What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Virut.NBM - pleas help me

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello,
Yesterday i got infected by W32/virut.NBM virus. after being frustrated, and after some googling and researching i found out that my pc is basically doomed.
I know I have to format, but the thing is i have a lot of files and important info on my hard-drives, and i don't want to lose it all.
i have windows xp installed on partition c, and i can completely format it. but for the rest:
what I'm thinking is change all my exe files to something like ex_e, and to do same with: scr/.htm/.html/.xml/.zip/.rar.
i also have some very important .iso and .bin files. are those safe for virut?

do i need to do any further actions in order to be safe from re-infection?


p.s English is not my native language, so i hope you can understand me.

thanks for any help.
——————————
here is my HijackThis log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:00:14, on 16/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\ASTSRV.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
D:\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\RTHDCPL.EXE
D:\Java\jre6\bin\jqs.exe
D:\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\regx32.exe
D:\Java\jre6\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
D:\PerfectDisk10\PDAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WISPTIS.EXE
D:\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - D:\FlashGet\jccatch.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: עוזר הכניסה של Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - D:\FlashGet\getflash.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [egui] "D:\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [TrialReset] C:\WINDOWS\regx32.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &Download All with FlashGet - D:\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - D:\FlashGet\jc_link.htm
O8 - Extra context menu item: &ייצוא אל Microsoft Excel - res://D:\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: שלח אל OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: ש&לח אל OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1235728617875
O16 - DPF: {D79B6F43-F214-4E7A-9ECB-CCC8771F2416} (LauncherV1 Class) - http://www.tapuz.co.il/irc/main/launcher.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C3CCF90B-613F-4E0D-A45B-E7466EB79D78}: NameServer = 80.179.52.100 80.179.55.100
O20 - AppInit_DLLs: prio.dll
O20 - Winlogon Notify: !SASWinLogon - D:\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Nalpeiron Licensing Service (ASTSRV) - Unknown owner - C:\WINDOWS\system32\ASTSRV.EXE
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - D:\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - D:\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: שירות Google Update (gupdate1c99516b3512fd2) (gupdate1c99516b3512fd2) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PDAgent - Raxco Software, Inc. - D:\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - D:\PerfectDisk10\PDEngine.exe
O23 - Service: Print Spooler (Spooler) - Unknown owner - C:\WINDOWS\system32\spoolsv.exe

–
End of file - 7862 bytes
Post #2
Hi,

I take it your Nod Antivirus alerted you to the infection? what files were infected? Do you have a log to show?

Please do the following scan to confirm….if it is in fact virut. then nothing can be saved other than documents, pictures and music…..renaming files will not help….it must be a full reformat.

Please do this

Download Dr.Web CureIt to the desktop:
  • Doubleclick the drweb-cureit icon to start the program.
  • press start
  • Allow the program to run the initial express scan
  • This will scan the files currently running in memory. If something is found, click the YES button when it asks you if you want to cure it. This is only a short scan.
    Note: A pop up may appear during this phase suggesting you purchase their program - click the X at the top right corner of this pop-up to close it.
  • Once the short scan has finished, check the Complete scan box on the left side, even if nothing was found on the initial scan.
  • Then click the small green arrow button on the right under the Dr.Web Antivirus picture to start the complete scan. (This scan will take several hours)
  • During this complete scan - if Dr.Web finds an infection a window will pop up requesting your attention. Select the Cure button.
    • Note:(If the file cannot be cured, Dr.Web will automatically delete the file)
  • Once the scan is complete, on the menu bar, click file and choose report list.
  • Save the report to your desktop. The report will be called DrWeb.csv
  • Note:this report will need to be renamed to Dr.Web.txt in order to post it on the forum.
  • Close Dr.Web Cureit.
  • Please post the Dr.Web.txt report in your next reply
Post #3
Hi, I tried to download CureIt few times yesterday and today (from your link) but i cant. the connection always get disconnected (the file is incomplete). is there any other mirror for that file? and yes, I'm sure it is virut, i scanned some files with virustotal.com (it was different kind of virut, not NBM). i cant back up my file because my CD driver got corrupted (i guess because the virus but im not sure), and i have A-LOT of files, so burning them all will take to many hours and dvds. (i know its lame). can i keep .avi too? are those safe with virut? (and i want to know the same about .iso too). I'm sorry for the hassle, i have years of info and files on my pc and cant effort of losing it. thanks again.
Post #4
Hi,

this is the only download link I have http://www.freedrweb.com/cureit/

down load button is on the bottom left of page.


personally I wouldn't keep .avi or .iso files myself. This virus corrupts pretty much everything.

If you can get Dr.Web to run, it will heal a few files - enough to give you time to copy everything that's safe to copy over to another drive…

but I would just copy my important documents and pictures …everything else can be reloaded.

check this blog here for further info on virut.
Post #5
Hi, the link to CureIt is the same link you gave me before. i was hoping that someone could upload this file to different server, as i really want to try it. yes i read that post after my research, very depressing. I will try to delete all my exe, scr, htm, html, xml, zip, rar, htm, html, asp, php files, then format partition c and reinstalling windows. i hope that it will help. its a very hurtful virus. thanks.
Post #7
Hi, Thank you so much for uploading the file, it did excellent job, after few full scans + restarts, CureIt doesn't found anything! I did full scan with nod32 and it didn't come up with anything as well. did virut gone? is it possible? nod32 real-time scanner don't show any warning message anymore. is there any other scan tool i can try? I created a safe partition (i hope) without risky files, so if anything happened I'm ready to format. thanks again, you helped a-lot :)
Post #8
Hi,

Please don't be misled by a false sense of security - Virut cannot be cured. It makes your system files unstable. Your system may run fine for a while and show no problems, then it will respawn all over again.

If this were my machine and I had a scan that showed virut, I would not trust that it had been removed. I would wipe my drive clean and reformat.

This scan will likely come up clean as well.

NOTE: This scan can take several hours to complete:

Go to Kaspersky website and perform an online antivirus scan.
  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • post the copy of that report in your next reply


NEXT

Upload this files to Virscan:

c:\windows\system32\userinit.exe

  • Make sure to use Internet Explorer for this
  • Please go to VirSCAN.org FREE on-line scan service
  • Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:
    • c:\windows\system32\userinit.exe
  • Click on the Upload button
  • If a pop-up appears saying the file has been scanned already, please select the ReScan button.
  • Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
  • Paste the contents of the Clipboard in your next reply.


Post the original first scan from Dr.Web as well - let me see it. (should be in the reports tab)
Post #9
Hi,

I know that some files may left corrupted, but my main concern is leftovers of virut. (being re-infected).
I didn't find the original CureIt log.

I did the scans you told me, and they came up totally clean. this is Raises a question: if I'll format everything except my 'safe' partition, and then reinstall windows - how would i know my system is really clean? I mean, all the scanners show that it is clean already.


anyway, So here's the logs you requested:

——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0 REPORT
Saturday, April 18, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Saturday, April 18, 2009 19:03:47
Records in database: 2058857
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\
L:\

Scan statistics:
Files scanned: 100382
Threat name: 0
Infected objects: 0
Suspicious objects: 0
Duration of the scan: 00:42:40

No malware has been detected. The scan area is clean.

The selected area was scanned.



VirSCAN.org Scanned Report :
Scanned time : 2009/04/18 23:22:08 (IDT)
Scanner results: All Scanners reported not find malware!
File Name : userinit.exe
File Size : 26112 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : 749af876cf9c7cdc1ad126bddd439599
SHA1 : 8a01763c593f8c258a84f060dec6634de9e78f13
Online report : http://virscan.org/report/058bbb41f0ffdc03…a3bb7d5495.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.0.0.32 20090418224013 2009-04-18 3.43 -
AhnLab V3 2009.04.18.00 2009.04.18 2009-04-18 1.43 -
AntiVir 7.9.0.148 7.1.3.73 2009-04-18 1.99 -
Antiy 2.0.18 20090418.2304915 2009-04-18 0.12 -
Authentium 5.1.1 200904172119 2009-04-17 1.18 -
AVAST! 3.0.1 090418-0 2009-04-18 0.01 -
AVG 7.5.52.442 270.12.0/2066 2009-04-18 2.07 -
BitDefender 7.81008.2849335 7.24877 2009-04-19 2.67 -
CA (VET) 9.0.0.143 31.6.6435 2009-04-14 18.34 -
ClamAV 0.95 9254 2009-04-18 0.01 -
Comodo 3.8 1120 2009-04-18 0.57 -
CP Secure 1.1.0.715 2009.04.18 2009-04-18 8.37 -
Dr.Web 4.44.0.9170 2009.04.18 2009-04-18 4.39 -
F-Prot 4.4.4.56 20090417 2009-04-17 1.13 -
F-Secure 5.51.6100 2009.04.18.02 2009-04-18 5.21 -
Fortinet 2.81-3.117 10.296 2009-04-18 0.39 -
GData 19.4714/19.303 20090418 2009-04-18 4.28 -
ViRobot 20090414 2009.04.14 2009-04-14 0.45 -
Ikarus T3.1.01.49 2009.04.18.72598 2009-04-18 2.80 -
JiangMin 11.0.706 2009.04.18 2009-04-18 2.04 -
Kaspersky 5.5.10 2009.04.18 2009-04-18 0.07 -
KingSoft 2009.2.5.15 2009.4.18.22 2009-04-18 0.59 -
McAfee 5.3.00 5588 2009-04-18 2.77 -
Microsoft 1.4502 2009.04.16 2009-04-16 4.62 -
mks_vir 2.01 2009.04.18 2009-04-18 2.74 -
Norman 6.00.06 6.00.00 2009-04-17 10.01 -
Panda 9.05.01 2009.04.18 2009-04-18 1.47 -
Trend Micro 8.700-1004 5.974.22 2009-04-18 0.03 -
Quick Heal 10.00 2009.04.18 2009-04-18 1.25 -
Rising 20.0 21.25.52.00 2009-04-18 0.70 -
Sophos 2.85.0 4.40 2009-04-19 2.20 -
Sunbelt 5094 5094 2009-04-15 0.72 -
Symantec 1.3.0.24 20090418.004 2009-04-18 0.05 -
nProtect 20090418.01 3480472 2009-04-18 7.29 -
The Hacker [removed] v00309 2009-04-15 0.58 -
VBA32 3.12.10.2 20090417.1222 2009-04-17 1.88 -
VirusBuster 4.5.11.10 10.104.2/1259648 2009-04-18 1.53 -
Post #10 last edited
Hi,

You have yet to show me any of the reports you have that have indicated virut….where did this diagnosis come from

you say Dr.Web 'cured a few things' Do you remember what exactly….I really need to see a log before I can continue to assist you.

Open your windows explorer (the Window key + E)

in files to search for type in CureIt.log > search in local disk C:\

you should now find a text file called 'CureIt' double click on it > a notepad will open > copy/paste the content of that text file here.
Post #11 last edited
OK, so i find the log, but it doesn't contain any bad input, i did so many full scanned that it reached its maximum size allowed by default (2 MB).

I do however have many NOD32 log entries that contains the viruted files. I'll post them at the end.

bed news: every time i opens Firefox my NOD32 warning me. this is the log for the warning:

17/04/2009 15:02:06 HTTP filter file h**p://goasi.$$/ex/a.php a variant of Win32/Inject.CCO trojan connection terminated - quarantined NT AUTHORITY\SYSTEM

I replaced tt with **, and cn with $$. (didn't want someone to click that by mistake).
I googled that address and that show that it is related to virut :(.
but i don't know what program is set to go to that website. it may be something in the registry like it said here:
http://www.vistax64.com/system-security/21…help-virus.html [edit: I think its for Windows Vista only]

———————–
here's some of NOD32 logs about virut, its endless list so i didn't post it all. sorry:

17/04/2009 14:27:48 Real-time file system protection file C:\WINDOWS\system32\wbem\wmiprvse.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:27:46 Real-time file system protection file C:\WINDOWS\system32\wbem\unsecapp.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:27:46 Real-time file system protection file C:\WINDOWS\system32\wbem\scrcons.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:54 Real-time file system protection file C:\WINDOWS\system32\xcopy.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:52 Real-time file system protection file C:\WINDOWS\system32\wupdmgr.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:52 Real-time file system protection file C:\WINDOWS\system32\WudfHost.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:50 Real-time file system protection file C:\WINDOWS\system32\wscntfy.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:50 Real-time file system protection file C:\WINDOWS\system32\write.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:49 Real-time file system protection file C:\WINDOWS\system32\wpabaln.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:45 Real-time file system protection file C:\WINDOWS\system32\WISPTIS.EXE Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:45 Real-time file system protection file C:\WINDOWS\system32\winver.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:44 Real-time file system protection file C:\WINDOWS\system32\winhlp32.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:44 Real-time file system protection file C:\WINDOWS\system32\WinFXDocObj.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:42 Real-time file system protection file C:\WINDOWS\system32\wiaacmgr.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:41 Real-time file system protection file C:\WINDOWS\system32\w32tm.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:41 Real-time file system protection file C:\WINDOWS\system32\vssadmin.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:40 Real-time file system protection file C:\WINDOWS\system32\verifier.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:40 Real-time file system protection file C:\WINDOWS\system32\uwdf.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:40 Real-time file system protection file C:\WINDOWS\system32\utilman.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:38 Real-time file system protection file C:\WINDOWS\system32\unlodctr.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:38 Real-time file system protection file C:\WINDOWS\system32\tzchange.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:38 Real-time file system protection file C:\WINDOWS\system32\TWUNK_32.EXE Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:37 Real-time file system protection file C:\WINDOWS\system32\tskill.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:37 Real-time file system protection file C:\WINDOWS\system32\tsdiscon.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:37 Real-time file system protection file C:\WINDOWS\system32\tscon.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:37 Real-time file system protection file C:\WINDOWS\system32\tracert6.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:36 Real-time file system protection file C:\WINDOWS\system32\tracert.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:36 Real-time file system protection file C:\WINDOWS\system32\tourstart.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:36 Real-time file system protection file C:\WINDOWS\system32\tlntsess.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:36 Real-time file system protection file C:\WINDOWS\system32\tlntadmn.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:35 Real-time file system protection file C:\WINDOWS\system32\tftp.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:35 Real-time file system protection file C:\WINDOWS\system32\telnet.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:35 Real-time file system protection file C:\WINDOWS\system32\tcmsetup.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:34 Real-time file system protection file C:\WINDOWS\system32\tasklist.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:34 Real-time file system protection file C:\WINDOWS\system32\systray.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:34 Real-time file system protection file C:\WINDOWS\system32\systeminfo.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:33 Real-time file system protection file C:\WINDOWS\system32\syskey.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:33 Real-time file system protection file C:\WINDOWS\system32\syncapp.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:32 Real-time file system protection file C:\WINDOWS\system32\subst.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:32 Real-time file system protection file C:\WINDOWS\system32\ssstars.scr Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:31 Real-time file system protection file C:\WINDOWS\system32\ssmarque.scr Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:31 Real-time file system protection file C:\WINDOWS\system32\ssbezier.scr Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:29 Real-time file system protection file C:\WINDOWS\system32\spiisupd.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:29 Real-time file system protection file C:\WINDOWS\system32\sort.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:28 Real-time file system protection file C:\WINDOWS\system32\sndrec32.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:28 Real-time file system protection file C:\WINDOWS\system32\skeys.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:27 Real-time file system protection file C:\WINDOWS\system32\sigverif.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:27 Real-time file system protection file C:\WINDOWS\system32\shutdown.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:26 Real-time file system protection file C:\WINDOWS\system32\shadow.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:26 Real-time file system protection file C:\WINDOWS\system32\sfc.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:26 Real-time file system protection file C:\WINDOWS\system32\setup.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:26 Real-time file system protection file C:\WINDOWS\system32\sethc.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:25 Real-time file system protection file C:\WINDOWS\system32\secedit.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:25 Real-time file system protection file C:\WINDOWS\system32\sdbinst.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:25 Real-time file system protection file C:\WINDOWS\system32\scrnsave.scr Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:25 Real-time file system protection file C:\WINDOWS\system32\schtasks.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:24 Real-time file system protection file C:\WINDOWS\system32\savedump.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:24 Real-time file system protection file C:\WINDOWS\system32\rwinsta.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:24 Real-time file system protection file C:\WINDOWS\system32\runonce.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:23 Real-time file system protection file C:\WINDOWS\system32\runas.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:23 Real-time file system protection file C:\WINDOWS\system32\rsopprov.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:23 Real-time file system protection file C:\WINDOWS\system32\rsnotify.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:23 Real-time file system protection file C:\WINDOWS\system32\rsmui.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:22 Real-time file system protection file C:\WINDOWS\system32\rsmsink.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:22 Real-time file system protection file C:\WINDOWS\system32\rsm.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:22 Real-time file system protection file C:\WINDOWS\system32\rsh.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:22 Real-time file system protection file C:\WINDOWS\system32\routemon.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:22 Real-time file system protection file C:\WINDOWS\system32\route.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:21 Real-time file system protection file C:\WINDOWS\system32\reset.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:21 Real-time file system protection file C:\WINDOWS\system32\replace.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:21 Real-time file system protection file C:\WINDOWS\system32\regwiz.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:21 Real-time file system protection file C:\WINDOWS\system32\regini.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:20 Real-time file system protection file C:\WINDOWS\system32\regedt32.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:20 Real-time file system protection file C:\WINDOWS\system32\rdshost.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:20 Real-time file system protection file C:\WINDOWS\system32\rdsaddin.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:20 Real-time file system protection file C:\WINDOWS\system32\rdpclip.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:20 Real-time file system protection file C:\WINDOWS\system32\rcp.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:20 Real-time file system protection file C:\WINDOWS\system32\rcimlby.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:19 Real-time file system protection file C:\WINDOWS\system32\rasphone.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:19 Real-time file system protection file C:\WINDOWS\system32\rasdial.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:19 Real-time file system protection file C:\WINDOWS\system32\rasautou.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:19 Real-time file system protection file C:\WINDOWS\system32\qwinsta.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:18 Real-time file system protection file C:\WINDOWS\system32\qprocess.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:17 Real-time file system protection file C:\WINDOWS\system32\qappsrv.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:17 Real-time file system protection file C:\WINDOWS\system32\proxycfg.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:16 Real-time file system protection file C:\WINDOWS\system32\progman.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:16 Real-time file system protection file C:\WINDOWS\system32\print.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:16 Real-time file system protection file C:\WINDOWS\system32\powercfg.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:15 Real-time file system protection file C:\WINDOWS\system32\ping6.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:15 Real-time file system protection file C:\WINDOWS\system32\ping.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:14 Real-time file system protection file C:\WINDOWS\system32\pentnt.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:13 Real-time file system protection file C:\WINDOWS\system32\packager.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:13 Real-time file system protection file C:\WINDOWS\system32\osuninst.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:13 Real-time file system protection file C:\WINDOWS\system32\osk.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:13 Real-time file system protection file C:\WINDOWS\system32\openfiles.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:12 Real-time file system protection file C:\WINDOWS\system32\nwscript.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:06 Real-time file system protection file C:\WINDOWS\system32\ntbackup.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:05 Real-time file system protection file C:\WINDOWS\system32\nslookup.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:04 Real-time file system protection file C:\WINDOWS\system32\netstat.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:04 Real-time file system protection file C:\WINDOWS\system32\netsh.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:04 Real-time file system protection file C:\WINDOWS\system32\netsetup.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:03 Real-time file system protection file C:\WINDOWS\system32\net1.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:03 Real-time file system protection file C:\WINDOWS\system32\net.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:03 Real-time file system protection file C:\WINDOWS\system32\nddeapir.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:02 Real-time file system protection file C:\WINDOWS\system32\nbtstat.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:02 Real-time file system protection file C:\WINDOWS\system32\narrator.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:26:02 Real-time file system protection file C:\WINDOWS\system32\napstat.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:59 Real-time file system protection file C:\WINDOWS\system32\mstinit.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:59 Real-time file system protection file C:\WINDOWS\system32\msswchx.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:58 Real-time file system protection file C:\WINDOWS\system32\mspaint.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:56 Real-time file system protection file C:\WINDOWS\system32\mshearts.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:55 Real-time file system protection file C:\WINDOWS\system32\msg.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:55 Real-time file system protection file C:\WINDOWS\system32\msfeedssync.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:51 Real-time file system protection file C:\WINDOWS\system32\mrinfo.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:51 Real-time file system protection file C:\WINDOWS\system32\mqtgsvc.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:50 Real-time file system protection file C:\WINDOWS\system32\mqbkup.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:50 Real-time file system protection file C:\WINDOWS\system32\mpnotify.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:50 Real-time file system protection file C:\WINDOWS\system32\mplay32.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:49 Real-time file system protection file C:\WINDOWS\system32\mountvol.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:49 Real-time file system protection file C:\WINDOWS\system32\mobsync.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:49 Real-time file system protection file C:\WINDOWS\system32\mmcperf.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:48 Real-time file system protection file C:\WINDOWS\system32\mmc.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:47 Real-time file system protection file C:\WINDOWS\system32\migpwd.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:46 Real-time file system protection file C:\WINDOWS\system32\makecab.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:46 Real-time file system protection file C:\WINDOWS\system32\magnify.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:46 Real-time file system protection file C:\WINDOWS\system32\lpq.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:45 Real-time file system protection file C:\WINDOWS\system32\logoff.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:45 Real-time file system protection file C:\WINDOWS\system32\logman.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:45 Real-time file system protection file C:\WINDOWS\system32\logagent.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:45 Real-time file system protection file C:\WINDOWS\system32\lodctr.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:44 Real-time file system protection file C:\WINDOWS\system32\lnkstub.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:44 Real-time file system protection file C:\WINDOWS\system32\lights.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:43 Real-time file system protection file C:\WINDOWS\system32\label.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:40 Real-time file system protection file C:\WINDOWS\system32\ipxroute.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:39 Real-time file system protection file C:\WINDOWS\system32\ipconfig.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:37 Real-time file system protection file C:\WINDOWS\system32\iexpress.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:35 Real-time file system protection file C:\WINDOWS\system32\hostname.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:34 Real-time file system protection file C:\WINDOWS\system32\help.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:34 Real-time file system protection file C:\WINDOWS\system32\grpconv.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:34 Real-time file system protection file C:\WINDOWS\system32\gpupdate.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:34 Real-time file system protection file C:\WINDOWS\system32\gpresult.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:33 Real-time file system protection file C:\WINDOWS\system32\getmac.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:33 Real-time file system protection file C:\WINDOWS\system32\ftp.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:33 Real-time file system protection file C:\WINDOWS\system32\fsutil.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:33 Real-time file system protection file C:\WINDOWS\system32\fsquirt.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:32 Real-time file system protection file C:\WINDOWS\system32\freecell.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:32 Real-time file system protection file C:\WINDOWS\system32\forcedos.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:32 Real-time file system protection file C:\WINDOWS\system32\fontview.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:32 Real-time file system protection file C:\WINDOWS\system32\fltMc.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:32 Real-time file system protection file C:\WINDOWS\system32\fixmapi.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:31 Real-time file system protection file C:\WINDOWS\system32\findstr.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:31 Real-time file system protection file C:\WINDOWS\system32\find.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:31 Real-time file system protection file C:\WINDOWS\system32\fc.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:31 Real-time file system protection file C:\WINDOWS\system32\extrac32.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:31 Real-time file system protection file C:\WINDOWS\system32\expand.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:30 Real-time file system protection file C:\WINDOWS\system32\eventvwr.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:30 Real-time file system protection file C:\WINDOWS\system32\eventtriggers.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:30 Real-time file system protection file C:\WINDOWS\system32\eventcreate.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:28 Real-time file system protection file C:\WINDOWS\system32\dvdupgrd.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:27 Real-time file system protection file C:\WINDOWS\system32\dvdplay.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:27 Real-time file system protection file C:\WINDOWS\system32\drwtsn32.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:26 Real-time file system protection file C:\WINDOWS\system32\driverquery.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:26 Real-time file system protection file C:\WINDOWS\system32\dpvsetup.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:26 Real-time file system protection file C:\WINDOWS\system32\dpnsvr.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:26 Real-time file system protection file C:\WINDOWS\system32\dplaysvr.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:25 Real-time file system protection file C:\WINDOWS\system32\doskey.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:24 Real-time file system protection file C:\WINDOWS\system32\dllhst3g.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:19 Real-time file system protection file C:\WINDOWS\system32\diskperf.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:19 Real-time file system protection file C:\WINDOWS\system32\diskpart.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:19 Real-time file system protection file C:\WINDOWS\system32\diantz.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:18 Real-time file system protection file C:\WINDOWS\system32\dfrgfat.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:17 Real-time file system protection file C:\WINDOWS\system32\defrag.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:17 Real-time file system protection file C:\WINDOWS\system32\ddeshare.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:10 Real-time file system protection file C:\WINDOWS\system32\convert.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:10 Real-time file system protection file C:\WINDOWS\system32\control.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:09 Real-time file system protection file C:\WINDOWS\system32\compact.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:09 Real-time file system protection file C:\WINDOWS\system32\comp.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:08 Real-time file system protection file C:\WINDOWS\system32\cmstp.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:08 Real-time file system protection file C:\WINDOWS\system32\cmmon32.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:08 Real-time file system protection file C:\WINDOWS\system32\cmdl32.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:07 Real-time file system protection file C:\WINDOWS\system32\clipbrd.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:07 Real-time file system protection file C:\WINDOWS\system32\cleanmgr.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:06 Real-time file system protection file C:\WINDOWS\system32\ckcnv.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:06 Real-time file system protection file C:\WINDOWS\system32\cidaemon.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:06 Real-time file system protection file C:\WINDOWS\system32\chkntfs.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:06 Real-time file system protection file C:\WINDOWS\system32\chkdsk.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:06 Real-time file system protection file C:\WINDOWS\system32\charmap.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:04 Real-time file system protection file C:\WINDOWS\system32\cacls.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:04 Real-time file system protection file C:\WINDOWS\system32\bootvrfy.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:04 Real-time file system protection file C:\WINDOWS\system32\bootok.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:04 Real-time file system protection file C:\WINDOWS\system32\blastcln.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:02 Real-time file system protection file C:\WINDOWS\system32\attrib.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:02 Real-time file system protection file C:\WINDOWS\system32\at.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:02 Real-time file system protection file C:\WINDOWS\system32\asr_pfu.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:02 Real-time file system protection file C:\WINDOWS\system32\asr_ldm.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:01 Real-time file system protection file C:\WINDOWS\system32\asr_fmt.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:01 Real-time file system protection file C:\WINDOWS\system32\arp.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:01 Real-time file system protection file C:\WINDOWS\system32\ahui.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:25:00 Real-time file system protection file C:\WINDOWS\system32\accwiz.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:22:57 Real-time file system protection file C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:22:18 Real-time file system protection file C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:21:19 Real-time file system protection file C:\WINDOWS\ie7updates\KB961260-IE7\ieudinit.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:21:16 Real-time file system protection file C:\WINDOWS\ie7updates\KB958215-IE7\iexplore.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:21:15 Real-time file system protection file C:\WINDOWS\ie7updates\KB958215-IE7\ie4uinit.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:55 Real-time file system protection file C:\WINDOWS\winhlp32.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:55 Real-time file system protection file C:\WINDOWS\TASKMAN.EXE Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:51 Real-time file system protection file C:\WINDOWS\RTLCPL.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:48 Real-time file system protection file C:\WINDOWS\regedit.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:46 Real-time file system protection file C:\WINDOWS\hh.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:44 Real-time file system protection file C:\WINDOWS\alcwzrd.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:43 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035957.EXE Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:43 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035956.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:43 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035955.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:43 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035954.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:42 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035953.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:42 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035952.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:42 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035951.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:42 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035950.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:41 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035949.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:41 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035948.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:41 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035947.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:40 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035945.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:39 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035946.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:33 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035944.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:31 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035932.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:31 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035936.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:31 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035933.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:31 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035935.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:30 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035934.EXE Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:29 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035931.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:28 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035930.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:28 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035929.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:28 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035928.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:27 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035927.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:27 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035926.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:27 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035925.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:26 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035924.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:26 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035922.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:26 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035921.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:26 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035919.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 14:17:26 Real-time file system protection file C:\System Volume Information\_restore{2A857E51-C04F-4EE1-823B-E7F700592596}\RP70\A0035918.exe Win32/Virut.NBM virus cleaned - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 13:49:25 Real-time file system protection file C:\windows\system32\spoolsv.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 13:49:14 Real-time file system protection file C:\windows\system32\ctfmon.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 13:49:13 Real-time file system protection file C:\windows\system32\astsrv.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 13:49:13 Real-time file system protection file C:\windows\system32\alg.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 13:49:12 Real-time file system protection file C:\windows\rthdcpl.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 13:49:10 Real-time file system protection file C:\windows\explorer.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 13:49:07 Real-time file system protection file C:\windows\explorer.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 13:49:02 Real-time file system protection file C:\program files\bonjour\mdnsresponder.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 13:48:58 Real-time file system protection file C:\program files\bonjour\mdnsresponder.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 13:48:42 Real-time file system protection file C:\WINDOWS\system32\spoolsv.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 13:48:42 Real-time file system protection file C:\Program Files\Bonjour\mDNSResponder.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
17/04/2009 13:48:42 Real-time file system protection file C:\WINDOWS\explorer.exe Win32/Virut.NBM virus error while cleaning NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe.
Post #12
OK.

Clearly your whole system is infected. The scans might come up clean now, but what scans cannot show is how the virus has corrupted your legitimate files.

This virus is deadly…believe me, your system cannot be saved. I know this is not what you wanted to hear.

Please cut your losses now and do a complete wipe of your system, reinstalling in partitions cannot be trusted either.


Tutorial can be found here.

How to reformat your computer
Post #13 last edited
Just a question: I have two physical hard drivers connected to my PC. I want to format one of them, then move my files to it, then format the other hard drive. (don't worry I'll only backup some pictures and songs (and avi files, but i read on this forum that this is allowed [was written by one of the Teaching Team], so I'll guess take the risk). the question is… is it safe to do it? to format a hard-drive using an infected windows? the formatted hard-drive always contain the folder System Volume Information. how can i remove that folder? i disabled the system restore. thanks a lot. so sorry for all the questions and nagging.
Post #14
Hi, Honestly I don't know the answer to that but I shall post in our staff forum and find out for you. Don't worry about asking questions or nagging…I really don't mind either…that's how we learn…now i am going to find an answer (hopefully) to something I don't know either… It might take a while to get back to you with an answer…so hang tight. CB
Post #15
Hi

I received a response from one of our experts that it is not safe to reformat in the manner in which you are suggesting.

He suggested that you post a new topic in our Tech forum HERE and let one of our excellent expert tech gurus guide you through this process so there is no chance of reinfection or corruption.

Link back to this topic here so the tech experts can see what has occurred.


Good luck

CB

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI