
qprocess.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
rasphone.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
rcimlby.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
rcp.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
rdpclip.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
rdsaddin.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
rdshost.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
reg.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
regedit.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
regsvr32.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
rexec.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
rsh.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
rsnotify.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
rstrui.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
rtcshare.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
rundll32.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
runonce.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
savedump.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
schtasks.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
scrcons.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
scrnsave.scr;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
sctasks.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
sdbinst.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
secedit.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
services.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
sessmgr.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
sethc.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
setregni.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
setup.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
setup50.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
shmgrate.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
shrpubw.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
shutdown.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
sigverif.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
skeys.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
slrundll.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
slserv.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
smbinst.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
smi2smir.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
smlogsvc.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
sndrec32.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
snmp.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
sort.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
spdwnwxp.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
spider.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
spiisupd.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
spnpinst.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
spoolsv.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
spupdwxp.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
ss3dfo.scr;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
ssbezier.scr;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
ssmarque.scr;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
ssmypics.scr;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
ssmyst.scr;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
sspipes.scr;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
ssstars.scr;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
stimon.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
stub_fpsrvadm.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
stub_fpsrvwin.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
svchost.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
sysocmgr.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
systeminfo.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
taskkill.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
tasklist.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
taskmgr.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
tcptest.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
tlntadmn.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
tlntsess.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
tlntsvr.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
togac.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
tourstart.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
tourstrt.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
tp4mon.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
tracerpt.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
tracert.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
tzchange.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
uploadm.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
upnpcont.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
ups.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
userinit.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
utilman.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
verclsid.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
vssvc.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
wab.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
wabmig.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
wextract.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
wiaacmgr.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
winhlp32.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
winlogon.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
winver.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
wmiadap.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
wmiapsrv.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
wmiprvse.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
wordpad.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
wpabaln.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
wscntfy.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
wscript.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
wuauclt.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
wuauclt1.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
xcopy.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
xpnetdiag.exe;C:\WINDOWS\$NtServicePackUninstall$;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB821557$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB824105$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB824141$\spuninst;Win32.Virut.56;Cured.;
comrepl.exe;C:\WINDOWS\$NtUninstallKB828741$;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB828741$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB834707$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB835732$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB837001$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB839643-DirectX9$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB840315$\spuninst;Win32.Virut.56;Cured.;
helpctr.exe;C:\WINDOWS\$NtUninstallKB840374$;Win32.Virut.56;Cured.;
hscupd.exe;C:\WINDOWS\$NtUninstallKB840374$;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB840374$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB841873$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB842773$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB873333$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB873339$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB885250$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB885835$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB885836$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB885884$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB886185$\spuninst;Win32.Virut.56;Cured.;
msmsgs.exe;C:\WINDOWS\$NtUninstallKB887472$;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB887472$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB887742$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB888113$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB888302$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB890047$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB890175$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallKB891781$\spuninst;Win32.Virut.56;Cured.;
hh.exe;C:\WINDOWS\$NtUninstallKB896358$;Win32.Virut.56;Cured.;
spoolsv.exe;C:\WINDOWS\$NtUninstallKB896423$;Win32.Virut.56;Cured.;
iedw.exe;C:\WINDOWS\$NtUninstallKB896688$;Win32.Virut.56;Cured.;
iedw.exe;C:\WINDOWS\$NtUninstallKB896727$;Win32.Virut.56;Cured.;
orun32.exe;C:\WINDOWS\$NtUninstallKB898458$;Win32.Virut.56;Cured.;
fltmc.exe;C:\WINDOWS\$NtUninstallKB922582$;Win32.Virut.56;Cured.;
orun32.exe;C:\WINDOWS\$NtUninstallKB923723$;Win32.Virut.56;Cured.;
tzchange.exe;C:\WINDOWS\$NtUninstallKB933360$;Win32.Virut.56;Cured.;
iedw.exe;C:\WINDOWS\$NtUninstallKB933566$;Win32.Virut.56;Cured.;
iedw.exe;C:\WINDOWS\$NtUninstallKB937143$;Win32.Virut.56;Cured.;
explorer.exe;C:\WINDOWS\$NtUninstallKB938828$;Win32.Virut.56;Cured.;
iedw.exe;C:\WINDOWS\$NtUninstallKB939653$;Win32.Virut.56;Cured.;
unregmp2.exe;C:\WINDOWS\$NtUninstallKB939683$;Win32.Virut.56;Cured.;
tzchange.exe;C:\WINDOWS\$NtUninstallKB942763$;Win32.Virut.56;Cured.;
tzchange.exe;C:\WINDOWS\$NtUninstallKB951072-v2$;Win32.Virut.56;Cured.;
cscript.exe;C:\WINDOWS\$NtUninstallKB951978$;Win32.Virut.56;Cured.;
wscript.exe;C:\WINDOWS\$NtUninstallKB951978$;Win32.Virut.56;Cured.;
logagent.exe;C:\WINDOWS\$NtUninstallKB952069_WM9$;Win32.Virut.56;Cured.;
tzchange.exe;C:\WINDOWS\$NtUninstallKB955839$;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallQ329390$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallQ329441$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallQ329834$\spuninst;Win32.Virut.56;Cured.;
accwiz.exe;C:\WINDOWS\$NtUninstallQ810565$;Win32.Virut.56;Cured.;
magnify.exe;C:\WINDOWS\$NtUninstallQ810565$;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallQ810565$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallQ810577$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallQ810833$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallQ811493$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallQ814033$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallQ817287$\spuninst;Win32.Virut.56;Cured.;
spuninst.exe;C:\WINDOWS\$NtUninstallQ828026$\spuninst;Win32.Virut.56;Cured.;
logagent.exe;C:\WINDOWS\$NtUninstallWMFDist11$;Win32.Virut.56;Cured.;
uwdf.exe;C:\WINDOWS\$NtUninstallWMFDist11$;Win32.Virut.56;Cured.;
wdfmgr.exe;C:\WINDOWS\$NtUninstallWMFDist11$;Win32.Virut.56;Cured.;
wmsetsdk.exe;C:\WINDOWS\$NtUninstallWMFDist11$;Win32.Virut.56;Cured.;
setup_wm.exe;C:\WINDOWS\$NtUninstallwmp11$;Win32.Virut.56;Cured.;
unregmp2.exe;C:\WINDOWS\$NtUninstallwmp11$;Win32.Virut.56;Cured.;
wmlaunch.exe;C:\WINDOWS\$NtUninstallwmp11$;Win32.Virut.56;Cured.;
wmpenc.exe;C:\WINDOWS\$NtUninstallwmp11$;Win32.Virut.56;Cured.;
wmplayer.exe;C:\WINDOWS\$NtUninstallwmp11$;Win32.Virut.56;Cured.;
ERDNT.EXE;C:\WINDOWS\ERDNT\11-30-2008;Win32.Virut.56;Cured.;
ERDNT.EXE;C:\WINDOWS\ERDNT\12-2-2008;Win32.Virut.56;Cured.;
ERDNT.EXE;C:\WINDOWS\ERDNT\3-2-2009;Win32.Virut.56;Cured.;
ERDNT.EXE;C:\WINDOWS\ERDNT\Hiv-backup;Win32.Virut.56;Cured.;
orun32.exe;C:\WINDOWS\Help\SBSI\Training;Win32.Virut.56;Cured.;
ounins32_s.exe;C:\WINDOWS\Help\SBSI\Training;Win32.Virut.56;Cured.;
usersid.exe;C:\WINDOWS\Help\SBSI\Training;Win32.Virut.56;Cured.;
ie4uinit.exe;C:\WINDOWS\ie7;Win32.Virut.56;Cured.;
iedw.exe;C:\WINDOWS\ie7;Win32.Virut.56;Cured.;
iexplore.exe;C:\WINDOWS\ie7;Win32.Virut.56;Cured.;
mshta.exe;C:\WINDOWS\ie7;Win32.Virut.56;Cured.;
ieResetIcons.exe;C:\WINDOWS\ie7\spuninst;Win32.Virut.56;Cured.;
ie4uinit.exe;C:\WINDOWS\ie7updates\KB939653-IE7;Win32.Virut.56;Cured.;
ie4uinit.exe;C:\WINDOWS\ie7updates\KB942615-IE7;Win32.Virut.56;Cured.;
ieudinit.exe;C:\WINDOWS\ie7updates\KB942615-IE7;Win32.Virut.56;Cured.;
iexplore.exe;C:\WINDOWS\ie7updates\KB942615-IE7;Win32.Virut.56;Cured.;
ie4uinit.exe;C:\WINDOWS\ie7updates\KB944533-IE7;Win32.Virut.56;Cured.;
ieudinit.exe;C:\WINDOWS\ie7updates\KB944533-IE7;Win32.Virut.56;Cured.;
iexplore.exe;C:\WINDOWS\ie7updates\KB944533-IE7;Win32.Virut.56;Cured.;
ie4uinit.exe;C:\WINDOWS\ie7updates\KB947864-IE7;Win32.Virut.56;Cured.;
ieudinit.exe;C:\WINDOWS\ie7updates\KB947864-IE7;Win32.Virut.56;Cured.;
iexplore.exe;C:\WINDOWS\ie7updates\KB947864-IE7;Win32.Virut.56;Cured.;
ie4uinit.exe;C:\WINDOWS\ie7updates\KB950759-IE7;Win32.Virut.56;Cured.;
ieudinit.exe;C:\WINDOWS\ie7updates\KB950759-IE7;Win32.Virut.56;Cured.;
iexplore.exe;C:\WINDOWS\ie7updates\KB950759-IE7;Win32.Virut.56;Cured.;
ie4uinit.exe;C:\WINDOWS\ie7updates\KB953838-IE7;Win32.Virut.56;Cured.;
ieudinit.exe;C:\WINDOWS\ie7updates\KB953838-IE7;Win32.Virut.56;Cured.;
iexplore.exe;C:\WINDOWS\ie7updates\KB953838-IE7;Win32.Virut.56;Cured.;
ie4uinit.exe;C:\WINDOWS\ie7updates\KB956390-IE7;Win32.Virut.56;Cured.;
ieudinit.exe;C:\WINDOWS\ie7updates\KB956390-IE7;Win32.Virut.56;Cured.;
iexplore.exe;C:\WINDOWS\ie7updates\KB956390-IE7;Win32.Virut.56;Cured.;
ie4uinit.exe;C:\WINDOWS\ie7updates\KB958215-IE7;Win32.Virut.56;Cured.;
ieudinit.exe;C:\WINDOWS\ie7updates\KB958215-IE7;Win32.Virut.56;Cured.;
ie4uinit.exe;C:\WINDOWS\ie7updates\KB961260-IE7;Win32.Virut.56;Cured.;
ieudinit.exe;C:\WINDOWS\ie7updates\KB961260-IE7;Win32.Virut.56;Cured.;
cplexe.exe;C:\WINDOWS\IME\IMJP8_1;Win32.Virut.56;Cured.;
imjpdadm.exe;C:\WINDOWS\IME\IMJP8_1;Win32.Virut.56;Cured.;
imjpdct.exe;C:\WINDOWS\IME\IMJP8_1;Win32.Virut.56;Cured.;
imjpdsvr.exe;C:\WINDOWS\IME\IMJP8_1;Win32.Virut.56;Cured.;
imjpinst.exe;C:\WINDOWS\IME\IMJP8_1;Win32.Virut.56;Cured.;
imjpmig.exe;C:\WINDOWS\IME\IMJP8_1;Win32.Virut.56;Cured.;
imjprw.exe;C:\WINDOWS\IME\IMJP8_1;Win32.Virut.56;Cured.;
imjpuex.exe;C:\WINDOWS\IME\IMJP8_1;Win32.Virut.56;Cured.;
imjputy.exe;C:\WINDOWS\IME\IMJP8_1;Win32.Virut.56;Cured.;
imekrmig.exe;C:\WINDOWS\IME\IMKR6_1;Win32.Virut.56;Cured.;
imkrinst.exe;C:\WINDOWS\IME\IMKR6_1;Win32.Virut.56;Cured.;
ENCSCICO.EXE;C:\WINDOWS\Installer\{04410044-9149-45C6-A806-F2BF9CFCE762};Win32.Virut.56;Cured.;
IconTmpl.E19E336B_37A7_429A_A112_A1C49FD4D9B1.exe;C:\WINDOWS\Installer\{1CF65E18-6463-4D28-A476-7DA10FBCE816};Win32.Virut.56;Cured.;
IconTmpl2.3EC467D7_636F_4FEE_B613_2BB6C00DECA3.exe;C:\WINDOWS\Installer\{1CF65E18-6463-4D28-A476-7DA10FBCE816};Win32.Virut.56;Cured.;
PLACES.EXE;C:\WINDOWS\Installer\{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227};Win32.Virut.56;Cured.;
icon.exe;C:\WINDOWS\Installer\{37477865-A3F1-4772-AD43-AAFC6BCFF99F};Win32.Virut.56;Cured.;
ARPPRODUCTICON.exe;C:\WINDOWS\Installer\{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B};Win32.Virut.56;Cured.;
NewShortcut2_4BDFD2CE632942E498019B3D1F10D79B.exe;C:\WINDOWS\Installer\{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B};Win32.Virut.56;Cured.;
NewShortcut3_4BDFD2CE632942E498019B3D1F10D79B.exe;C:\WINDOWS\Installer\{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B};Win32.Virut.56;Cured.;
ARPPRODUCTICON.exe;C:\WINDOWS\Installer\{4C24A8C1-7CFA-4650-AF15-732F5BD7B46D};Win32.Virut.56;Cured.;
Fireworks.exe_4C24A8C17CFA4650AF15732F5BD7B46D.exe;C:\WINDOWS\Installer\{4C24A8C1-7CFA-4650-AF15-732F5BD7B46D};Win32.Virut.56;Cured.;
NewShortcut3_4C24A8C17CFA4650AF15732F5BD7B46D.exe;C:\WINDOWS\Installer\{4C24A8C1-7CFA-4650-AF15-732F5BD7B46D};Win32.Virut.56;Cured.;
NewShortcut4_4C24A8C17CFA4650AF15732F5BD7B46D.exe;C:\WINDOWS\Installer\{4C24A8C1-7CFA-4650-AF15-732F5BD7B46D};Win32.Virut.56;Cured.;
icon.exe;C:\WINDOWS\Installer\{716E0306-8318-4364-8B8F-0CC4E9376BAC};Win32.Virut.56;Cured.;
NewShortcut2_F04825A0D1E9444AA8D32CE95CBF1716.exe;C:\WINDOWS\Installer\{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D};Win32.Virut.56;Cured.;
Program_FAQ_SC1_A865F9643D344747AD8AA93191B65DD3.exe;C:\WINDOWS\Installer\{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D};Win32.Virut.56;Cured.;
Program_Help_SC1_A865F9643D344747AD8AA93191B65DD3.exe;C:\WINDOWS\Installer\{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D};Win32.Virut.56;Cured.;
Anim3TryAndBuy.exe;C:\WINDOWS\Installer\{81A34902-9D0B-4920-A25C-4CDC5D14B328};Win32.Virut.56;Cured.;
DPS_SMLink.CAA7B2BB_F373_4C0B_8C62_D4147E5C816B.exe;C:\WINDOWS\Installer\{81A34902-9D0B-4920-A25C-4CDC5D14B328};Win32.Virut.56;Cured.;
NewShortcut6_81A349029D0B4920A25C4CDC5D14B328.exe;C:\WINDOWS\Installer\{81A34902-9D0B-4920-A25C-4CDC5D14B328};Win32.Virut.56;Cured.;
icon.exe;C:\WINDOWS\Installer\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71};Win32.Virut.56;Cured.;
misc.exe.D0DF3458_A845_11D3_8D0A_0050046416B9.exe;C:\WINDOWS\Installer\{8704D51E-25B7-4F23-81E7-AA4F54790210};Win32.Virut.56;Cured.;
_4A11634F506C_4669_882B_B03023E5C6D9.exe;C:\WINDOWS\Installer\{8704D51E-25B7-4F23-81E7-AA4F54790210};Win32.Virut.56;Cured.;
accicons.exe;C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9};Win32.Virut.56;Cured.;
cagicon.exe;C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9};Win32.Virut.56;Cured.;
fpicon.exe;C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9};Win32.Virut.56;Cured.;
misc.exe;C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9};Win32.Virut.56;Cured.;
mspicons.exe;C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9};Win32.Virut.56;Cured.;
opwicon.exe;C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9};Win32.Virut.56;Cured.;
outicon.exe;C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9};Win32.Virut.56;Cured.;
PEicons.exe;C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9};Win32.Virut.56;Cured.;
unbndico.exe;C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9};Win32.Virut.56;Cured.;
wordicon.exe;C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9};Win32.Virut.56;Cured.;
cagicon.exe;C:\WINDOWS\Installer\{911B0409-6000-11D3-8CFE-0050048383C9};Win32.Virut.56;Cured.;
misc.exe;C:\WINDOWS\Installer\{911B0409-6000-11D3-8CFE-0050048383C9};Win32.Virut.56;Cured.;
mspicons.exe;C:\WINDOWS\Installer\{911B0409-6000-11D3-8CFE-0050048383C9};Win32.Virut.56;Cured.;
opwicon.exe;C:\WINDOWS\Installer\{911B0409-6000-11D3-8CFE-0050048383C9};Win32.Virut.56;Cured.;
PEicons.exe;C:\WINDOWS\Installer\{911B0409-6000-11D3-8CFE-0050048383C9};Win32.Virut.56;Cured.;
unbndico.exe;C:\WINDOWS\Installer\{911B0409-6000-11D3-8CFE-0050048383C9};Win32.Virut.56;Cured.;
wordicon.exe;C:\WINDOWS\Installer\{911B0409-6000-11D3-8CFE-0050048383C9};Win32.Virut.56;Cured.;
misc.exe;C:\WINDOWS\Installer\{A13D16C5-38A9-4D96-9647-59FCCAB12A85};Win32.Virut.56;Cured.;
ARPPRODUCTICON.exe;C:\WINDOWS\Installer\{B702FCEF-5875-491C-B50C-A4B457617EC6};Win32.Virut.56;Cured.;
_55E0E6594D22_426D_A135_5224A38BBF40.exe;C:\WINDOWS\Installer\{B9966F27-9678-4620-9579-925E3084647E};Win32.Virut.56;Cured.;
_5FEAB184D2E1_4823_BD8A_1FD3BB401148.exe;C:\WINDOWS\Installer\{B9966F27-9678-4620-9579-925E3084647E};Win32.Virut.56;Cured.;
_BA9978FF5731_4DAB_9CE5_E3C183433DFA.exe;C:\WINDOWS\Installer\{B9966F27-9678-4620-9579-925E3084647E};Win32.Virut.56;Cured.;
icon.exe;C:\WINDOWS\Installer\{C04E32E0-0416-434D-AFB9-6969D703A9EF};Win32.Virut.56;Cured.;
DPS_SMLink.CAA7B2BB_F373_4C0B_8C62_D4147E5C816B.exe;C:\WINDOWS\Installer\{CC000127-5E5D-4A1C-90CB-EEAAAC1E3AC0};Win32.Virut.56;Cured.;
NewShortcut3.exe;C:\WINDOWS\Installer\{CC000127-5E5D-4A1C-90CB-EEAAAC1E3AC0};Win32.Virut.56;Cured.;
misc.exe;C:\WINDOWS\Installer\{FB97C283-1F3C-42D4-AE01-ADC1DC12F774};Win32.Virut.56;Cured.;
NETFXSBS10.exe;C:\WINDOWS\Microsoft.NET\Framework;Win32.Virut.56;Cured.;
aspnet_regiis.exe;C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322;Win32.Virut.56;Cured.;
CasPol.exe;C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322;Win32.Virut.56;Cured.;
ConfigWizards.exe;C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322;Win32.Virut.56;Cured.;
csc.exe;C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322;Win32.Virut.56;Cured.;
IEExec.exe;C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322;Win32.Virut.56;Cured.;
InstallUtil.exe;C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322;Win32.Virut.56;Cured.;
jsc.exe;C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322;Win32.Virut.56;Cured.;
MigPol.exe;C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322;Win32.Virut.56;Cured.;
MigPolWin.exe;C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322;Win32.Virut.56;Cured.;
ngen.exe;C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322;Win32.Virut.56;Cured.;
RegAsm.exe;C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322;Win32.Virut.56;Cured.;
RegSvcs.exe;C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322;Win32.Virut.56;Cured.;
hotfix.exe;C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates;Win32.Virut.56;Cured.;
agentsvr.exe;C:\WINDOWS\MSAGENT;Win32.Virut.56;Cured.;
muisetup.exe;C:\WINDOWS\MUI;Win32.Virut.56;Cured.;
xpnetdiag.exe;C:\WINDOWS\network diagnostic;Win32.Virut.56;Cured.;
helpctr.exe;C:\WINDOWS\PCHealth\HelpCtr\Binaries;Win32.Virut.56;Cured.;
HelpHost.exe;C:\WINDOWS\PCHealth\HelpCtr\Binaries;Win32.Virut.56;Cured.;
hscupd.exe;C:\WINDOWS\PCHealth\HelpCtr\Binaries;Win32.Virut.56;Cured.;
msconfig.exe;C:\WINDOWS\PCHealth\HelpCtr\Binaries;Win32.Virut.56;Cured.;
NOTIFLAG.EXE;C:\WINDOWS\PCHealth\HelpCtr\Binaries;Win32.Virut.56;Cured.;
uploadm.exe;C:\WINDOWS\PCHealth\UploadLB\Binaries;Win32.Virut.56;Cured.;
setup_wm.exe;C:\WINDOWS\RegisteredPackages\{3FDF25EE-E592-4495-8391-6E9C504DAC2B};Win32.Virut.56;Cured.;
setup_wm.exe;C:\WINDOWS\RegisteredPackages\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}$BACKUP$\System;Win32.Virut.56;Cured.;
dplaysvr.exe;C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C};Win32.Virut.56;Cured.;
dpnsvr.exe;C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C};Win32.Virut.56;Cured.;
dpvsetup.exe;C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C};Win32.Virut.56;Cured.;
dxdiag.exe;C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C};Win32.Virut.56;Cured.;
dxdllreg.exe;C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C};Win32.Virut.56;Cured.;
uwdf.exe;C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A};Win32.Virut.56;Cured.;
wdfmgr.exe;C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A};Win32.Virut.56;Cured.;
logagent.exe;C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170};Win32.Virut.56;Cured.;
logagent.exe;C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System;Win32.Virut.56;Cured.;
wmplayer.exe;C:\WINDOWS\RegisteredPackages\{B3C1B200-8F14-4C49-96D3-67425AD59914};Win32.Virut.56;Cured.;
unregmp2.exe;C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799};Win32.Virut.56;Cured.;
migrate.exe;C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System;Win32.Virut.56;Cured.;
unregmp2.exe;C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System;Win32.Virut.56;Cured.;
wmplayer.exe;C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System;Win32.Virut.56;Cured.;
accwiz.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
actmovie.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
admin.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
alg.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
aspnet_state.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
aspnet_wp.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
asr_pfu.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
at.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
atmadm.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
attrib.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
auditusr.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
author.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
blastcln.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
bootcfg.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
caspol.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
cfgwiz.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
cipher.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
cisvc.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
cliconfg.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
clipbrd.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
clipsrv.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
cmd.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
cmmon32.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
cmstp.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
comrepl.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
comrereg.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
comsdupd.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
conf.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
conime.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
csc.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
cscript.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
ctfmon.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
davcdata.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
dcomcnfg.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
ddeshare.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
defrag.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
dfrgfat.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
dfrgntfs.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
dialer.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
diantz.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
dlimport.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
dllhost.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
dmadmin.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
dmremote.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
dplaysvr.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
dpnsvr.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
drvqry.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
dumprep.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
dvdupgrd.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
dwwin.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
dxdiag.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
eudcedit.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
evntcmd.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
evtrig.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
explorer.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
extrac32.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
faxpatch.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
findstr.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
fltmc.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
fontview.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
forcedos.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
fp98sadm.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
fpadmcgi.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
fpcount.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
fpremadm.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
fpsrvadm.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
ftp.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
fxsclnt.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
fxssvc.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
getmac.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
grpconv.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
help.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
helpctr.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
helpsvc.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
hscupd.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
icwconn2.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
icwrmind.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
iedw.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
ieexec.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
iexpress.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
iisrstas.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
ilasm.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
imapi.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
inetin51.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
inetwiz.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
installutil.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
ipconfig.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
ipv6.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
ipxroute.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
irftp.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
jsc.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
lhmstsc.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
locator.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
logon.scr;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
logonui.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
lsass.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
magnify.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
makecab.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
migregdb.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
migwiz.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
migwiza.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
migwiz_a.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
mmc.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
mmcperf.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
mnmsrvc.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
mobsync.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
moviemk.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
mplayer2.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
mqbkup.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
mqsvc.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
mqtgsvc.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
msconfig.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
mshta.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
msiregmv.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
msmsgs.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
msoobe.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
mspaint.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
mstinit.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
mstsc.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
mtstocom.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
muisetup.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
napstat.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
narrator.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
nddeapir.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
net.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
net1.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
netdde.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
netsetup.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
netsh.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
netstat.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
ngen.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
notepad.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
nppagent.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
nslookup.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
ntbackup.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
ntvdm.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
odbcad32.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
odbcconf.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
oemig50.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
oobebaln.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
osk.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
packager.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
perfmon.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
pinball.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
ping.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
powercfg.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
proquota.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
proxycfg.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
qprocess.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
rasphone.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
rcp.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
rdpclip.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
rdshost.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
reg.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
regasm.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
regedit.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
regsvr32.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
rexec.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
rsh.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
rsnotify.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
rstrui.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
rtcshare.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
rundll32.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
runonce.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
savedump.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
scardsvr.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
scrcons.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
sctasks.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
secedit.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
services.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
sessmgr.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
sethc.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
setup.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
setup50.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
setupn.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
setup_wm.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
shmgrate.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
shrpubw.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
shtml.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
shutdown.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
sigverif.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
skeys.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
slrundll.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
slserv.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
smbinst.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
smi2smir.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
smlogsvc.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
sndrec32.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
snmp.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
snmptrap.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
sort.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
spider.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
spiisupd.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
spnpinst.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
spoolsv.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
spupdwxp.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
ss3dfo.scr;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
ssbezier.scr;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
ssflwbox.scr;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
ssmarque.scr;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
ssmypics.scr;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
ssmyst.scr;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
sspipes.scr;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
ssstars.scr;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
sstext3d.scr;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
stimon.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
stub_fpsrvadm.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
stub_fpsrvwin.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
svchost.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
sysinfo.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
sysocmgr.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
taskkill.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
tasklist.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
taskmgr.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
tcptest.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
telnet.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
tlntadmn.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
tlntsess.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
tlntsvr.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
tourstrt.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
tracerpt.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
tracert.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
tscupgrd.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
tzchange.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
unregmp2.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
uploadm.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
upnpcont.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
ups.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
userinit.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
utilman.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
vbc.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
verclsid.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
vssvc.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
wab.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
wabmig.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
wbemtest.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
wextract.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
wiaacmgr.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
winhlp32.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
winlogon.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
winver.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
wmiadap.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
wmiapsrv.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
wmic.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
wmiprvse.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
wmplayer.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
wordpad.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
wpabaln.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
wpnpinst.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
wscntfy.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
wscript.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
wuauclt.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
wuauclt1.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
xcopy.exe;C:\WINDOWS\ServicePackFiles\i386;Win32.Virut.56;Cured.;
cintsetp.exe;C:\WINDOWS\ServicePackFiles\i386\lang;Win32.Virut.56;Cured.;
cplexe.exe;C:\WINDOWS\ServicePackFiles\i386\lang;Win32.Virut.56;Cured.;
imjpdct.exe;C:\WINDOWS\ServicePackFiles\i386\lang;Win32.Virut.56;Cured.;
imjpdsvr.exe;C:\WINDOWS\ServicePackFiles\i386\lang;Win32.Virut.56;Cured.;
imjpinst.exe;C:\WINDOWS\ServicePackFiles\i386\lang;Win32.Virut.56;Cured.;
imjpmig.exe;C:\WINDOWS\ServicePackFiles\i386\lang;Win32.Virut.56;Cured.;
imjprw.exe;C:\WINDOWS\ServicePackFiles\i386\lang;Win32.Virut.56;Cured.;
imjputy.exe;C:\WINDOWS\ServicePackFiles\i386\lang;Win32.Virut.56;Cured.;
imscinst.exe;C:\WINDOWS\ServicePackFiles\i386\lang;Win32.Virut.56;Cured.;
pintlphr.exe;C:\WINDOWS\ServicePackFiles\i386\lang;Win32.Virut.56;Cured.;
tintlphr.exe;C:\WINDOWS\ServicePackFiles\i386\lang;Win32.Virut.56;Cured.;
tintsetp.exe;C:\WINDOWS\ServicePackFiles\i386\lang;Win32.Virut.56;Cured.;
msmsgs.exe;C:\WINDOWS\ServicePackFiles\ServicePackCache\i386;Win32.Virut.56;Cured.;
ie4uinit.exe;C:\WINDOWS\SoftwareDistribution\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR;Win32.Virut.56;Cured.;
ieudinit.exe;C:\WINDOWS\SoftwareDistribution\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR;Win32.Virut.56;Cured.;
iexplore.exe;C:\WINDOWS\SoftwareDistribution\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR;Win32.Virut.56;Cured.;
ie4uinit.exe;C:\WINDOWS\SoftwareDistribution\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE;Win32.Virut.56;Cured.;
ieudinit.exe;C:\WINDOWS\SoftwareDistribution\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE;Win32.Virut.56;Cured.;
iexplore.exe;C:\WINDOWS\SoftwareDistribution\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE;Win32.Virut.56;Cured.;
xpnetdg.exe;C:\WINDOWS\SoftwareDistribution\Download\0facce6115ab861022eae3087e064a2a\SP2QFE;Win32.Virut.56;Cured.;
accwiz.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
actmovie.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
ahui.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
ARP.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
asr_fmt.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
ASR_LDM.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
asr_pfu.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
at.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
Ati2mdxx.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
atmadm.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
attrib.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
auditusr.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
bootcfg.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
BOOTOK.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
BOOTVRFY.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
cacls.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
CALC.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
CHARMAP.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
CIDAEMON.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
cipher.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
CKCNV.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
cleanmgr.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
cliconfg.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
clipbrd.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
cmd.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
cmdl32.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
cmmon32.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
cmstp.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
COMP.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
COMPACT.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
comsdupd.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
conime.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
CONTROL.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
ControlSuite.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
CONVERT.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
cscript.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
dcomcnfg.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
ddeshare.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
defrag.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
dfrgfat.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
dfrgntfs.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
diantz.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
diskpart.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
DISKPERF.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
dkozbmb;C:\WINDOWS\SYSTEM32;BackDoor.Zapinit;Cured.;
DLLHST3G.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
DOSKEY.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
dplaysvr.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
dpnsvr.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
dpvsetup.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
driverquery.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
drmupgds.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
DRWTSN32.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
DSentry.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
dumprep.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
DVDPLAY.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
dvdupgrd.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
dwwin.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
dxdiag.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
dxdllreg.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
efivjct;C:\WINDOWS\SYSTEM32;BackDoor.Zapinit;Cured.;
ESENTUTL.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
eudcedit.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
eventcreate.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
eventtriggers.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
EVENTVWR.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
EXPAND.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
extrac32.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
faxpatch.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
FC.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
FIND.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
findstr.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
FINGER.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
FIXMAPI.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
fltmc.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
fontview.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
forcedos.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
FREECELL.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
fsquirt.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
FSUTIL.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
ftp.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
fxahuq;C:\WINDOWS\SYSTEM32;BackDoor.Zapinit;Cured.;
fxsclnt.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
fxscover.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
fxssend.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
getmac.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
gpresult.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
GPUPDATE.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
grpconv.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
help.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
hkcmd.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
HOSTNAME.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
iexpress.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
igfxcfg.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
igfxdiag.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
igfxext.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
instlsp.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
ipconfig.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
IPSEC6.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
ipv6.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
ipxroute.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
ivsugsl;C:\WINDOWS\SYSTEM32;BackDoor.Zapinit;Cured.;
Jasc Paint Shop Photo Album.scr;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
LABEL.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
LIGHTS.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
LNKSTUB.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
LODCTR.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
logagent.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
logman.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
LOGOFF.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
LPQ.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
magnify.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
makecab.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
MAPISRVR.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
MIGPWD.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
mmc.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
mmcperf.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
mobsync.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
MOUNTVOL.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
mplay32.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
MPNOTIFY.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
mqtgsvc.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
MRINFO.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
MSHEARTS.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
mshta.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
mspaint.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
MSSWCHX.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
mstinit.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
mstsc.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
napstat.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
narrator.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
NBTSTAT.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
nddeapir.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
net.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
net1.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
netsetup.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
netsh.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
netstat.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
nslookup.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
ntbackup.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
ntvdm.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
NWSCRIPT.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
openfiles.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
osk.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
OSUNINST.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
packager.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
PATHPING.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
PENTNT.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
perfmon.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
ping.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
PING6.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
powercfg.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
PRINT.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
proquota.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
proxycfg.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
QAPPSRV.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
qnnkhjv;C:\WINDOWS\SYSTEM32;BackDoor.Zapinit;Cured.;
qprocess.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
QWINSTA.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
qycl;C:\WINDOWS\SYSTEM32;BackDoor.Zapinit;Cured.;
RASAUTOU.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
RASDIAL.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
rasphone.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
rcimlby.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
rcp.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
rdpclip.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
rdsaddin.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
rdshost.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
RECOVER.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
reg.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
REGEDT32.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
REGINI.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
RELOG.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
REPLACE.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
RESET.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
rexec.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
ROUTE.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
ROUTEMON.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
rsh.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
RSM.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
RSMSINK.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
RSMUI.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
rsnotify.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
RSOPPROV.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
rtcshare.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
RUNAS.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
runonce.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
RWINSTA.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
savedump.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
SC.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
schtasks.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
scrnsave.scr;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
sdbinst.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
secedit.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
senekahghrpjbv.dll;C:\WINDOWS\SYSTEM32;Trojan.Packed.365;Deleted.;
senekantjlksrh.dll;C:\WINDOWS\SYSTEM32;Trojan.Packed.365;Deleted.;
senekaucxnriql.dll;C:\WINDOWS\SYSTEM32;Trojan.Packed.365;Deleted.;
sethc.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
setup.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
setupn.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
SFC.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
SHADOW.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
shrpubw.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
shutdown.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
sigverif.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
skeys.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
slrundll.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
slserv.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
smbinst.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
sndrec32.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
SNDVOL32.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
SOL.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
sort.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
spdwnwxp.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
spider.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
spiisupd.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
spnpinst.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
spupdwxp.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
ss3dfo.scr;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
ssflwbox.scr;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
ssmypics.scr;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
ssmyst.scr;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
sstext3d.scr;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
stimon.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
SUBST.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
SYNCAPP.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
SYSKEY.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
sysocmgr.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
systeminfo.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
SYSTRAY.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
taskkill.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
tasklist.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
TASKMAN.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
taskmgr.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
TCMSETUP.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
TCPSVCS.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
telnet.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
TFTP.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
tlntadmn.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
tlntsess.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
tracerpt.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
tracert.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
TRACERT6.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
TSCON.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
tscupgrd.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
TSDISCON.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
TSKILL.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
TSSHUTDN.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
TYPEPERF.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
uazzzigr;C:\WINDOWS\SYSTEM32;BackDoor.Zapinit;Cured.;
UNLODCTR.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
upnpcont.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
USRMLNKA.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
USRPRBDA.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
USRSHUTA.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
utilman.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
uwdf.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
verclsid.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
VERIFIER.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
VSSADMIN.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
W32TM.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
wdfmgr.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
wextract.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
wiaacmgr.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
WinFXDocObj.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
WINHLP32.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
WINMINE.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
winver.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
wisptis.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
WMPSTUB.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
wpdshextautoplay.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
wpnpinst.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
WRITE.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
wscntfy.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
wscript.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
WudfHost.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
WUPDMGR.EXE;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
xcopy.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
xpsp1hfm.exe;C:\WINDOWS\SYSTEM32;Win32.Virut.56;Cured.;
zmzbmv;C:\WINDOWS\SYSTEM32;BackDoor.Zapinit;Cured.;
comrepl.exe;C:\WINDOWS\SYSTEM32\Com;Win32.Virut.56;Cured.;
comrereg.exe;C:\WINDOWS\SYSTEM32\Com;Win32.Virut.56;Cured.;
tfswcmd.exe;C:\WINDOWS\SYSTEM32\dla;Win32.Virut.56;Cured.;
tfswctrl.exe;C:\WINDOWS\SYSTEM32\dla;Win32.Virut.56;Cured.;
cintsetp.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
cplexe.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
cscript.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
fxssend.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
icwtutor.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
ie4uinit.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
iedw.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
ieudinit.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
imekrmig.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
imepadsv.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
imjpdadm.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
imjpdct.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
imjpdsvr.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
imjpinst.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
imjpmig.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
imjprw.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
imjpuex.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
imjputy.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
imkrinst.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
imscinst.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
isignup.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
logagent.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
migrate.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
mshearts.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
mshta.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
pintlphr.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
setup_wm.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
tintlphr.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
tintsetp.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
unregmp2.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
user32.dll;C:\WINDOWS\SYSTEM32\DLLCACHE;BackDoor.Zapinit;Cured.;
wmplayer.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
wscript.exe;C:\WINDOWS\SYSTEM32\DLLCACHE;Win32.Virut.56;Cured.;
cintsetp.exe;C:\WINDOWS\SYSTEM32\IME\CINTLGNT;Win32.Virut.56;Cured.;
IMSCINST.EXE;C:\WINDOWS\SYSTEM32\IME\PINTLGNT;Win32.Virut.56;Cured.;
pintlphr.exe;C:\WINDOWS\SYSTEM32\IME\PINTLGNT;Win32.Virut.56;Cured.;
TINTLPHR.EXE;C:\WINDOWS\SYSTEM32\IME\TINTLGNT;Win32.Virut.56;Cured.;
TINTSETP.EXE;C:\WINDOWS\SYSTEM32\IME\TINTLGNT;Win32.Virut.56;Cured.;
rundll33.exe;C:\WINDOWS\SYSTEM32\inf;Win32.Virut.56;Cured.;
xccdfb16_090131.dll;C:\WINDOWS\SYSTEM32\inf;Trojan.Hitpop.1898;Deleted.;
SwInit.exe;C:\WINDOWS\SYSTEM32\Macromed\Shockwave 10;Win32.Virut.56;Cured.;
UNWISE.EXE;C:\WINDOWS\SYSTEM32\Macromed\Shockwave 10;Win32.Virut.56;Cured.;
QuitRemote.exe;C:\WINDOWS\SYSTEM32\Macromed\Shockwave 8;Win32.Virut.56;Cured.;
SwInit.exe;C:\WINDOWS\SYSTEM32\Macromed\Shockwave 8;Win32.Virut.56;Cured.;
UNWISE.EXE;C:\WINDOWS\SYSTEM32\Macromed\Shockwave 8;Win32.Virut.56;Cured.;
nppagent.exe;C:\WINDOWS\SYSTEM32\NPP;Win32.Virut.56;Cured.;
Ati2mdxx.exe;C:\WINDOWS\SYSTEM32\ReinstallBackups\0001\DriverFiles;Win32.Virut.56;Cured.;
ati2evxx.exe;C:\WINDOWS\SYSTEM32\ReinstallBackups\0013\DriverFiles\B_11252;Win32.Virut.56;Cured.;
Ati2mdxx.exe;C:\WINDOWS\SYSTEM32\ReinstallBackups\0013\DriverFiles\B_11252;Win32.Virut.56;Cured.;
ati2evxx.exe;C:\WINDOWS\SYSTEM32\ReinstallBackups\0014\DriverFiles\B_18893;Win32.Virut.56;Cured.;
Ati2mdxx.exe;C:\WINDOWS\SYSTEM32\ReinstallBackups\0014\DriverFiles\B_18893;Win32.Virut.56;Cured.;
rstrui.exe;C:\WINDOWS\SYSTEM32\Restore;Win32.Virut.56;Cured.;
SRDIAG.EXE;C:\WINDOWS\SYSTEM32\Restore;Win32.Virut.56;Cured.;
regtlib.exe;C:\WINDOWS\SYSTEM32\URTTemp;Win32.Virut.56;Cured.;
migload.exe;C:\WINDOWS\SYSTEM32\USMT;Win32.Virut.56;Cured.;
migwiz.exe;C:\WINDOWS\SYSTEM32\USMT;Win32.Virut.56;Cured.;
migwiz_a.exe;C:\WINDOWS\SYSTEM32\USMT;Win32.Virut.56;Cured.;
mofcomp.exe;C:\WINDOWS\SYSTEM32\WBEM;Win32.Virut.56;Cured.;
scrcons.exe;C:\WINDOWS\SYSTEM32\WBEM;Win32.Virut.56;Cured.;
UNSECAPP.EXE;C:\WINDOWS\SYSTEM32\WBEM;Win32.Virut.56;Cured.;
wbemtest.exe;C:\WINDOWS\SYSTEM32\WBEM;Win32.Virut.56;Cured.;
wmiadap.exe;C:\WINDOWS\SYSTEM32\WBEM;Win32.Virut.56;Cured.;
wmic.exe;C:\WINDOWS\SYSTEM32\WBEM;Win32.Virut.56;Cured.;
wmiprvse.exe;C:\WINDOWS\SYSTEM32\WBEM;Win32.Virut.56;Cured.;
wcmdmgr.exe;C:\WINDOWS\wt\backup\1.6.1.002;Win32.Virut.56;Cured.;
wcmdmgrl.exe;C:\WINDOWS\wt\backup\1.6.2.003;Win32.Virut.56;Cured.;


HiJack This Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:41:28 PM, on 3/9/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Dell Support Center\bin\sprtsvc.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\PROGRA~1\AVG\AVG8\avgnsx.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

C:\Program Files\Dell Support Center\bin\sprtcmd.exe

C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe

C:\Program Files\Digital Line Detect\DLG.exe

H:\Antivirus\drweb-cureit.exe

C:\DOCUME~1\meredith\LOCALS~1\Temp\RarSFX0\_start.exe

C:\DOCUME~1\meredith\LOCALS~1\Temp\RarSFX0\setup.exe

C:\Documents and Settings\meredith\Desktop\Anti-virus\HiJackThis.exe


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: BHO - {C9C42510-9B21-41c1-9DCD-8382A2D07C61} - C:\WINDOWS\system32\iehelper.dll (file missing)

O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\meredith\Application Data\Macromedia\Common\3bbae0261.dll""

O4 - HKUS\S-1-5-21-3190460428-3815118845-2255937060-1006\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?')

O4 - HKUS\S-1-5-21-3190460428-3815118845-2255937060-1006\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\meredith\Application Data\Macromedia\Common\3bbae0261.dll"" (User '?')

O4 - HKUS\S-1-5-21-3190460428-3815118845-2255937060-500\..\Run: [Sonic RecordNow!] (User '?')

O4 - HKUS\S-1-5-21-3190460428-3815118845-2255937060-501\..\Run: [Sonic RecordNow!] (User '?')

O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User '?')

O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')

O4 - Global Startup: Digital Line Detect.lnk = ?

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Application Management (AppMgmt) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe (file missing)

O23 - Service: Windows Audio (AudioSrv) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Computer Browser (Browser) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Cryptographic Services (CryptSvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: DCOM Server Process Launcher (DcomLaunch) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: DHCP Client (Dhcp) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Logical Disk Manager (dmserver) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: DNS Client (Dnscache) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Wired AutoConfig (Dot3svc) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe

O23 - Service: Extensible Authentication Protocol Service (EapHost) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Error Reporting Service (ERSvc) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: COM+ Event System (EventSystem) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Fast User Switching Compatibility (FastUserSwitchingCompatibility) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Help and Support (helpsvc) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: HID Input Service (HidServ) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Health Key and Certificate Management Service (hkmsvc) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Server (lanmanserver) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Workstation (lanmanworkstation) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: TCP/IP NetBIOS Helper (LmHosts) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Network Access Protection Agent (napagent) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Network Connections (Netman) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Network Location Awareness (NLA) (Nla) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Removable Storage (NtmsSvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Remote Access Auto Connection Manager (RasAuto) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Remote Access Connection Manager (RasMan) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Remote Registry (RemoteRegistry) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Remote Procedure Call (RPC) (RpcSs) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Smart Card (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe (file missing)

O23 - Service: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Secondary Logon (seclogon) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: System Event Notification (SENS) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Windows Firewall/Internet Connection Sharing (ICS) (SharedAccess) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Shell Hardware Detection (ShellHWDetection) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe

O23 - Service: System Restore Service (srservice) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: SSDP Discovery Service (SSDPSRV) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Windows Image Acquisition (WIA) (stisvc) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Telephony (TapiSrv) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Terminal Services (TermService) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Themes - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Distributed Link Tracking Client (TrkWks) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Universal Plug and Play Device Host (upnphost) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Uninterruptible Power Supply (UPS) - Unknown owner - C:\WINDOWS\System32\ups.exe (file missing)

O23 - Service: Windows Time (w32time) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: WebClient - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Windows Management Instrumentation (winmgmt) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Portable Media Serial Number Service (WmdmPmSN) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Windows Management Instrumentation Driver Extensions (Wmi) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Windows Driver Foundation - User-mode Driver Framework (WudfSvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Wireless Zero Configuration (WZCSVC) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Network Provisioning Service (xmlprov) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

–

End of file - 10614 bytes
Post #8
Hi RoryCalhoun,

Bad news I'm afraid. You are infected with a file infector called Virut.

This infection can and will infect all the machine's executable files .exe, .scr plus .html and .htm. Because there are a number of bugs in its code, it may create executable files that are corrupted beyond repair resulting in an inoperative machine.

More information can be found here and here.

A Complete Reformat and Reinstall is the only way to clean the infection. This includes All Drives that contain .exe, .scr, .hlm, .html files.
  • Backup all your documents and important items only.
    data/documents/pictures/movies/songs/etc..
  • DO NOT backup any executable files (,exe .scr .html or .htm)
  • Do Not back up compressed files (zip/cab/rar) files that may contain .exe or .scr files
  • Reformat and Reinstall as outlined HERE

A CD would be best, but a blank USB device will work. Make sure there aren't any executable on it.

If you are going to use a USB device, I suggest you use a freshly formated one. After formatting it, use FDD on it before attaching it to the infected computer.

I would also strongly advise doing an on line scan at Kaspersky on the clean computer, just to be sure it's clean.

Be further advised that these infections may have backdoor capabilities.

I suggest you do the following immediately:
  • Call all of your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and to put a watch on your accounts or change all your account numbers.
  • From a clean computer, change *all* your online passwords – for email, for banks, financial accounts, PayPal, eBay, online companies, any online forums or groups you belong to.
  • DO NOT change passwords or do any transactions while using the infected computer because the attacker will get the new passwords and transaction information.
Feel free to ask any questions, but keep in mind a Reformat is the only way to clean this computer.
Post #9
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI