What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] what happened? (failtechie)

51 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #61
Hi Jun23, The download links are named Major Geeks [Usa]. When you click the link you will be taken to the download page which has some advertising on it, do not download anything else. If you have a popup blocker you will need to allow the popups. The download box should appear. 📎mbam.JPG
Post #62
Hi, I'm having problems with updating the Kaspersky Online Scanner. This is the prompt that came up after it said I finished downloading and installing the application. Update has failed. Program has failed to start. Close the Kaspersky Online Scanner 7.0 window and open it again to install the program. You must be online to update the Kaspersky Online Scanner 7.0 database. With the latest database updates, you can find new viruses and other threats. Please go online to use Kaspersky Online Scanner 7.0. [ERROR: Key is expired]
Post #63
Hi Jun23,

Sounds like Kaspersky is having another bad hairday. Let's use this one instead.

(Note: You must use Internet Explorer for this scan.)

Go here to run an online scannner from ESET:
http://www.eset.eu/online-scanner

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
  • Click Start
  • Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
  • Click Scan.
  • Wait for the scan to finish.
  • Re-enable your Antivirus software.
  • A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. We will need this later.

Please post back with the
  • MBAM log
  • Eset log
  • OTL log taken last

Thanks
Post #64
Hi,
here is the MBAM log
Malwarebytes' Anti-Malware 1.40
Database version: 2574
Windows 5.1.2600 Service Pack 2

07/08/2009 16:17:25
mbam-log-2009-08-07 (16-17-25).txt

Scan type: Quick Scan
Objects scanned: 92697
Time elapsed: 6 minute(s), 33 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\userinit.old.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nfr.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\9gdfgjf23 (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\WINDOWS\t55ft3518f44.dat (Worm.KoobFace) -> Quarantined and deleted successfully.


Here is the ESET log

ESETSmartInstaller@High as downloader log:
all ok
# version=6
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.5889
# api_version=3.0.2
# EOSSerial=a148c9e5463ae64196b587751005ff81
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2009-08-09 10:38:41
# local_time=2009-08-09 11:38:41 (+0000, GMT Standard Time)
# country="United Kingdom"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=3073 61 80 44 105483727343750
# scanned=130679
# found=222
# cleaned=0
# scan_time=2967
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinTDSSrtk3.zip Win32/Bagle.gen.zip worm 00000000000000000000000000000000 I
C:\Documents and Settings\HP_Owner\My Documents\My Music\Paramore - Riot [Full Album] (2007)\08 Paramore - Crushcrushcrush.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\Hquhofajah.dll.vir a variant of Win32/Kryptik.JU trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\ld01.exe.vir Win32/Koobface.NAW worm 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\aereajfm.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\amlskyoc.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\avljxegh.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\bckwfukc.dll.vir a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\bnaiqtjn.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\brwbmvdq.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\buxfsliw.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\chveyevy.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\cimdja.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\coykslma.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ctevhrtm.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\cwkrhdee.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\dmrfsevm.dll.vir a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\dpcybytt.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\dqgwzt.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\eedhrkwc.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\enctrhry.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\enydnfai.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\eqavjbvo.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\espbjsvx.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\fbeaqofy.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\fgibtnqp.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\flpjekga.dll.vir a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\fsivjyyb.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ftansiup.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\fugnsxim.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\fysfmkxp.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\gdkbupgs.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\gkknjfgm.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\grebla.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\hgexjlva.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\hs3i7jdgfd.dll.vir a variant of Win32/Kryptik.JV trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\htcxqdot.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\hufmhz.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\hulgamtp.dll.vir a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\huwsepqx.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\iaplqqer.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\iguhfh.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\imprdqux.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\itnhjeoy.dll.vir Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\iuwcfx.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\jjagcy.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\jrftennt.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\kccmff.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\krbqtigm.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\kyfekvol.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ldxyjvfo.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ltuniflr.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\lvfwkvsb.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\meamhhho.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mfjaerea.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mgfjnkkg.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mgitqbrk.dll.vir Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mixsnguf.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mqvdtmds.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mrgvmlgr.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mstssbvp.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mtrhvetc.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mukruhwu.dll.vir a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\muwcepgn.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ngpecwum.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\njtqianb.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\nsluwkod.dll.vir a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\nykeegcx.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\oaxborre.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ofvjyxdl.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\orjelleg.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ovbjvaqe.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\pjynqswq.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\puisnatf.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\pvbsstsm.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\qdvmbwrb.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\qifzhn.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\qrfhylkt.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\qtssvmts.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\qwsqnyjp.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\qxyudf.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\reqqlpai.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\rfkxuo.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\rglmvgrm.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\rlfinutl.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\rtqllumv.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\sdmtdvqm.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\stmvsstq.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\svoicvxm.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\tmhtkxhw.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\tnnetfrj.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\todqxcth.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\tphjhj.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ttybycpd.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\uksudlvj.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\usmrgdej.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\vadumz.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\vgkiwisr.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\vmullqtr.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\whxkthmt.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\wtaydcpl.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\wukuraqx.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\xcgeekyn.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\xqarukuw.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\xvsjbpse.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\yaycseuv.dll.vir a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\yfoqaebf.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\yoejhnti.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\yrhrtcne.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\yzussd.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\UACd.sys.vir Win32/Olmarik.FT trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096106.sys Win32/Olmarik.FT trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096109.exe Win32/Koobface.NAW worm 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096110.com Win32/AutoRun.ABH worm 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096111.com Win32/AutoRun.ABH worm 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096114.dll a variant of Win32/Kryptik.JU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096115.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096116.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096117.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096118.dll a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096119.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096120.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096121.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096122.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096123.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096124.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096125.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096126.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096127.dll a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096128.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096129.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096130.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096131.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096132.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096133.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096134.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096135.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096136.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096137.dll a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096138.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096139.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096140.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096141.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096142.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096143.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096144.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096145.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096146.dll a variant of Win32/Kryptik.JV trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096147.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096148.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096149.dll a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096150.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096151.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096152.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096153.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096154.dll Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096155.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096156.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096157.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096158.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096159.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096160.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096161.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096162.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096163.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096164.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096165.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096166.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096167.dll Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096168.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096169.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096170.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096171.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096172.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096173.dll a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096174.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096175.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096176.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096177.dll a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096178.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096179.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096180.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096181.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096182.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096183.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096184.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096185.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096186.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096187.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096188.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096189.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096190.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096191.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096192.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096193.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096194.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096195.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096196.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096197.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096198.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096199.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096200.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096201.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096202.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096203.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096204.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096205.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096206.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096207.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096208.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096209.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096210.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096211.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096212.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096213.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096214.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096215.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096216.dll a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096217.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096218.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096219.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096220.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
ESETSmartInstaller@High as downloader log:
all ok
# version=6
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.5889
# api_version=3.0.2
# EOSSerial=a148c9e5463ae64196b587751005ff81
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2009-08-10 10:07:06
# local_time=2009-08-10 11:07:06 (+0000, GMT Standard Time)
# country="United Kingdom"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=3073 61 80 44 105896772500000
# scanned=130994
# found=222
# cleaned=0
# scan_time=2760
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinTDSSrtk3.zip Win32/Bagle.gen.zip worm 00000000000000000000000000000000 I
C:\Documents and Settings\HP_Owner\My Documents\My Music\Paramore - Riot [Full Album] (2007)\08 Paramore - Crushcrushcrush.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\Hquhofajah.dll.vir a variant of Win32/Kryptik.JU trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\ld01.exe.vir Win32/Koobface.NAW worm 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\aereajfm.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\amlskyoc.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\avljxegh.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\bckwfukc.dll.vir a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\bnaiqtjn.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\brwbmvdq.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\buxfsliw.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\chveyevy.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\cimdja.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\coykslma.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ctevhrtm.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\cwkrhdee.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\dmrfsevm.dll.vir a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\dpcybytt.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\dqgwzt.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\eedhrkwc.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\enctrhry.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\enydnfai.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\eqavjbvo.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\espbjsvx.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\fbeaqofy.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\fgibtnqp.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\flpjekga.dll.vir a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\fsivjyyb.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ftansiup.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\fugnsxim.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\fysfmkxp.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\gdkbupgs.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\gkknjfgm.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\grebla.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\hgexjlva.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\hs3i7jdgfd.dll.vir a variant of Win32/Kryptik.JV trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\htcxqdot.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\hufmhz.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\hulgamtp.dll.vir a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\huwsepqx.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\iaplqqer.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\iguhfh.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\imprdqux.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\itnhjeoy.dll.vir Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\iuwcfx.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\jjagcy.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\jrftennt.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\kccmff.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\krbqtigm.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\kyfekvol.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ldxyjvfo.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ltuniflr.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\lvfwkvsb.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\meamhhho.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mfjaerea.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mgfjnkkg.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mgitqbrk.dll.vir Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mixsnguf.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mqvdtmds.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mrgvmlgr.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mstssbvp.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mtrhvetc.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mukruhwu.dll.vir a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\muwcepgn.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ngpecwum.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\njtqianb.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\nsluwkod.dll.vir a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\nykeegcx.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\oaxborre.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ofvjyxdl.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\orjelleg.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ovbjvaqe.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\pjynqswq.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\puisnatf.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\pvbsstsm.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\qdvmbwrb.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\qifzhn.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\qrfhylkt.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\qtssvmts.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\qwsqnyjp.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\qxyudf.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\reqqlpai.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\rfkxuo.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\rglmvgrm.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\rlfinutl.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\rtqllumv.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\sdmtdvqm.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\stmvsstq.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\svoicvxm.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\tmhtkxhw.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\tnnetfrj.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\todqxcth.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\tphjhj.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ttybycpd.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\uksudlvj.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\usmrgdej.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\vadumz.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\vgkiwisr.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\vmullqtr.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\whxkthmt.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\wtaydcpl.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\wukuraqx.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\xcgeekyn.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\xqarukuw.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\xvsjbpse.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\yaycseuv.dll.vir a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\yfoqaebf.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\yoejhnti.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\yrhrtcne.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\yzussd.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\UACd.sys.vir Win32/Olmarik.FT trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096106.sys Win32/Olmarik.FT trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096109.exe Win32/Koobface.NAW worm 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096110.com Win32/AutoRun.ABH worm 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096111.com Win32/AutoRun.ABH worm 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096114.dll a variant of Win32/Kryptik.JU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096115.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096116.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096117.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096118.dll a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096119.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096120.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096121.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096122.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096123.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096124.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096125.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096126.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096127.dll a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096128.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096129.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096130.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096131.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096132.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096133.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096134.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096135.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096136.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096137.dll a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096138.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096139.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096140.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096141.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096142.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096143.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096144.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096145.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096146.dll a variant of Win32/Kryptik.JV trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096147.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096148.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096149.dll a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096150.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096151.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096152.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096153.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096154.dll Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096155.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096156.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096157.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096158.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096159.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096160.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096161.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096162.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096163.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096164.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096165.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096166.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096167.dll Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096168.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096169.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096170.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096171.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096172.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096173.dll a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096174.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096175.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096176.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096177.dll a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096178.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096179.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096180.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096181.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096182.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096183.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096184.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096185.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096186.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096187.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096188.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096189.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096190.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096191.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096192.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096193.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096194.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096195.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096196.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096197.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096198.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096199.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096200.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096201.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096202.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096203.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096204.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096205.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096206.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096207.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096208.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096209.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096210.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096211.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096212.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096213.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096214.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096215.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096216.dll a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096217.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096218.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096219.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096220.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
esets_scanner_update returned -1 esets_gle=53251
# version=6
# IEXPLORE.EXE=6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
# OnlineScanner.ocx=1.0.0.5889
# api_version=3.0.2
# EOSSerial=a148c9e5463ae64196b587751005ff81
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2009-08-11 08:38:36
# local_time=2009-08-11 09:38:36 (+0000, GMT Standard Time)
# country="United Kingdom"
# lang=9
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=3073 61 80 44 106707667500000
# scanned=132115
# found=222
# cleaned=0
# scan_time=2174
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinTDSSrtk3.zip Win32/Bagle.gen.zip worm 00000000000000000000000000000000 I
C:\Documents and Settings\HP_Owner\My Documents\My Music\Paramore - Riot [Full Album] (2007)\08 Paramore - Crushcrushcrush.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\Hquhofajah.dll.vir a variant of Win32/Kryptik.JU trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\ld01.exe.vir Win32/Koobface.NAW worm 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\aereajfm.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\amlskyoc.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\avljxegh.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\bckwfukc.dll.vir a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\bnaiqtjn.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\brwbmvdq.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\buxfsliw.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\chveyevy.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\cimdja.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\coykslma.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ctevhrtm.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\cwkrhdee.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\dmrfsevm.dll.vir a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\dpcybytt.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\dqgwzt.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\eedhrkwc.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\enctrhry.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\enydnfai.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\eqavjbvo.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\espbjsvx.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\fbeaqofy.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\fgibtnqp.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\flpjekga.dll.vir a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\fsivjyyb.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ftansiup.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\fugnsxim.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\fysfmkxp.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\gdkbupgs.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\gkknjfgm.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\grebla.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\hgexjlva.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\hs3i7jdgfd.dll.vir a variant of Win32/Kryptik.JV trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\htcxqdot.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\hufmhz.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\hulgamtp.dll.vir a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\huwsepqx.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\iaplqqer.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\iguhfh.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\imprdqux.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\itnhjeoy.dll.vir Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\iuwcfx.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\jjagcy.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\jrftennt.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\kccmff.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\krbqtigm.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\kyfekvol.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ldxyjvfo.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ltuniflr.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\lvfwkvsb.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\meamhhho.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mfjaerea.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mgfjnkkg.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mgitqbrk.dll.vir Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mixsnguf.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mqvdtmds.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mrgvmlgr.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mstssbvp.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mtrhvetc.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mukruhwu.dll.vir a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\muwcepgn.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ngpecwum.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\njtqianb.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\nsluwkod.dll.vir a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\nykeegcx.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\oaxborre.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ofvjyxdl.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\orjelleg.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ovbjvaqe.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\pjynqswq.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\puisnatf.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\pvbsstsm.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\qdvmbwrb.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\qifzhn.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\qrfhylkt.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\qtssvmts.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\qwsqnyjp.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\qxyudf.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\reqqlpai.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\rfkxuo.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\rglmvgrm.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\rlfinutl.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\rtqllumv.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\sdmtdvqm.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\stmvsstq.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\svoicvxm.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\tmhtkxhw.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\tnnetfrj.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\todqxcth.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\tphjhj.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ttybycpd.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\uksudlvj.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\usmrgdej.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\vadumz.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\vgkiwisr.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\vmullqtr.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\whxkthmt.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\wtaydcpl.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\wukuraqx.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\xcgeekyn.dll.vir Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\xqarukuw.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\xvsjbpse.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\yaycseuv.dll.vir a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\yfoqaebf.dll.vir a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\yoejhnti.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\yrhrtcne.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\yzussd.dll.vir a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\UACd.sys.vir Win32/Olmarik.FT trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096106.sys Win32/Olmarik.FT trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096109.exe Win32/Koobface.NAW worm 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096110.com Win32/AutoRun.ABH worm 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096111.com Win32/AutoRun.ABH worm 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096114.dll a variant of Win32/Kryptik.JU trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096115.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096116.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096117.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096118.dll a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096119.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096120.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096121.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096122.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096123.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096124.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096125.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096126.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096127.dll a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096128.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096129.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096130.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096131.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096132.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096133.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096134.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096135.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096136.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096137.dll a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096138.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096139.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096140.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096141.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096142.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096143.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096144.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096145.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096146.dll a variant of Win32/Kryptik.JV trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096147.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096148.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096149.dll a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096150.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096151.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096152.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096153.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096154.dll Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096155.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096156.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096157.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096158.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096159.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096160.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096161.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096162.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096163.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096164.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096165.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096166.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096167.dll Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096168.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096169.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096170.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096171.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096172.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096173.dll a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096174.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096175.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096176.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096177.dll a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096178.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096179.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096180.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096181.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096182.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096183.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096184.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096185.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096186.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096187.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096188.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096189.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096190.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096191.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096192.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096193.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096194.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096195.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096196.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096197.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096198.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096199.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096200.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096201.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096202.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096203.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096204.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096205.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096206.dll Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096207.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096208.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096209.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096210.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096211.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096212.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096213.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096214.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096215.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096216.dll a variant of Win32/Kryptik.TZ trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096217.dll a variant of Win32/Adware.Virtumonde.NEF application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096218.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096219.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{D207F513-1AD2-4EA6-B9AE-1EC20364A2B0}\RP65\A0096220.dll a variant of Win32/Adware.SuperJuan.A application 00000000000000000000000000000000 I


And this is the OTL log taken last.

OTL logfile created on: 11/08/2009 08:00:23 - Run 4
OTL by OldTimer - Version 3.0.10.3 Folder = C:\Documents and Settings\HP_Owner\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

511.29 Mb Total Physical Memory | 272.55 Mb Available Physical Memory | 53.31% Memory free
1.22 Gb Paging File | 0.85 Gb Available in Paging File | 69.46% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 181.71 Gb Total Space | 134.10 Gb Free Space | 73.80% Space Free | Partition Type: NTFS
Drive D: | 4.58 Gb Total Space | 0.96 Gb Free Space | 20.93% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: YOUR-A52C34C618
Current User Name: HP_Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\WINDOWS\System32\Ati2evxx.exe (ATI Technologies Inc.)
PRC - C:\WINDOWS\System32\Ati2evxx.exe (ATI Technologies Inc.)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
PRC - C:\Program Files\Real\RealPlayer\RealPlay.exe (RealNetworks, Inc.)
PRC - C:\HP\KBD\KBD.EXE (Hewlett-Packard Company)
PRC - C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
PRC - C:\windows\system\hpsysdrv.exe (Hewlett-Packard Company)
PRC - C:\Program Files\Common Files\AOL\1229762181\ee\AOLSoftware.exe (America Online, Inc.)
PRC - C:\Program Files\COMODO\Firewall\cfp.exe ()
PRC - C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
PRC - C:\Program Files\Common Files\AOL\ACS\AOLDial.exe (AOL LLC)
PRC - C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
PRC - C:\WINDOWS\AGRSMMSG.exe (Agere Systems)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
PRC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)
PRC - C:\Program Files\COMODO\Firewall\cmdagent.exe ()
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\WINDOWS\System32\tcpsvcs.exe (Microsoft Corporation)
PRC - c:\program files\common files\aol\1229762181\ee\services\antiSpywareApp\ver2_0_12\AOLSP Scheduler.exe ()
PRC - c:\program files\common files\aol\1229762181\ee\aolsoftware.exe (America Online, Inc.)
PRC - C:\WINDOWS\System32\wscntfy.exe (Microsoft Corporation)
PRC - C:\WINDOWS\System32\wbem\wmiprvse.exe (Microsoft Corporation)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Documents and Settings\HP_Owner\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AOL Companion\companion.exe ()

========== Win32 Services (SafeList) ==========

SRV - (6to4 [Auto | Running]) – C:\WINDOWS\System32\6to4svc.dll (Microsoft Corporation)
SRV - (AOL ACS [Auto | Running]) – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)
SRV - (aspnet_state [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (Microsoft Corporation)
SRV - (Ati HotKey Poller [Auto | Running]) – C:\WINDOWS\System32\Ati2evxx.exe (ATI Technologies Inc.)
SRV - (cmdAgent [Auto | Running]) – C:\Program Files\COMODO\Firewall\cmdagent.exe ()
SRV - (helpsvc [Auto | Running]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (JavaQuickStarterService [Auto | Running]) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (LPDSVC [On_Demand | Stopped]) – C:\WINDOWS\System32\tcpsvcs.exe (Microsoft Corporation)
SRV - (Microsoft Office Groove Audit Service [On_Demand | Stopped]) – C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)
SRV - (odserv [On_Demand | Stopped]) – C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ose [On_Demand | Stopped]) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (p2pgasvc [On_Demand | Stopped]) – C:\WINDOWS\System32\p2pgasvc.dll (Microsoft Corporation)
SRV - (SimpTcp [Auto | Running]) – C:\WINDOWS\System32\tcpsvcs.exe (Microsoft Corporation)
SRV - (WMPNetworkSvc [On_Demand | Stopped]) – C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (AgereSoftModem [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\AGRSM.sys (Agere Systems)
DRV - (ASCTRM [Auto | Running]) – C:\WINDOWS\System32\drivers\asctrm.sys (Windows ® 2000 DDK provider)
DRV - (ati2mtag [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ati2mtag.sys (ATI Technologies Inc.)
DRV - (Cap7134 [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\Cap7134.sys (ASUSTek)
DRV - (cmdGuard [System | Running]) – C:\WINDOWS\System32\DRIVERS\cmdguard.sys (COMODO)
DRV - (cmdHlp [System | Running]) – C:\WINDOWS\System32\DRIVERS\cmdhlp.sys (COMODO)
DRV - (HDAudBus [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider)
DRV - (ialm [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\ialmnt5.sys (Intel Corporation)
DRV - (Inspect [Boot | Running]) – C:\WINDOWS\System32\DRIVERS\inspect.sys (COMODO)
DRV - (IntcAzAudAddService [On_Demand | Running]) – C:\WINDOWS\System32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (Iviaspi [On_Demand | Running]) – C:\WINDOWS\System32\drivers\iviaspi.sys (InterVideo, Inc.)
DRV - (PhTVTune [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\PhTVTune.sys (ASUSTek)
DRV - (Ps2 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\PS2.sys (Hewlett-Packard Company)
DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (PxHelp20 [Boot | Running]) – C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (rtl8139 [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\R8139n51.SYS (Realtek Semiconductor Corporation )
DRV - (Secdrv [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\secdrv.sys ()
DRV - (SiS315 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (SISAGP [Boot | Running]) – C:\WINDOWS\system32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)
DRV - (SiSkp [System | Running]) – C:\WINDOWS\System32\DRIVERS\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (Tcpip6 [System | Running]) – C:\WINDOWS\System32\DRIVERS\tcpip6.sys (Microsoft Corporation)
DRV - (viaagp1 [Boot | Running]) – C:\WINDOWS\system32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.)
DRV - (viagfx [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\vtmini.sys (Copyright © VIA/S3 Graphics Co, Ltd.)
DRV - (wanatw [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\wanatw4.sys (America Online, Inc.)

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p…ER}&ar=home
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=localhost:7070

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.explosm.net/comics"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.0.1
FF - prefs.js..extensions.enabledItems: [removed]:6.0
FF - prefs.js..extensions.enabledItems: {3112ca9c-de6d-4884-a869-9855de68056c}:5.0.20090805W
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}:6.0.14
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:1.4.4
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.13
FF - prefs.js..network.proxy.http_port: 7070

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009/08/05 08:19:52 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/08/06 09:54:56 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/08/05 08:20:11 | 00,000,000 | —D | M]

[2008/12/20 09:53:38 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Extensions
[2008/12/20 09:53:38 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/08/11 01:48:01 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Firefox\Profiles\17ibpqgm.default\extensions
[2009/08/11 01:48:00 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Firefox\Profiles\17ibpqgm.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2009/01/27 21:42:31 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Firefox\Profiles\17ibpqgm.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2009/02/11 01:34:02 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Firefox\Profiles\17ibpqgm.default\extensions\[removed]
[2009/04/04 19:40:17 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Firefox\Profiles\17ibpqgm.default\extensions\[removed]
[2009/08/11 07:32:39 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions
[2009/08/05 07:28:02 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/01/04 20:39:03 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}
[2009/08/05 08:20:14 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
[2009/08/05 07:27:56 | 00,023,032 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/08/05 07:27:56 | 00,134,648 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2009/08/05 08:19:51 | 00,410,984 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeploytk.dll
[2009/08/05 07:27:58 | 00,065,528 | —- | M] (mozilla.org) – C:\Program Files\mozilla firefox\plugins\npnul32.dll
[2006/10/26 21:12:16 | 00,016,192 | —- | M] (Microsoft Corporation) – C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL
[2008/01/04 16:36:50 | 00,001,538 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2006/07/05 19:47:38 | 00,002,193 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2008/01/04 16:36:50 | 00,000,947 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2008/03/08 10:35:22 | 00,001,534 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2008/09/22 20:14:04 | 00,000,759 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2008/04/16 05:08:20 | 00,001,706 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\google.xml
[2008/03/28 19:11:14 | 00,001,178 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2008/01/04 16:36:50 | 00,000,831 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKLM\..\Toolbar: (HP view) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll (Hewlett-Packard Company)
O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKCU\..\Toolbar\ShellBrowser: (HP view) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\WebBrowser: (HP view) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [AGRSMMSG] C:\WINDOWS\AGRSMMSG.exe (Agere Systems)
O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4 - HKLM..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe (AOL LLC)
O4 - HKLM..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [COMODO Firewall Pro] C:\Program Files\COMODO\Firewall\cfp.exe ()
O4 - HKLM..\Run: [HostManager] C:\Program Files\Common Files\AOL\1229762181\ee\AOLSoftware.exe (America Online, Inc.)
O4 - HKLM..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe (Hewlett-Packard)
O4 - HKLM..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [KBD] C:\HP\KBD\KBD.EXE (Hewlett-Packard Company)
O4 - HKLM..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [PS2] C:\WINDOWS\System32\ps2.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE ()
O4 - HKLM..\Run: [SiSPower] C:\WINDOWS\System32\SiSPower.DLL (Silicon Integrated Systems Corporation)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe (America Online, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\HP_Owner\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &AOL Toolbar search - C:\Program Files\AOL Toolbar\toolbar.dll File not found
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - Reg Error: Value error. File not found
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 50 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O15 - HKCU\..Trusted Domains: 50 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\Ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/01/01 09:58:38 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/28 06:07:38 | 00,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2004/04/30 22:01:14 | 00,000,053 | -HS- | M] () - D:\AUTORUN.FCB – [ FAT32 ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found

========== Files/Folders - Created Within 30 Days ==========

[2009/08/10 00:00:48 | 00,013,459 | —- | C] () – C:\Documents and Settings\HP_Owner\My Documents\eset scanner threats.docx
[2009/08/09 22:45:51 | 00,000,000 | —D | C] – C:\Program Files\ESET
[2009/08/09 22:45:02 | 02,668,240 | —- | C] () – C:\Documents and Settings\HP_Owner\Desktop\esetsmartinstaller_enu.exe
[2009/08/07 15:57:54 | 00,000,000 | —D | C] – C:\Documents and Settings\HP_Owner\Application Data\Malwarebytes
[2009/08/07 15:57:50 | 00,000,707 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/08/07 15:57:47 | 00,038,160 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/08/07 15:57:45 | 00,019,096 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/08/07 15:57:45 | 00,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2009/08/07 15:57:45 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/08/07 15:56:30 | 03,942,048 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\HP_Owner\Desktop\mbam-setup.exe
[2009/08/05 08:20:11 | 00,073,728 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2009/08/05 08:20:10 | 00,410,984 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deploytk.dll
[2009/08/05 08:20:10 | 00,148,888 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2009/08/05 08:20:10 | 00,144,792 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2009/08/05 08:20:10 | 00,144,792 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2009/08/03 17:46:39 | 16,254,360 | —- | C] (Sun Microsystems, Inc.) – C:\Documents and Settings\HP_Owner\Desktop\jre-6u14-windows-i586.exe
[2009/08/02 12:37:49 | 00,073,728 | —- | C] (Realtek Semiconductor Corp.) – C:\WINDOWS\ALCFDRTM.EXE
[2009/08/02 12:28:01 | 00,000,000 | -HSD | C] – C:\RECYCLER
[2009/08/02 12:09:54 | 00,000,000 | —D | C] – C:\WINDOWS\temp
[2009/08/02 11:48:33 | 00,000,000 | —D | C] – C:\_OTL
[2009/07/29 21:31:53 | 00,513,536 | —- | C] (OldTimer Tools) – C:\Documents and Settings\HP_Owner\Desktop\OTL.exe
[2009/07/14 15:48:23 | 53,620,3264 | -HS- | C] () – C:\hiberfil.sys
[2009/04/09 21:32:30 | 00,143,104 | —- | C] () – C:\WINDOWS\System32\guard32.dll
[2009/02/19 18:11:25 | 00,000,029 | —- | C] () – C:\WINDOWS\DEBUGSM.INI
[2009/02/17 02:12:40 | 00,000,072 | —- | C] () – C:\WINDOWS\System32\epDPE.ini
[2009/02/17 02:11:01 | 00,000,022 | —- | C] () – C:\WINDOWS\System32\PICSDK.ini
[2009/02/17 02:08:32 | 00,000,025 | —- | C] () – C:\WINDOWS\CDE CX6600E.ini
[2009/01/29 22:08:55 | 00,000,665 | —- | C] () – C:\WINDOWS\wininit.ini
[2009/01/04 20:25:18 | 00,000,081 | —- | C] () – C:\WINDOWS\DVDConverter.INI
[2009/01/04 20:24:51 | 00,765,952 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/01/04 20:24:51 | 00,180,224 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2008/12/23 15:16:33 | 00,000,162 | —- | C] () – C:\WINDOWS\ODBC.INI
[2008/12/19 17:58:21 | 00,000,004 | —- | C] () – C:\WINDOWS\msoffice.ini
[2008/12/18 22:06:10 | 00,000,540 | —- | C] () – C:\WINDOWS\AppRun.ini
[2006/03/06 11:41:02 | 00,073,728 | —- | C] () – C:\WINDOWS\System32\AMV_DecDLL.dll
[2006/01/04 19:19:27 | 00,027,440 | —- | C] () – C:\WINDOWS\System32\drivers\secdrv.sys
[2006/01/04 19:18:08 | 00,081,920 | —- | C] () – C:\WINDOWS\System32\ieencode.dll
[2005/01/02 01:00:19 | 00,103,579 | —- | C] () – C:\WINDOWS\VGAsetup.ini
[2005/01/02 01:00:19 | 00,095,249 | —- | C] () – C:\WINDOWS\System32\VGAunistlog.ini
[2005/01/01 16:45:30 | 00,000,548 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2005/01/01 16:45:11 | 00,000,695 | —- | C] () – C:\WINDOWS\win.ini
[2005/01/01 16:45:09 | 00,000,227 | —- | C] () – C:\WINDOWS\system.ini
[2005/01/01 13:08:44 | 00,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2005/01/01 11:48:20 | 00,013,779 | —- | C] () – C:\WINDOWS\System32\CHODDI.SYS
[2005/01/01 11:48:11 | 00,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2005/01/01 10:43:52 | 00,192,512 | —- | C] () – C:\WINDOWS\System32\RTCOMDLL.dll
[2005/01/01 10:43:52 | 00,156,160 | —- | C] () – C:\WINDOWS\System32\RTLCPAPI.dll
[2005/01/01 10:38:35 | 00,163,840 | —- | C] ( ) – C:\WINDOWS\System32\ATIDEMGR.dll
[2005/01/01 10:14:45 | 00,299,073 | —- | C] () – C:\WINDOWS\System32\PythonCOM22.dll
[2005/01/01 10:14:45 | 00,065,536 | —- | C] () – C:\WINDOWS\System32\PyWinTypes22.dll
[2005/01/01 10:14:30 | 00,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2005/01/01 10:02:20 | 00,000,802 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/09/16 14:26:40 | 00,012,634 | —- | C] () – C:\WINDOWS\System32\drivers\ADFUUD.SYS
[2004/08/20 04:14:46 | 00,086,016 | —- | C] () – C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2004/08/20 04:14:46 | 00,065,536 | —- | C] () – C:\WINDOWS\System32\ProgressTrace.dll
[2003/04/11 00:04:00 | 00,028,672 | —- | C] () – C:\WINDOWS\System32\JAWTAccessBridge.dll

========== Files - Modified Within 30 Days ==========

[2009/08/11 07:29:06 | 00,000,248 | —- | M] () – C:\WINDOWS\System\hpsysdrv.dat
[2009/08/11 07:29:02 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/08/11 07:29:00 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/08/11 07:28:58 | 53,620,3264 | -HS- | M] () – C:\hiberfil.sys
[2009/08/11 01:54:33 | 00,020,992 | —- | M] () – C:\Documents and Settings\HP_Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/11 01:53:57 | 00,000,695 | —- | M] () – C:\WINDOWS\win.ini
[2009/08/10 00:00:49 | 00,013,459 | —- | M] () – C:\Documents and Settings\HP_Owner\My Documents\eset scanner threats.docx
[2009/08/09 22:45:11 | 02,668,240 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\esetsmartinstaller_enu.exe
[2009/08/07 15:57:50 | 00,000,707 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/08/07 15:56:55 | 03,942,048 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\HP_Owner\Desktop\mbam-setup.exe
[2009/08/05 08:19:50 | 00,148,888 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2009/08/05 08:19:50 | 00,144,792 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2009/08/05 08:19:50 | 00,144,792 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2009/08/05 08:19:50 | 00,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2009/08/05 08:19:49 | 00,410,984 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deploytk.dll
[2009/08/03 17:47:16 | 16,254,360 | —- | M] (Sun Microsystems, Inc.) – C:\Documents and Settings\HP_Owner\Desktop\jre-6u14-windows-i586.exe
[2009/08/03 13:36:28 | 00,038,160 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/08/03 13:36:06 | 00,019,096 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/08/02 12:37:49 | 00,073,728 | —- | M] (Realtek Semiconductor Corp.) – C:\WINDOWS\ALCFDRTM.VER
[2009/08/02 12:37:49 | 00,073,728 | —- | M] (Realtek Semiconductor Corp.) – C:\WINDOWS\ALCFDRTM.EXE
[2009/08/02 12:06:10 | 00,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2009/08/02 12:05:26 | 00,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2009/07/29 21:31:54 | 00,513,536 | —- | M] (OldTimer Tools) – C:\Documents and Settings\HP_Owner\Desktop\OTL.exe
[2009/07/19 11:35:08 | 00,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/07/16 07:25:48 | 04,317,612 | -H– | M] () – C:\Documents and Settings\HP_Owner\Local Settings\Application Data\IconCache.db
[2009/07/13 05:48:54 | 00,219,648 | —- | M] () – C:\WINDOWS\PEV.exe
[2009/07/12 22:36:30 | 00,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20090723-092051.backup
< End of report >
Post #65 last edited
Hi,

Oldman will be off for a little while longer and has asked if I'd look after you while he was gone.

The majority of those files found by ESET are inquarantine or in old system restore points so nothing to worry about as we will be cleaning them up shortly

Please do the following:

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :OTL
PRC - [2008/04/14 05:00:00 | 01,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe 
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=localhost:7070
FF - prefs.js..network.proxy.http_port: 7070
O9 - Extra Button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - Reg Error: Value error. File not found

:Files
C:\Documents and Settings\HP_Owner\My Documents\My Music\Paramore - Riot [Full Album] (2007)\08 Paramore - Crushcrushcrush.mp3

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post the OTL log



NEXT

Click Start > Run then copy/paste the following single-line command into the Run box and click OK:

C:\Qoobox\Add-Remove Programs.txt


A text file should open.

Post the contents of that file in your next reply.




In your next reply, please post

  • OTL log
  • Add/remove Programs Log

Also please advise how your computer is running now and if there are any out standing issues.
Post #66
Hi, Okay then. I guess everybody needs a break every now and then :) Here is the OTL log All processes killed ========== OTL ========== No active process named explorer.exe was found! HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully! HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully! HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully! Prefs.js: 7070 removed from network.proxy.http_port Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{4982D40A-C53B-4615-B15B-B5B5E98D167C}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4982D40A-C53B-4615-B15B-B5B5E98D167C}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{4982D40A-C53B-4615-B15B-B5B5E98D167C}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4982D40A-C53B-4615-B15B-B5B5E98D167C}\ not found. ========== FILES ========== File\Folder C:\Documents and Settings\HP_Owner\My Documents\My Music\Paramore - Riot [Full Album] (2007)\08 Paramore - Crushcrushcrush.mp3 not found. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: HP_Owner ->Temp folder emptied: 76893600 bytes ->Temporary Internet Files folder emptied: 6843153 bytes ->Java cache emptied: 13591817 bytes ->FireFox cache emptied: 57193579 bytes User: LocalService File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot. ->Temp folder emptied: 65984 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 33170 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes Windows Temp folder emptied: 65536 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 147.55 mb OTL by OldTimer - Version 3.0.10.3 log created on 08122009_161312 Files\Folders moved on Reboot… Registry entries deleted on Reboot… And here is the add/remove programmes log ABC (remove only) Adobe Acrobat - Reader 6.0.2 Update Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Reader 6.0.1 Agere Systems PCI Soft Modem AiO_Scan AiOSoftware AOL Coach Version 1.0(Build:20040229.1 uk) AOL Uninstaller ATI Control Panel ATI Display Driver BufferChm CameraDrivers CCleaner (remove only) Choice Guard Combined Community Codec Pack 2008-09-21 16:18 COMODO Firewall Pro Copy CreativeProjects CreativeProjectsTemplates CueTour Dawn Of War Dawn of War - Dark Crusade Dawn of War - Soulstorm Dawn Of War - Winter Assault Destinations DG834 Director DocProc DocumentViewer Easy Internet Sign-up EPSON CardMonitor EPSON Copy Utility 3 EPSON PhotoQuicker3.5 EPSON PhotoStarter3.1 EPSON PRINT Image Framer Tool2.1 EPSON Printer Software EPSON Scan EPSON Smart Panel EPSON Web-To-Page ESCX6600 Reference Guide ESCX6600 Software Guide Fax Help and Support Additions High Definition Audio Driver Package - KB835221 HijackThis 2.0.2 Hotfix for Windows XP (KB926239) Hotfix for Windows XP (KB942288-v3) HP Deskjet Preloaded Printer Drivers HP Diagnostic Assistant HP Image Zone 4.2.3 HP Image Zone Plus 4.2.3 HP Photosmart Cameras 4.0 HP PSC & OfficeJet 4.0 HP Software Update HPIZ423 HpSdpAppCoreApp InstantShare InterVideo DiscLabel Java 2 Runtime Environment, SE v1.4.2_03 KBD Learn2 Player (Uninstall Only) Microsoft .NET Framework 1.1 Microsoft Application Error Reporting Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Visio MUI (English) 2007 Microsoft Office Visio Professional 2007 Microsoft Office Word MUI (English) 2007 Microsoft Software Update for Web Folders (English) 12 Microsoft User-Mode Driver Framework Feature Pack 1.5 Microsoft WinUsb 1.0 Mozilla Firefox (3.0.12) MP3 Player Utilities 4.17 MSVCRT PC-Doctor for Windows PhotoGallery Photosmart 320,370,7400,8100,8400 Series PIF DESIGNER2.1 PrintScreen PS2 PSPrinters06 Python 2.2 combined Win32 extensions Python 2.2.1 QFolder QuickProjects QuickTime Readme RealPlayer Basic RemoveIT Pro v4 - SE Scan ScanToWeb Segoe UI SiS VGA Utilities SkinsHP1 Skype™ 3.8 Spybot - Search & Destroy TrayApp Unload VC 9.0 Runtime Viewpoint Media Player WebFldrs XP WebReg Windows Live Call Windows Live Communications Platform Windows Live Essentials Windows Live Messenger Windows Live Sign-in Assistant Windows Live Upload Tool Windows Media Format 11 runtime Windows Media Player 11 Windows Movie Maker 2.0 Windows XP Hotfix - KB883667 Windows XP Hotfix - KB885295 WinRAR WinRAR archiver Xvid 1.1.3 final uninstall Compter has been running ok, internet's been a bit slow though (but my internet has always been kind of slow so this might not actually be a problem. I'm not sure)
Post #67
Hi,

Oldman960 gave instructions for updating Java? did you follow those as the old java is still showing?

Please do the following:

[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.

  • Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
  • Scroll down to where it says "Java SE Runtime Environment (JRE) 6 Update 15. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
  • Click the "Download" button to the right.
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: " I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Now go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u15-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH CheckedApplications and AppletsTrace and Log Files
  • Click OK on Delete Temporary Files Window

    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.



NEXT

Visit ADOBEand download the latest version of Acrobat Reader (version 9.1.3)
Having the latest updates ensures there are no security vulnerabilities in your system.


NEXT

Please post a fresh HJT log and advise if there are any outstanding issues
Post #68
Hi,
I was told not to install Java Runtime Environment (JRE) 6 Update 14 yet.

Following your instructions I removed any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name,
not realizing that I was instructed earlier on not to uninstall Java TM 6 Update 14. :S

  • Go to http://java.sun.com/javase/downloads/index.jsp
  • Scroll down to "Java Runtime Environment (JRE) 6 Update 14
  • Click the download button on the right.
If Information Bar pop-ups up, right-click on it and say it's OK to display the blocked content.
  • Select the platform (Windows, in your case), mutli language.
  • Accept the license agreement, click continue.
You do not have to install the Java Web Start ActiveX Control
  • Scroll down and click on Windows Offline Installation,
  • Save the file jre-6u14-windows-i586-p.exe to your desktop;
Do not select Run . Do not install it yet.

When the download is complete, close your browser.

Open Control Panel > Add/Remove Programs and uninstall

Java 2 Runtime Environment, SE v1.4.2_03

Do not uninstall Java TM 6 Update 14 if found!


Here is the log from HJT.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:23:01, on 14/08/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Common Files\AOL\1229762181\ee\AOLSoftware.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\AGRSMMSG.exe
c:\program files\common files\aol\1229762181\ee\services\antiSpywareApp\ver2_0_12\AOLSP Scheduler.exe
c:\program files\common files\aol\1229762181\ee\aolsoftware.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\AOL Companion\companion.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1229762181\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

–
End of file - 7748 bytes
Post #69 last edited
Hi,

Your log is clean.

Please go ahead and install Java NOW.

In fact it has been updated a couple of times and the newest version to install is Java™ version 6 update 16

you can download it from here: http://www.java.com/en/download/manual.jsp

This is the one you want:

[external image: Posted Image] Windows XP/Vista/2000/2003/2008 Online
filesize: ~ 10 MB *


Time to clean up all the tools used:

Follow these steps to uninstall Combofix

  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]


NEXT

Now to remove the rest of the tools that we have used in fixing your machine:
  • Make sure you have an Internet Connection.
  • Download OTC to your desktop and run it
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
  • Click Yes to begin the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

NOTE: If any logs or tools that were used remain > right clicK then delete them….if you are unsure - ASK

Keep the MalwareBytes program, it is good to have, update and run it regularly.

NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.


  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them
    Then consider a password keeper, to keep all your passwords safe.
  • Keep Windows updated by regularly checking their website at :
    http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.

  • SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.

  • SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.

  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
  • ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

    WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox and IE

  • For Firefox, I highly recommend this add-on to keep your PC even more secure.
    • NoScript - for blocking ads and other potential website attacks
  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security–What Do I Need?.


**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.


Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.
Post #70
Hi, Actually, I'm not sure what to write in this reply. I have removed the tools used to fix the computer. I will take your recommendations and advise into thought and action them. Thank you for yours and Oldman960's help and time! :D I really appreciate it. Once again thank you! Jun23
Post #72
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI