Spyware / Malware / Virus Removal

EMPNADS, TBPS TOOLBAR +more intrusions?!

47 min read

Looking for the outcome? Ask AI

Nala Topic Starter

Post #1June 11, 2005, 11:45 PM UTC

Hello, this is my first post and from reading the others here, it looks like I have finally have hope….. I am excited to get your remedies to fix this madness.

My problem with what looks to me to be ADWARE/SPYWARE intrusions started after doing a System Recovery of my computer (because of extremely slow start up loading; 3 yr. old computer with no previous operational problems). I did this one week ago at the suggestion of VERIZON/MSN technicians while establishing DSL/MSN service installations. System was running better than it ever has when all of a sudden……POPUP mania hits! Programs are at the newest versions as I was working on making sure when this hit about 3 days ago. I use AD-AWARE SE but it can't quarantine the TOOLBAR/TBPS(.exe, .dat,.exe), PIB.exe, nzqlihv.wzg or common.dll files it has identified as being critical/negligent to my system. Popups I have left and can't get rid of are all with beginning internet addresses of EMPNADS.

Logfile of HijackThis v1.97.7
Scan saved at 2:48:54 PM, on 6/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Trend Micro\PC-cillin 2000\Tmntsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Toolbar\TBPS.exe
C:\PROGRA~1\Toolbar\PIB.exe
c:\PROGRA~1\Toolbar\radio.exe
C:\WINDOWS\System32\WScript.exe
C:\Program Files\Trend Micro\PC-cillin 2000\Pop3trap.exe
C:\Program Files\Trend Micro\PC-cillin 2000\WebTrapNT.exe
C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe
C:\WINDOWS\System32\exp.exe
C:\WINDOWS\System32\wintask.exe
C:\WINDOWS\system32\tsbfd.exe
C:\WINDOWS\system32\RUNDLL32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
C:\WINDOWS\System32\picsvr\picsvr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rrvlkv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Trend Micro\PC-cillin 2000\PNTIOMON.exe
C:\Program Files\Sony\VAIO Action Setup\VAServ.exe
C:\Program Files\Trend Micro\PC-cillin 2000\pccntupd.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\progra~1\Support.com\client\bin\tgcmd.exe
C:\Program Files\MSN\MSNCoreFiles\msn.exe
C:\Documents and Settings\MARY\My Documents\My Downloads\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R3 - Default URLSearchHook is missing
O2 - BHO: Cas - {B5F3970B-745E-46AC-B890-E08F69777D80} - C:\WINDOWS\system32\ca.dll
O4 - HKLM\..\Run: [ZTgServerSwitch] c:\program files\support.com\client\lserver\server.vbs
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2000\Pop3trap.exe"
O4 - HKLM\..\Run: [WebTrapNT.exe] "C:\Program Files\Trend Micro\PC-cillin 2000\WebTrapNT.exe"
O4 - HKLM\..\Run: [CleanupProgram] C:\Sonysys\cleanup.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe"
O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\System32\PSof1.exe
O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\System32\exp.exe
O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\System32\wintask.exe
O4 - HKLM\..\Run: [x32i3qR] tsbfd.exe
O4 - HKLM\..\Run: [checkrun] C:\windows\system32\elitezyv32.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
O4 - HKLM\..\Run: [picsvr] C:\WINDOWS\System32\picsvr\picsvr.exe
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\rrvlkv.exe reg_run
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Real-time Monitor.lnk = ?
O4 - Global Startup: VAIO Action Setup (Server).lnk = ?
O9 - Extra button: AOL Toolbar (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} (MSSecurityAdvisor Class) - http://protect.microsoft.com/security/prot…b?1118363126999
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB
O16 - DPF: {4B48D5DF-9021-45F7-A240-60304302A215} (Malicious Software Removal Tool) - http://download.microsoft.com/download/b/d…/WebCleaner.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…90/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1118361238062
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,23/mcgdmgr.cab
O16 - DPF: {D06A22B4-6087-4D3D-B7AF-82B113E9ABD4} (CPostLaunch Object) - http://www2.verizon.net/update/msnwebinsta…es/vzWebIns.CAB

Siggyx

Post #2June 12, 2005, 2:02 AM UTC

Download this tool: http://skads.org/special/rkfiles.zip
Unzip it to your Desktop.
Don't use it yet!

IMPORTANT! Reboot the computer into Safe Mode (tap F8 during bootup, use arrow keys to select Safe Mode, then hit 'enter').

Doubleclick LQfix.bat that you saved on your desktop before.
A doswindow will open and close again, that is normal.

Reboot into normal mode and scan with HijackThis. Post the new log as a reply to this thread.

Nala

Post #3June 12, 2005, 3:36 AM UTC

I followed the steps and below is the log copy for review. I don't know what to do with it now. What do I check to delete to fix the problems? Thanks for such quick help.

Logfile of HijackThis v1.97.7
Scan saved at 8:29:39 PM, on 6/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\WScript.exe
C:\Program Files\Trend Micro\PC-cillin 2000\Pop3trap.exe
C:\Program Files\Trend Micro\PC-cillin 2000\WebTrapNT.exe
C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe
C:\WINDOWS\System32\exp.exe
C:\WINDOWS\System32\wintask.exe
C:\WINDOWS\system32\tsbfd.exe
C:\WINDOWS\system32\RUNDLL32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
C:\WINDOWS\System32\picsvr\picsvr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rrvlkv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Trend Micro\PC-cillin 2000\PNTIOMON.exe
C:\Program Files\Sony\VAIO Action Setup\VAServ.exe
C:\Program Files\Trend Micro\PC-cillin 2000\pccntupd.exe
C:\Program Files\Trend Micro\PC-cillin 2000\Tmntsrv.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\progra~1\Support.com\client\bin\tgcmd.exe
C:\Documents and Settings\MARY\My Documents\My Downloads\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R3 - Default URLSearchHook is missing
O2 - BHO: Cas - {B5F3970B-745E-46AC-B890-E08F69777D80} - C:\WINDOWS\system32\ca.dll
O4 - HKLM\..\Run: [ZTgServerSwitch] c:\program files\support.com\client\lserver\server.vbs
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2000\Pop3trap.exe"
O4 - HKLM\..\Run: [WebTrapNT.exe] "C:\Program Files\Trend Micro\PC-cillin 2000\WebTrapNT.exe"
O4 - HKLM\..\Run: [CleanupProgram] C:\Sonysys\cleanup.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe"
O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\System32\PSof1.exe
O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\System32\exp.exe
O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\System32\wintask.exe
O4 - HKLM\..\Run: [x32i3qR] tsbfd.exe
O4 - HKLM\..\Run: [checkrun] C:\windows\system32\elitezyv32.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
O4 - HKLM\..\Run: [picsvr] C:\WINDOWS\System32\picsvr\picsvr.exe
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\rrvlkv.exe reg_run
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Real-time Monitor.lnk = ?
O4 - Global Startup: VAIO Action Setup (Server).lnk = ?
O9 - Extra button: AOL Toolbar (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} (MSSecurityAdvisor Class) - http://protect.microsoft.com/security/prot…b?1118363126999
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB
O16 - DPF: {4B48D5DF-9021-45F7-A240-60304302A215} (Malicious Software Removal Tool) - http://download.microsoft.com/download/b/d…/WebCleaner.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…90/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1118361238062
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,23/mcgdmgr.cab
O16 - DPF: {D06A22B4-6087-4D3D-B7AF-82B113E9ABD4} (CPostLaunch Object) - http://www2.verizon.net/update/msnwebinsta…es/vzWebIns.CAB

Siggyx

Post #4June 12, 2005, 3:38 AM UTC

Step # 1

Please download and run CWShredder. Make sure that all browser windows are closed with the exception of Cwshredder and choose FIX.

http://www.majorgeeks.com/downloadget.php?…7fd6b3ff02edc90

REBOOT

Step #2

Please download and run Spybot & AdAware SE Then follow the instructions in the link below to run.

Spybot & Adaware Tutorial

REBOOT

Step # 3

Then do a virus scan here >>> Trend Micro

Reboot and post a new HiJackThis log.

Nala

Post #5June 12, 2005, 3:42 AM UTC

(p.s. I now have a cricket sound that started to appear after my first visit to tomcoyote site. Also, we have 4 sections in our system for each family member's personal use with each one having matching access to everything on our system. Do I have to repeat this procedure in each section or is one application of the process adequate to fix them all? Also, this may need to be a new Thread Topic, but EZULA appears in the ADAWARE scans and if it is fixed will show up again I noticed throughout this past week. Will this remedy you have provided handle fixing that problem or should I start a new thread for help with that? sorry, for these add on thoughts but they might be important to what you are guiding me to do.)

Siggyx

Post #6June 12, 2005, 3:44 AM UTC last edited June 12, 2005, 3:45 AM UTC

Make sure that you have downloaded the new Spybot 1.4 and Adaware 1.06 from my post. Do the scans. If any of them lock up boot to safe mode (tap f8 while bios loads) then scan. Edit >>>> Lets start with the admin user account and see how it goes from there. Hopefully you have not set everyone up as admin.

Nala

Post #7June 12, 2005, 3:49 AM UTC

whoops…I did…but i will do the next step process and we will see where that takes me. Back in awhile to post the new log. Thank you.

Nala

Post #8June 12, 2005, 6:59 AM UTC

I am slow being a novice computer user, but I have finished your last directions and this is what happened:

CWShredder: found no problems to fix.

Spybot: Downloaded, Scanned, found near 400 items but said I would need to pay for the program to have them fixed; I think it fixed a few free; it is coming up as SpyWare on my shortcut button–I hope I downloaded the right one (this one is driving me nuts already with all its notices of blocking!).

AdAware SE: I already use this program and it is the most updated version; scanned and it fixed the problems.

Trend Micro: Ran the free HOUSECALL scan and it found 6 files that are NON CLEANABLE – they are TROJ SMALL.AMT; TROJ DROPPER:CP; TROJ DLOADER.FN; TROJ CLICKER.AD; TROJ BRDUPDATED; TROJ START PAG.QY. —– I read the site's descriptions/information about each one and sent the solutions on how to get rid of them to my email address with the links to refer to later if need be. —– I also have this site's/maker's PC-cillin 2000 program that already runs on my system, but I attempted to update it to the most current version and it downloads files but keeps asking me if I want to do it over and over again after I downloaded it to my computer (???). I also saw where TOM COYOTE recommends the TROJAN TREND scans to use at the top of this page, but I didn't perform them. I wanted to be sure that that is what is best to do at this point for my system?

AFTER FOLLOWING THE STEPS YOU GAVE ME, BELOW IS THE HJ LOG IT NOW SHOWS:

Logfile of HijackThis v1.97.7
Scan saved at 11:39:26 PM, on 6/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\WScript.exe
C:\Program Files\Trend Micro\PC-cillin 2000\Pop3trap.exe
C:\Program Files\Trend Micro\PC-cillin 2000\WebTrapNT.exe
C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe
C:\WINDOWS\system32\RUNDLL32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rrvlkv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Trend Micro\PC-cillin 2000\PNTIOMON.exe
C:\Program Files\Sony\VAIO Action Setup\VAServ.exe
C:\Program Files\Trend Micro\PC-cillin 2000\pccntupd.exe
C:\Program Files\Trend Micro\PC-cillin 2000\Tmntsrv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\Documents and Settings\MARY\My Documents\My Downloads\HijackThis.exe
c:\progra~1\Support.com\client\bin\tgcmd.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: (no name) - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: Cas - {B5F3970B-745E-46AC-B890-E08F69777D80} - C:\WINDOWS\system32\ca.dll
O4 - HKLM\..\Run: [ZTgServerSwitch] c:\program files\support.com\client\lserver\server.vbs
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2000\Pop3trap.exe"
O4 - HKLM\..\Run: [WebTrapNT.exe] "C:\Program Files\Trend Micro\PC-cillin 2000\WebTrapNT.exe"
O4 - HKLM\..\Run: [CleanupProgram] C:\Sonysys\cleanup.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe"
O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\System32\PSof1.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\rrvlkv.exe reg_run
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [x32i3qR] tsbfd.exe
O4 - HKLM\..\Run: [checkrun] C:\windows\system32\elitezyv32.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Real-time Monitor.lnk = ?
O4 - Global Startup: VAIO Action Setup (Server).lnk = ?
O9 - Extra button: Spyware Doctor (HKLM)
O9 - Extra button: AOL Toolbar (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} (MSSecurityAdvisor Class) - http://protect.microsoft.com/security/prot…b?1118363126999
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB
O16 - DPF: {4B48D5DF-9021-45F7-A240-60304302A215} (Malicious Software Removal Tool) - http://download.microsoft.com/download/b/d…/WebCleaner.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…90/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1118361238062
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,23/mcgdmgr.cab
O16 - DPF: {D06A22B4-6087-4D3D-B7AF-82B113E9ABD4} (CPostLaunch Object) - http://www2.verizon.net/update/msnwebinsta…es/vzWebIns.CAB

DID I ACCOMPLISH ANYTHING? I still get pop-ups as before at the moment. Things seem to be the same, but maybe they are better? I am wondering if the best way to resolve these problems/intrusions might be to do a complete SYSTEM RECOVERY process again (just did it one week ago and I think this happened because the FIREWALLS were down for a couple days when I followed the instructions of the VERIZON techs and left them off) and start over or would that not eliminate and be a pointless process with what has invaded my system?

I will check for what to do next in the morning. I appreciate the time and expertise you offer.

Siggyx

Post #9June 13, 2005, 2:19 AM UTC

Spybot Search and Destroy is free product and you should not have to pay to renoe anything. Can you show me the link that you downloaded it from please as this is very very strange

Scan with hijackthis and put a ehck beside these lines and choose FIX

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R3 - Default URLSearchHook is missing

O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\System32\PSof1.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\rrvlkv.exe reg_run
O4 - HKLM\..\Run: [x32i3qR] tsbfd.exe
O4 - HKLM\..\Run: [checkrun] C:\windows\system32\elitezyv32.exe

Then reboot to safe mode and look for and delete these files.

C:\WINDOWS\System32\PSof1.exe
C:\WINDOWS\system32\rrvlkv.exe reg_run
tsbfd.exe
C:\windows\system32\elitezyv32.exe

Tne reboot to normal mode and scan with hijackthis again and post a new log.

PLEASE MAKE SURE THAT YOU USE THE UPDATED VERSION OF HIJACKTHIS AS THE LAST LOG WAS THE OLDER ERSION. GET RID OF VERSION 1.97.7.

Nala

Post #10June 13, 2005, 10:44 PM UTC

I worked on my system yesterday by changing INTERNET PROPERTY OPTIONS with the COOKIES PERMISSIONS and I noticed that my PC-cillin Virus Protection Program was able to quarantine some of the TROJAN Virus files (4 of them I believe – I redid a scan at TREND MICRO) whereas previously that could not be accomplished. They are still showing in my system, but somewhere inbetween my entries to the interent properties options and the quarantining changes, the pop-ups have completely disappeared. My AD-AWARE also scans with considerably fewer items showing as problems, usually only posting 2 Browser items for removal and they are successfully removed each scan even though they do reappear. This is huge progress and that is why I wanted to post this reply to be sure you still suggest I run the last procedures you posted today for me to do. I am sending a new HJT log before I do them for you to check and advise. I don't want to mess things up since my system is running primo now. TREND MICRO posts the solutions for removal of each of the TROJAN VIRUS files, but they seem so complicated and I also want to verify that I should proceed with attempting to perform them before doing so.

The SPYBOT site was found through the link you first provided and I downloaded the FREE LINK as offered. It scans and performs, but won't allow me to delete the files it finds unless I purchase the program. A link appears on my scan screen at the conclusion of the process. (???) I have the option for the POP UP QUARD seclected for "off" because it became so bothersome with all its alerts, etc. and would freeze its warning screen in the midst of working on the machine so I dislodged that option once I felt the pop up problem was resolved and without it operating, I still have not one pop today. Maybe I selected something wrong but it seems to be working great without it right now.

BELOW IS THE MOST RECENT LOG FOR YOUR REVIEW:
Logfile of HijackThis v1.97.7
Scan saved at 3:28:09 PM, on 6/13/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\WScript.exe
C:\Program Files\Trend Micro\PC-cillin 2000\Pop3trap.exe
C:\Program Files\Trend Micro\PC-cillin 2000\WebTrapNT.exe
C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rrvlkv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\system32\vidctrl\vidctrl.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Trend Micro\PC-cillin 2000\PNTIOMON.exe
C:\Program Files\Sony\VAIO Action Setup\VAServ.exe
C:\Program Files\Trend Micro\PC-cillin 2000\pccntupd.exe
C:\Program Files\Trend Micro\PC-cillin 2000\Tmntsrv.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\progra~1\Support.com\client\bin\tgcmd.exe
C:\Program Files\MSN\MSNCoreFiles\msn.exe
C:\Program Files\Adobe\Acrobat 5.0\Reader\AcroRd32.exe
C:\Documents and Settings\MARY\My Documents\My Downloads\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: (no name) - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: Cas - {B5F3970B-745E-46AC-B890-E08F69777D80} - C:\WINDOWS\system32\ca.dll
O4 - HKLM\..\Run: [ZTgServerSwitch] c:\program files\support.com\client\lserver\server.vbs
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2000\Pop3trap.exe"
O4 - HKLM\..\Run: [WebTrapNT.exe] "C:\Program Files\Trend Micro\PC-cillin 2000\WebTrapNT.exe"
O4 - HKLM\..\Run: [CleanupProgram] C:\Sonysys\cleanup.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe"
O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\System32\PSof1.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\rrvlkv.exe reg_run
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [x32i3qR] tsbfd.exe
O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\system32\vidctrl\vidctrl.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Real-time Monitor.lnk = ?
O4 - Global Startup: VAIO Action Setup (Server).lnk = ?
O9 - Extra button: Spyware Doctor (HKLM)

Thanks. Look forward to your analyzation and "OK" or not to proceed with your last instructions.

Nala

Post #11June 14, 2005, 12:05 AM UTC

HERE'S THE HJT LOG WITH THE MOST UPDATED VERSION AS YOU ASKED I BE SURE TO USE (SORRY DIDN'T NOTICE UNTIL AFTER I SENT THE LAST POST).
Logfile of HijackThis v1.99.1
Scan saved at 5:00:16 PM, on 6/13/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Trend Micro\PC-cillin 2000\Tmntsrv.exe
C:\WINDOWS\System32\WScript.exe
C:\Program Files\Trend Micro\PC-cillin 2000\Pop3trap.exe
C:\Program Files\Trend Micro\PC-cillin 2000\WebTrapNT.exe
C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rrvlkv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\vidctrl\vidctrl.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Trend Micro\PC-cillin 2000\PNTIOMON.exe
C:\Program Files\Sony\VAIO Action Setup\VAServ.exe
C:\Program Files\Trend Micro\PC-cillin 2000\pccntupd.exe
c:\progra~1\Support.com\client\bin\tgcmd.exe
C:\Program Files\MSN\MSNCoreFiles\msn.exe
C:\Documents and Settings\MARY\My Documents\My Downloads\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
R3 - Default URLSearchHook is missing
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: Cas - {B5F3970B-745E-46AC-B890-E08F69777D80} - C:\WINDOWS\system32\ca.dll
O4 - HKLM\..\Run: [ZTgServerSwitch] c:\program files\support.com\client\lserver\server.vbs
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2000\Pop3trap.exe"
O4 - HKLM\..\Run: [WebTrapNT.exe] "C:\Program Files\Trend Micro\PC-cillin 2000\WebTrapNT.exe"
O4 - HKLM\..\Run: [CleanupProgram] C:\Sonysys\cleanup.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe"
O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\System32\PSof1.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\rrvlkv.exe reg_run
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [x32i3qR] tsbfd.exe
O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\system32\vidctrl\vidctrl.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Real-time Monitor.lnk = ?
O4 - Global Startup: VAIO Action Setup (Server).lnk = ?
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…90/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1118361238062
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,23/mcgdmgr.cab
O16 - DPF: {D06A22B4-6087-4D3D-B7AF-82B113E9ABD4} (CPostLaunch Object) - http://www2.verizon.net/update/msnwebinsta…es/vzWebIns.CAB
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2000\Tmntsrv.exe

Siggyx

Post #12June 15, 2005, 2:09 AM UTC

Download MicroWorld virus scan here >>> Micro World http://www.mwti.net/antivirus/free_utilities.asp

To run the virus scan make sure you click the following

memory, registry, startup folders, system folders, services, drive (all drives will be added) then click on scan clean. When the scan is complete hilight all the files in the LOWER box. Then ctrl + c and paste them into the thread ctrl + v.

I warn you the scan will take a long time to run and will not fix anything just identifies bad files.

Nala

Post #13June 15, 2005, 6:55 AM UTC

OK….HERE IS THE LOG YOU NEED. HOW ARE WE LOOKING NOW OR DARE I EVEN ASK?:

File C:\WINDOWS\system32\ppznizi.dll infected by "Trojan-Downloader.Win32.Qoologic.q" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\D0CE0C16B1.dll infected by "Trojan-Clicker.Win32.Agent.dh" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\rrvlkv.exe infected by "Trojan-Downloader.Win32.Qoologic.o" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\vidctrl\vidctrl.exe tagged as "not-a-virus:AdWare.DelphinMediaViewer.f". Action Taken: No Action Taken.
File C:\WINDOWS\System32\ccbxnbn.exe infected by "Trojan-Downloader.Win32.Qoologic.q" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\rrvlkv.exe infected by "Trojan-Downloader.Win32.Qoologic.o" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\vidctrl\vidctrl.exe tagged as "not-a-virus:AdWare.DelphinMediaViewer.f". Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ddnu.exe infected by "Trojan-Downloader.Win32.Qoologic.o" Virus! Action Taken: No Action Taken.
Object "IBIS Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "IBIS Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "BrowserAid Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "HuntBar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "HuntBar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "tsa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "Quicken Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "iSearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\QTPlugin.OCX". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\msxml3a.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{417386C3-8D4A-4611-9B91-E57E89D603AC}" refers to invalid object "C:\WINDOWS\system32\PopOops2.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{73175B20-8DF1-11D1-800A-44455354616F}" refers to invalid object "D:\VBUPROGRESS.OCX". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{7c1af354-a022-4bb7-98b2-32055f75b5aa}" refers to invalid object "C:\WINDOWS\System32\nnaok.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{7C86B871-20BE-11D5-B71A-0090271BEFB3}" refers to invalid object "C:\Program Files\Corel\WordPerfect 10\Programs\qputl100.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}" refers to invalid object "fde.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{D52433A9-A44C-43AB-A013-24B3C756DD2B}" refers to invalid object "C:\WINDOWS\system32\SWLAD1.dll". Action Taken: No Action Taken.
Entry "HKCR\Alg.AlgSetup" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.
Entry "HKCR\Alg.AlgSetup.1" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.
Entry "HKCR\ComPlusMetaData.MsCorHost" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken.
Entry "HKCR\ComPlusMetaData.MsCorHost.2" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken.
Entry "HKCR\PhotoRecord.Album" refers to invalid object "{FEDCFFC1-BEC4-11D1-93B9-0060979C8AB8}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\RTCCore.RTCClient" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.
Entry "HKCR\RTCCore.RTCClient.1" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.
Entry "HKCR\SymWriter.pdb" refers to invalid object "{520DC67A-752E-11D3-8D56-00C04F680B2B}". Action Taken: No Action Taken.
Entry "HKCR\WEBIMAGE>WebImageCtrl.1" refers to invalid object "{5F468352-B444-11D1-A5DF-00A0C906C89C}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
Entry "HKCR\WMPShell.HWEventHandler" refers to invalid object "{9B186A8F-F520-4eeb-B553-118304AC46C5}". Action Taken: No Action Taken.
Entry "HKCR\WMPShell.HWEventHandler.1" refers to invalid object "{9B186A8F-F520-4eeb-B553-118304AC46C5}". Action Taken: No Action Taken.
Entry "HKCR\ZoomBrowserEX.Document" refers to invalid object "{476A6961-6FF1-11D0-9742-00A0246B6561}". Action Taken: No Action Taken.
File C:\WINDOWS\Helper101.dll infected by "Trojan-Clicker.Win32.Delf.r" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\btnetw-614090_venturea-hot.exe tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.i". Action Taken: No Action Taken.
File C:\WINDOWS\system32\ccpsk.dll infected by "Trojan-Downloader.Win32.Qoologic.q" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\cxtpls_loader.exe infected by "Trojan-Downloader.Win32.Apropo.ab" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\D0CE0C16B1.DLL infected by "Trojan-Clicker.Win32.Agent.dh" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\dist001.exe infected by "Trojan-Downloader.Win32.VB.eu" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\GSM3-0511.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\L90112201.Stub.exe infected by "Trojan-Downloader.Win32.Delmed.a" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\nsdD5.dll tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.i". Action Taken: No Action Taken.
File C:\WINDOWS\system32\nsh42.dll tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.i". Action Taken: No Action Taken.
File C:\WINDOWS\system32\nsi51.dll tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.i". Action Taken: No Action Taken.
File C:\WINDOWS\system32\nsq1B.dll tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.i". Action Taken: No Action Taken.
File C:\WINDOWS\system32\nsvF2.dll tagged as "not-a-virus:AdWare.Beginto.c". Action Taken: No Action Taken.
File C:\WINDOWS\system32\ppznizi.dll infected by "Trojan-Downloader.Win32.Qoologic.q" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\qqpga.dat infected by "Trojan-Downloader.Win32.Qoologic.o" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\redit.cpl infected by "Trojan-Downloader.Win32.Qoologic.p" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\SSK3_B5 Seedcorn 4.exe infected by "Trojan-Dropper.Win32.Agent.hl" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\supdate.dll infected by "Trojan-Downloader.Win32.Qoologic.p" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\SYSsfitb.dll tagged as "not-a-virus:AdWare.ToolBar.SearchIt.d". Action Taken: No Action Taken.
File C:\WINDOWS\system32\thin-138-1-x-x.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken.
File C:\WINDOWS\system32\uci.exe infected by "Trojan-Dropper.Win32.Agent.hl" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\weirdontheweb_ventura.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\WINDOWS\system32\WinNB57.dll tagged as "not-a-virus:AdWare.Mirar.b". Action Taken: No Action Taken.
File C:\DOCUME~1\MARY\LOCALS~1\Temp\1351937.dll tagged as "not-a-virus:AdWare.ToolBar.EliteBar.af". Action Taken: No Action Taken.
File C:\DOCUME~1\MARY\LOCALS~1\Temp\i6C.tmp tagged as "not-a-virus:AdWare.SurfSide.j". Action Taken: No Action Taken.
File C:\DOCUME~1\MARY\LOCALS~1\Temp\SSK3_B5 Seedcorn 4.exe infected by "Trojan-Dropper.Win32.Small.qn" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\MARY\LOCALS~1\Temp\temp.fr476F\EliteToolBar version 60.dll tagged as "not-a-virus:AdWare.ToolBar.EliteBar.af". Action Taken: No Action Taken.
File C:\DOCUME~1\MARY\LOCALS~1\Temp\temp.fr47E6\common.dll tagged as "not-a-virus:AdWare.WebSearch.aj". Action Taken: No Action Taken.
File C:\DOCUME~1\MARY\LOCALS~1\Temp\temp.fr47E6\PIB.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\DOCUME~1\MARY\LOCALS~1\Temp\temp.fr47E6\radio.exe tagged as "not-a-virus:AdWare.WebSearch.al". Action Taken: No Action Taken.
File C:\DOCUME~1\MARY\LOCALS~1\Temp\temp.fr47E6\TBPS.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\DOCUME~1\MARY\LOCALS~1\Temp\tp7543.exe infected by "Trojan-Downloader.Win32.Qoologic.o" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\MARY\LOCALS~1\Temp\wrapperouter.exe tagged as "not-a-virus:AdWare.VirtualBouncer.j". Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ddnu.exe infected by "Trojan-Downloader.Win32.Qoologic.o" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\CHERYL\Local Settings\Temp\10A.tmp\thnall1ac.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken.
File C:\Documents and Settings\CHERYL\Local Settings\Temp\19568125.dll tagged as "not-a-virus:AdWare.ToolBar.EliteBar.af". Action Taken: No Action Taken.
File C:\Documents and Settings\CHERYL\Local Settings\Temp\cln15.tmp infected by "Trojan-Downloader.Win32.Dyfuca.ei" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\CHERYL\Local Settings\Temp\f437234.exe infected by "Trojan-Downloader.Win32.Qoologic.o" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\CHERYL\Local Settings\Temp\HXQ\aurareco.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken.
File C:\Documents and Settings\CHERYL\Local Settings\Temp\i102.tmp tagged as "not-a-virus:AdWare.SurfSide.j". Action Taken: No Action Taken.
File C:\Documents and Settings\CHERYL\Local Settings\Temp\nstE6.EXE tagged as "not-a-virus:AdWare.SmartPops.c". Action Taken: No Action Taken.
File C:\Documents and Settings\CHERYL\Local Settings\Temp\ptf_0002.exe tagged as "not-a-virus:AdWare.Pacer.d". Action Taken: No Action Taken.
File C:\Documents and Settings\CHERYL\Local Settings\Temp\SSK3_B5 Seedcorn 4.exe infected by "Trojan-Dropper.Win32.Small.qn" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\CHERYL\Local Settings\Temp\toc_0032.exe infected by "Trojan-Downloader.Win32.Agent.jq" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\CHERYL\Local Settings\Temp\tool4_b2search.exe tagged as "not-a-virus:AdWare.Beginto.c". Action Taken: No Action Taken.
File C:\Documents and Settings\CHERYL\Local Settings\Temp\uppicsvr.exe tagged as "not-a-virus:AdWare.DelphinMedia.Viewer.f". Action Taken: No Action Taken.
File C:\Documents and Settings\CHERYL\Local Settings\Temp\wrapperouter.exe tagged as "not-a-virus:AdWare.VirtualBouncer.j". Action Taken: No Action Taken.
File C:\Documents and Settings\CHERYL\Local Settings\Temp\wupdt.exe infected by "Trojan-Downloader.Win32.Intexp.c" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\JANELLE\Local Settings\Temp\180sainstaller.exe tagged as "not-a-virus:AdWare.180Solutions.i". Action Taken: No Action Taken.
File C:\Documents and Settings\JANELLE\Local Settings\Temp\Del1C.tmp infected by "Trojan-Downloader.Win32.Small.asf" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\JANELLE\Local Settings\Temp\Del30.tmp tagged as "not-a-virus:AdWare.180Solutions.i". Action Taken: No Action Taken.
File C:\Documents and Settings\JANELLE\Local Settings\Temp\i96.tmp tagged as "not-a-virus:AdWare.SurfSide.j". Action Taken: No Action Taken.
File C:\Documents and Settings\JANELLE\Local Settings\Temp\res1D.tmp tagged as "not-a-virus:AdWare.180Solutions.i". Action Taken: No Action Taken.
File C:\Documents and Settings\JANELLE\Local Settings\Temp\SSK3_B5 Seedcorn 4.exe infected by "Trojan-Dropper.Win32.Small.qn" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\JANELLE\Local Settings\Temp\wrapperouter.exe tagged as "not-a-virus:AdWare.VirtualBouncer.j". Action Taken: No Action Taken.
File C:\Documents and Settings\MARY\Local Settings\Temp\1351937.dll tagged as "not-a-virus:AdWare.ToolBar.EliteBar.af". Action Taken: No Action Taken.
File C:\Documents and Settings\MARY\Local Settings\Temp\i6C.tmp tagged as "not-a-virus:AdWare.SurfSide.j". Action Taken: No Action Taken.
File C:\Documents and Settings\MARY\Local Settings\Temp\SSK3_B5 Seedcorn 4.exe infected by "Trojan-Dropper.Win32.Small.qn" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\MARY\Local Settings\Temp\temp.fr476F\EliteToolBar version 60.dll tagged as "not-a-virus:AdWare.ToolBar.EliteBar.af". Action Taken: No Action Taken.
File C:\Documents and Settings\MARY\Local Settings\Temp\temp.fr47E6\common.dll tagged as "not-a-virus:AdWare.WebSearch.aj". Action Taken: No Action Taken.
File C:\Documents and Settings\MARY\Local Settings\Temp\temp.fr47E6\PIB.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\Documents and Settings\MARY\Local Settings\Temp\temp.fr47E6\radio.exe tagged as "not-a-virus:AdWare.WebSearch.al". Action Taken: No Action Taken.
File C:\Documents and Settings\MARY\Local Settings\Temp\temp.fr47E6\TBPS.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\Documents and Settings\MARY\Local Settings\Temp\tp7543.exe infected by "Trojan-Downloader.Win32.Qoologic.o" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\MARY\Local Settings\Temp\wrapperouter.exe tagged as "not-a-virus:AdWare.VirtualBouncer.j". Action Taken: No Action Taken.
File C:\Documents and Settings\PHILIP\Local Settings\Temp\GLF14FGLF14F.EXE infected by "Trojan-Downloader.Win32.TSUpdate.f" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\PHILIP\Local Settings\Temp\GLF15GLF15.EXE infected by "Trojan-Downloader.Win32.TSUpdate.f" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\PHILIP\Local Settings\Temp\GLF61GLF61.EXE infected by "Trojan-Downloader.Win32.TSUpdate.f" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\PHILIP\Local Settings\Temp\GLFFGLFF.EXE infected by "Trojan-Downloader.Win32.TSUpdate.f" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\PHILIP\Local Settings\Temp\i75.tmp tagged as "not-a-virus:AdWare.SurfSide.j". Action Taken: No Action Taken.
File C:\Documents and Settings\PHILIP\Local Settings\Temp\i96.tmp tagged as "not-a-virus:AdWare.SurfSide.j". Action Taken: No Action Taken.
File C:\Documents and Settings\PHILIP\Local Settings\Temp\SSK3_B5 Seedcorn 4.exe infected by "Trojan-Dropper.Win32.Small.qn" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\PHILIP\Local Settings\Temp\temp.fr5673\CHPON.dll tagged as "not-a-virus:AdWare.EZula.ae". Action Taken: No Action Taken.
File C:\Documents and Settings\PHILIP\Local Settings\Temp\temp.fr685E\CHPON.dll tagged as "not-a-virus:AdWare.EZula.ae". Action Taken: No Action Taken.
File C:\Documents and Settings\PHILIP\Local Settings\Temp\temp.fr7B57\common.dll tagged as "not-a-virus:AdWare.WebSearch.aj". Action Taken: No Action Taken.
File C:\Documents and Settings\PHILIP\Local Settings\Temp\temp.fr7B57\PIB.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\Documents and Settings\PHILIP\Local Settings\Temp\temp.fr7B57\radio.exe tagged as "not-a-virus:AdWare.WebSearch.al". Action Taken: No Action Taken.
File C:\Documents and Settings\PHILIP\Local Settings\Temp\temp.fr7B57\TBPS.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\Documents and Settings\PHILIP\Local Settings\Temp\temp.fr7B57\toolbar.dll tagged as "not-a-virus:AdWare.WebSearch.am". Action Taken: No Action Taken.
File C:\Documents and Settings\PHILIP\Local Settings\Temp\tsinstall_4_0_3_8_b17.exe infected by "Trojan-Downloader.Win32.TSUpdate.k" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\PHILIP\Local Settings\Temp\ts_8_new.exe infected by "Trojan-Downloader.Win32.TSUpdate.f" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\PHILIP\Local Settings\Temp\wrapperouter.exe tagged as "not-a-virus:AdWare.VirtualBouncer.j". Action Taken: No Action Taken.
File C:\Program Files\cdmdownld\aeximswahr.dll tagged as "not-a-virus:AdWare.SmartPops.d". Action Taken: No Action Taken.
File C:\Program Files\cdmdownld\aeximswahr.exe tagged as "not-a-virus:AdWare.SmartPops.c". Action Taken: No Action Taken.
File C:\Program Files\Common Files\ufrr\ufrra.exe infected by "Trojan-Downloader.Win32.TSUpdate.l" Virus! Action Taken: No Action Taken.
File C:\Program Files\Common Files\ufrr\ufrrl.exe infected by "Trojan-Downloader.Win32.TSUpdate.j" Virus! Action Taken: No Action Taken.
File C:\Program Files\Common Files\ufrr\ufrrm.exe infected by "Trojan-Downloader.Win32.TSUpdate.k" Virus! Action Taken: No Action Taken.
File C:\Program Files\Common Files\ufrr\ufrrp.exe tagged as "not-a-virus:AdWare.Xupiter.m". Action Taken: No Action Taken.
File C:\Program Files\Common Files\Uninstall Information\RemoveDisplayUtility.exe tagged as "not-a-virus:AdWare.DelphinMedia.Viewer.f". Action Taken: No Action Taken.
File C:\Program Files\FwBarTemp\searchbar.exe infected by "Trojan-Downloader.Win32.VB.eu" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\1.tmp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\13B.tmp infected by "Trojan-Downloader.Win32.Small.abd" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\13C.tmp infected by "Trojan-Downloader.Win32.Small.abd" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\13D.tmp infected by "Trojan-Downloader.Win32.Delmed.b" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\13E.tmp infected by "Trojan-Downloader.Win32.Braidupdate.d" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\13F.tmp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\140.tmp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\145.tmp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\17F.tmp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\1B0.tmp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\1B1.tmp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\1B2.tmp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\1C9.tmp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\2.tmp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\226.tmp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\228.tmp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\22B.tmp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\22D.tmp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\22E.tmp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\37.tmp infected by "Trojan-Clicker.Win32.Small.ez" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\38.tmp infected by "Trojan-Dropper.Win32.Agent.lu" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\39.tmp infected by "Trojan-Downloader.Win32.Small.abd" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\3A.tmp infected by "Trojan-Downloader.Win32.Small.abd" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\3B.tmp infected by "Trojan-Downloader.Win32.Delmed.b" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\3C.tmp infected by "Trojan-Downloader.Win32.Braidupdate.d" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\3D.tmp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\44.tmp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\45.tmp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\PC-cillin 2000\QUARANTINE\46.tmp infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Program Files\Yahoo!\Installs\ymsgrie.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0007933.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0007943.cpl infected by "Trojan-Dropper.Win32.Small.wc" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0007951.exe infected by "Trojan-Downloader.Win32.VB.eu" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0007959.exe tagged as "not-a-virus:AdWare.Wintol.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0007960.dll tagged as "not-a-virus:AdWare.WebSearch.am". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0007961.exe tagged as "not-a-virus:AdWare.VirtualBouncer.g". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0007967.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0007968.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0007973.exe infected by "Trojan-Dropper.Win32.Agent.hl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0007974.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0007980.exe tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.i". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0007986.cpl infected by "Trojan-Dropper.Win32.Small.wc" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0007990.exe infected by "Trojan-Downloader.Win32.Apropo.ab" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0007991.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0007992.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0007995.exe infected by "Trojan-Dropper.Win32.Agent.hl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0007999.EXE tagged as "not-a-virus:AdWare.VirtualBouncer.j". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0008000.EXE tagged as "not-a-virus:AdWare.VirtualBouncer.j". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0008002.EXE tagged as "not-a-virus:AdWare.VirtualBouncer". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0008005.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0008007.exe infected by "Trojan-Downloader.Win32.VB.eu" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0008009.exe infected by "Trojan-Downloader.Win32.VB.eu" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0008023.exe tagged as "not-a-virus:AdWare.VirtualBouncer.i". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0008028.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0008033.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0008037.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0008043.exe infected by "Trojan-Dropper.Win32.Agent.hl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0008046.exe tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.i". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0008047.exe infected by "Trojan-Downloader.Win32.Apropo.ab" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0008048.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0008049.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0008050.dll tagged as "not-a-virus:AdWare.ToolBar.EliteBar.af". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0008051.exe infected by "Trojan-Dropper.Win32.Agent.hl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0008053.cpl infected by "Trojan-Dropper.Win32.Small.wc" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0008054.exe infected by "Trojan-Downloader.Win32.VB.eu" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP10\A0008056.exe infected by "Trojan-Downloader.Win32.VB.eu" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP11\A0008057.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP13\A0008145.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP21\A0008485.exe tagged as "not-a-virus:AdWare.VirtualBouncer.i". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP21\A0008514.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP21\A0008517.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP21\A0008518.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP21\A0008524.dll tagged as "not-a-virus:AdWare.ToolBar.SearchIt.d". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP21\A0008526.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP21\A0008529.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP21\A0008535.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP21\A0008537.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP21\A0008540.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP22\A0008554.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP23\A0010106.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP23\A0010108.exe tagged as "not-a-virus:AdWare.VirtualBouncer.g". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP23\A0010487.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP23\A0010488.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP23\A0010502.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP23\A0010543.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP23\A0010552.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP23\A0010553.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP23\A0010555.dll tagged as "not-a-virus:AdWare.ToolBar.SearchIt.d". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP23\A0010577.exe infected by "Trojan-Downloader.Win32.Intexp.c" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP23\A0010578.exe tagged as "not-a-virus:AdWare.BetterInternet.c". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP23\A0010580.exe tagged as "not-a-virus:AdWare.BetterInternet.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP23\A0010590.exe tagged as "not-a-virus:AdWare.BetterInternet.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP23\A0010593.exe infected by "Trojan-Downloader.Win32.Intexp.c" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP23\A0010596.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP23\A0010600.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP24\A0010601.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP24\A0010609.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP24\A0010610.dll tagged as "not-a-virus:AdWare.ToolBar.SearchIt.d". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP24\A0010611.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP24\A0010620.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010632.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010737.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010740.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010746.dll tagged as "not-a-virus:AdWare.ToolBar.SearchIt.d". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010775.exe infected by "Trojan-Downloader.Win32.Apropo.ab" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010780.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010781.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010782.dll tagged as "not-a-virus:AdWare.ToolBar.EliteBar.af". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010784.exe infected by "Trojan-Dropper.Win32.Agent.hl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010788.cpl infected by "Trojan-Dropper.Win32.Small.wc" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010789.exe infected by "Trojan-Downloader.Win32.VB.eu" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010791.exe infected by "Trojan-Downloader.Win32.VB.eu" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010798.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010801.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010832.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010837.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010849.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010851.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010857.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010859.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010890.dll tagged as "not-a-virus:AdWare.WebSearch.am". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010891.cpl infected by "Trojan-Dropper.Win32.Small.wc" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010892.dll tagged as "not-a-virus:AdWare.VirtualBouncer.g". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010893.dll tagged as "not-a-virus:AdWare.VirtualBouncer.g". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010894.dll tagged as "not-a-virus:AdWare.VirtualBouncer.g". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010895.dll tagged as "not-a-virus:AdWare.VirtualBouncer.g". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010896.exe infected by "Trojan-Dropper.Win32.Agent.hl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010988.dll tagged as "not-a-virus:AdWare.BHO.E2Give.c". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0010993.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0011040.dll tagged as "not-a-virus:AdWare.ToolBar.EliteBar.af". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0011044.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0011056.dll tagged as "not-a-virus:AdWare.WebSearch.am". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0011091.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0011112.dll tagged as "not-a-virus:AdWare.ToolBar.SearchIt.d". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0011116.exe infected by "Trojan.Win32.Favadd.o" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0011122.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0011138.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP25\A0011146.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0011196.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0011218.dll tagged as "not-a-virus:AdWare.ToolBar.SearchIt.d". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0011220.exe infected by "Trojan-Downloader.Win32.TSUpdate.j" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0011221.exe infected by "Trojan-Downloader.Win32.TSUpdate.l" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0011222.exe tagged as "not-a-virus:AdWare.Xupiter.m". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012196.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012197.dll tagged as "not-a-virus:AdWare.ToolBar.SearchIt.d". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012200.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012210.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012213.dll tagged as "not-a-virus:AdWare.ToolBar.SearchIt.d". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012214.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012220.dll tagged as "not-a-virus:AdWare.EZula.ae". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012223.exe infected by "Trojan.Win32.Favadd.o" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012225.dll tagged as "not-a-virus:AdWare.EZula.az". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012226.exe tagged as "not-a-virus:AdWare.EZula.z". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012228.dll tagged as "not-a-virus:AdWare.EZula.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012239.exe tagged as "not-a-virus:AdWare.EZula.av". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012240.exe tagged as "not-a-virus:AdWare.EZula.ak". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012242.exe tagged as "not-a-virus:AdWare.WinAD.am". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012244.dll tagged as "not-a-virus:AdWare.WebSearch.am". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012246.exe tagged as "not-a-virus:AdWare.WinAD.am". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012303.exe infected by "Trojan-Dropper.Win32.Agent.hl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012313.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012316.dll tagged as "not-a-virus:AdWare.WebSearch.aj". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012317.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012318.exe tagged as "not-a-virus:AdWare.WebSearch.al". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012319.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012339.dll tagged as "not-a-virus:AdWare.ToolBar.SearchIt.d". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012343.dll tagged as "not-a-virus:AdWare.EZula.ae". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012352.dll tagged as "not-a-virus:AdWare.ToolBar.SearchIt.d". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012360.exe infected by "Trojan.Win32.Favadd.o" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012369.dll tagged as "not-a-virus:AdWare.ToolBar.SearchIt.d". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012371.exe infected by "Trojan-Downloader.Win32.Small.hs" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012374.dll tagged as "not-a-virus:AdWare.EZula.ae". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP26\A0012446.exe infected by "Trojan.Win32.Favadd.o" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP27\A0014584.ocx tagged as "not-a-virus:AdWare.DelphinMediaViewer.c". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP27\A0014585.dll tagged as "not-a-virus:AdWare.DelphinMedia.Viewer.f". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP27\A0014586.exe tagged as "not-a-virus:AdWare.DelphinMedia.Viewer.f". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP27\A0014587.exe tagged as "not-a-virus:AdWare.DelphinMedia.Viewer.f". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP27\A0014602.exe infected by "Trojan-Downloader.Win32.Apropo.g" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP27\A0014606.exe infected by "Trojan-Downloader.Win32.QDown.x" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP27\A0014616.exe infected by "Trojan-Downloader.Win32.Delmed.a" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP27\A0014620.ocx tagged as "not-a-virus:AdWare.DelphinMediaViewer.c". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP27\A0014621.dll tagged as "not-a-virus:AdWare.DelphinMedia.Viewer.f". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP27\A0014622.exe tagged as "not-a-virus:AdWare.DelphinMedia.Viewer.f". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP27\A0014623.exe tagged as "not-a-virus:AdWare.DelphinMedia.Viewer.f". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP27\A0014626.exe tagged as "not-a-virus:AdWare.WebSearch.an". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP27\A0014629.exe infected by "Trojan-Downloader.Win32.QDown.x" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP27\A0014630.dll tagged as "not-a-virus:AdWare.WebSearch.aj". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP27\A0014631.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP27\A0014632.exe tagged as "not-a-virus:AdWare.WebSearch.al". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP27\A0014633.exe tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP27\A0014634.dll tagged as "not-a-virus:AdWare.WebSearch.am". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP27\A0014650.exe infected by "Trojan-Downloader.Win32.Delmed.a" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{B6441411-87B0-4BDA-9E4A-8AC5B81921CD}\RP27\A0014658.exe infected by "Trojan-Downloader.Win32.QDown.x" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Helper101.dll infected by "Trojan-Clicker.Win32.Delf.r" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\btnetw-614090_venturea-hot.exe tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.i". Action Taken: No Action Taken.
File C:\WINDOWS\system32\Cache\876004.exe infected by "Trojan-Dropper.Win32.VB.gg" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\Cache\cxtpls_loader.exe infected by "Trojan-Downloader.Win32.Apropo.ab" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\Cache\dist006.exe infected by "Trojan-Downloader.Win32.VB.eu" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\Cache\e121307.Stub.exe infected by "Trojan-Downloader.Win32.Delmed.a" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\Cache\HelperInstall.exe infected by "Trojan-Dropper.Win32.Delf.z" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\Cache\optimize8.exe infected by "Trojan-Downloader.Win32.Dyfuca.ei" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\Cache\pi1_60.exe infected by "Trojan-Downloader.Win32.Small.aal" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\Cache\setup_test.exe infected by "Trojan-Downloader.Win32.VB.id" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\Cache\SSK3_B5 Advagency.exe infected by "Trojan-Dropper.Win32.Small.qn" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\Cache\thin-175-1-x-x.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken.
File C:\WINDOWS\system32\Cache\ven_d1.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus&

Nala

Post #14June 15, 2005, 7:15 AM UTC

I NOTICED THAT MY PREVIOUS REPLY POST'S COPY ACTION OF THE MICROWORLD'S BOTTOM SCREEN SCAN REPORT SEEMS TO BE MISSING SOME OF ITS LAST ENTRIES, SO I HAVE LOCATED WHERE IT LEFT OFF AND BELOW IS THE REMAINING PART OF THAT REPORT:

File C:\WINDOWS\system32\Cache\ven_d1.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\Cache\weirdontheweb_ventura2.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\WINDOWS\system32\ccpsk.dll infected by "Trojan-Downloader.Win32.Qoologic.q" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\cxtpls_loader.exe infected by "Trojan-Downloader.Win32.Apropo.ab" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\D0CE0C16B1.DLL infected by "Trojan-Clicker.Win32.Agent.dh" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\dist001.exe infected by "Trojan-Downloader.Win32.VB.eu" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\GSM3-0511.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\L90112201.Stub.exe infected by "Trojan-Downloader.Win32.Delmed.a" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\nsdD5.dll tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.i". Action Taken: No Action Taken.
File C:\WINDOWS\system32\nsh42.dll tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.i". Action Taken: No Action Taken.
File C:\WINDOWS\system32\nsi51.dll tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.i". Action Taken: No Action Taken.
File C:\WINDOWS\system32\nsq1B.dll tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.i". Action Taken: No Action Taken.
File C:\WINDOWS\system32\nsvF2.dll tagged as "not-a-virus:AdWare.Beginto.c". Action Taken: No Action Taken.
File C:\WINDOWS\system32\nsvsvc\nsv.ocx tagged as "not-a-virus:AdWare.DelphinMediaViewer.c". Action Taken: No Action Taken.
File C:\WINDOWS\system32\nsvsvc\nsvs.dll tagged as "not-a-virus:AdWare.DelphinMedia.Viewer.f". Action Taken: No Action Taken.
File C:\WINDOWS\system32\nsvsvc\nsvsvc.exe tagged as "not-a-virus:AdWare.DelphinMedia.Viewer.f". Action Taken: No Action Taken.
File C:\WINDOWS\system32\ppznizi.dll infected by "Trojan-Downloader.Win32.Qoologic.q" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\qqpga.dat infected by "Trojan-Downloader.Win32.Qoologic.o" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\redit.cpl infected by "Trojan-Downloader.Win32.Qoologic.p" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\SSK3_B5 Seedcorn 4.exe infected by "Trojan-Dropper.Win32.Agent.hl" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\supdate.dll infected by "Trojan-Downloader.Win32.Qoologic.p" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\SYSsfitb.dll tagged as "not-a-virus:AdWare.ToolBar.SearchIt.d". Action Taken: No Action Taken.
File C:\WINDOWS\system32\thin-138-1-x-x.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken.
File C:\WINDOWS\system32\uci.exe infected by "Trojan-Dropper.Win32.Agent.hl" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\weirdontheweb_ventura.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File C:\WINDOWS\system32\WinNB57.dll tagged as "not-a-virus:AdWare.Mirar.b". Action Taken: No Action Taken.

Siggyx

Post #15June 16, 2005, 11:37 PM UTC

Please do these scans

Trend Micro http://housecall.antivirus.com/

E Trust http://www3.ca.com/virusinfo/virusscan.aspx

Rav http://www.ravantivirus.com/scan/

Pc Pitstop http://www.pcpitstop.com/antivirus/AV.asp

Panda http://www.pandasoftware.com/activescan/co…n_principal.htm

Bitdefender http://www.bitdefender.com/scan/Msie/index.php

Then download CCleaner from the link below and click on "run scanner"

Then post a new log please.

CCleaner >>>> http://www.majorgeeks.com/download4191.html

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

EMPNADS, TBPS TOOLBAR +more intrusions?!

✨ Ask AI

Ask AI