got a bug spysheriff?

Hello Mike, Welcome to TomCoyote forum. I wish first to apologize for the member that posted in your thread. I am sure they were well intentioned and wanted to help…and may have, but it is just against the policy of the forum. I can see you have been hard at work trying to cleanup this mess, and I am going to look at your last posted log and go from there. I can tell you that this line:
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe indicates you have a Nail/Aurora infection. I see you think there may be some CoolWebSearch on the computer and even though I do not see this, I am going to run CWShredder just in case. Once you have completed these two tools, then we will clean up the balance with HijackThis, so you know we have a little work to do.

To answer this question:

Have read posts about aboutblank in this forum. can I use these posts to fix my problem???

My advice is unless you are very sure about what you are doing, you should wait until one of the folks trained in this process can assist you. The process varies from infection to infection and even though it might look the same, it might not be. I should also say that some of the fixes are for specific infections and damage to your computer can result from using them.

was able to get xp service pack 2 loaded on my computer. Hers my lastest log

Microsoft was very definate what they said not to download SP2 unless you have a clean (no malware) computer. I can not say what the results of putting it on the computer while you are still infected will be but my guess is that you are probably going to have to remove it and download it again. You might discuss that with your Microsoft Tech, here are their instructions:
http://www.microsoft.com/windowsxp/sp2/sp2_whattoknow.mspx

I suppose we are ready, please follow the directions in the posted order:

1) Download CCleaner from this link: http://www.ccleaner.com/ Review the instructions on the download page and please do not run it until I ask you to.

2) Download CWShredder from the following link. Update if available, then click on FIX not scan. Allow the program to run and remove anything it locates. Please let me know if it found anything.
http://www.softpedia.com/get/Internet/Popu…WShredder.shtml


3) Nail/Aurora Instructions

Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.


Please download Nailfix from here:
http://users.pandora.be/bluepatchy/nailfix.exe
Save it to the desktop but please do NOT run it yet.

The above Registry file written by miekiemoes, Swandog and racooper was written specifically for this infection and is not to be used on any other infection as it could damage a person's PC
Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.com/support/safemode.shtml

Once in Safe Mode, please double-click on Nailfix.cmd. Your desktop and icons will disappear and reappear, and a window should open and close very quickly — this is normal.

Then please run Ewido, and run a full scan. Save the log from the scan to your Desktop. IMPORTANT! Lately more people choose “Ignore” during the scan, but you’ll have to click/choose “Clean” or “Quarantine”! Otherwise the whole fix will result in a failure.

Then please run HijackThis, click Scan, and check (if there):

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

Close all open windows except for HijackThis and click Fix Checked.

Restart your computer in normal mode, make a new HijackThis log and post it here in this same thread, as well as the log from the Ewido scan.

Run CCleaner using the default settings, please do not use the registry cleaner unless you follow the directions to back up the registry.

We will have more to do.
Thanks…pskelley
TomCoyote forum
Slyware Warrior

Hi Mike, You have posted the wrong Ewido report and that makes me think the scan was not run properly. Here are the instructions, make sure you follow these directions:


Then please run Ewido, and run a full scan. Save the log from the scan to your Desktop. IMPORTANT! Lately more people choose “Ignore” during the scan, but you’ll have to click/choose “Clean” or “Quarantine”! Otherwise the whole fix will result in a failure.


Here are additional instructions if it helps:
Ewido trojan scanner: http://www.ewido.net/en/download/
Please download, install, update and scan your system with the free version of Ewido trojan scanner:

1. When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
   
2. When you run ewido for the first time, you will get a warning "Database could not be found!". Click OK. We will fix this in a moment.
   
3. From the main ewido screen, click on update in the left menu, then click the Start update button.
   
4. After the update finishes (the status bar at the bottom will display "Update successful"), click on the Scanner button in the left menu, then click on the Start button. This scan can take quite a while to run, so time to go get a drink and a snack….
   
5. If ewido finds anything, it will pop up a notification. You can select "clean" and check the boxes "Perform action with all infections" and "Create encrypted backup" before clicking on OK.
   
6. When the scan finishes, click on "Save Report". This will create a text file. Please then paste the contents of the text file to this thread.
   

The correct log will look like this:
ewido security suite - Scan report
———————————————————

+ Created on: 9:20:53 AM, 7/5/2005
+ Report-Checksum: 31720637

+ Scan result:

C:\Documents and Settings\Norm\Cookies\norm@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
ETC. This is a scan report.
__________________________________________________________________________
You have posted:

ewido security suite - Process report
———————————————————

+ Created on: 9:42:13 AM, 7/5/2005
+ Report-Checksum: 697BB19C

———————————————————
ewido security suite - Startup report
———————————————————

+ Created on: 9:42:02 AM, 7/5/2005
+ Report-Checksum: 28C45BA0

Post the log of the scan when it is complete, make sure you do this:

IMPORTANT! Lately more people choose “Ignore” during the scan, but you’ll have to click/choose “Clean” or “Quarantine”! Otherwise the whole fix will result in a failure.
From looking at the HJT log you posted, none of the items Ewido normally removes during the scan have been removed, please review the instructions, scan as directed, remove the bad items when prompted then save the report. Make sure you reboot after your scan then post the scan log and a new HJT log. Thanks.

pskelly Think I got it right this time. here us the scan report. Forgot to tell you last time Cwshredder found nothing. Thanks Mike ——————————————————— ewido security suite - Scan report ——————————————————— + Created on: 11:18:29 AM, 7/5/2005 + Report-Checksum: FC8F254C + Scan result: HKLM\SOFTWARE\AutoLoader -> Spyware.AproposMedia : Cleaned with backup HKLM\SOFTWARE\AutoLoader\20271JLKNYPc -> Spyware.AproposMedia : Cleaned with backup HKLM\SOFTWARE\AutoLoader\202H1JLKNYPc -> Spyware.AproposMedia : Cleaned with backup HKLM\SOFTWARE\Envolo -> Spyware.AproposMedia : Cleaned with backup HKLM\SOFTWARE\Envolo\AutoUpdate -> Spyware.AproposMedia : Cleaned with backup HKLM\SOFTWARE\Envolo\AutoUpdate\State -> Spyware.AproposMedia : Cleaned with backup HKLM\SOFTWARE\Envolo\AutoUpdate\Tasks -> Spyware.AproposMedia : Cleaned with backup C:\Program Files\Aprps\CxtPls.dll -> Heuristic.Win32.Hijacker1 : Cleaned with backup C:\Program Files\Aprps\plg0\cxtpls.dll -> Heuristic.Win32.Hijacker1 : Cleaned with backup C:\Program Files\Common Files\AOL\ACS\acsd.exe -> Heuristic.Win32.Dialer : Cleaned with backup C:\Program Files\Common Files\aolback\Comps\coach\aolcinst.exe/.\Data\player\aolnysev.exe -> Heuristic.Win32.Hijacker1 : Cleaned with backup C:\Program Files\Common Files\aolshare\Coach\Player\AOLNySEV.exe -> Heuristic.Win32.Hijacker1 : Cleaned with backup C:\Program Files\Common Files\Microsoft Shared\DAO\winkfwf32.dll -> TrojanDownloader.Murlo.ar : Cleaned with backup C:\Program Files\nrpn\osoa.exe -> Spyware.PurityScan : Cleaned with backup C:\Program Files\SurfSideKick 3\Ssk.exe -> Spyware.SurfSide : Cleaned with backup C:\Program Files\SurfSideKick 3\SskBho.dll -> Spyware.SurfSide : Cleaned with backup C:\Program Files\SurfSideKick 3\SskCore.dll -> Spyware.SurfSide : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP147\A0010559.dll -> Spyware.AproposMedia : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP147\A0010560.dll -> TrojanDownloader.Apropo.w : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP147\A0010561.exe -> Spyware.AproposMedia : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP147\A0010562.dll -> Spyware.AproposMedia : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP154\A0010646.dll -> Spyware.AproposMedia : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP154\A0010647.exe -> Spyware.AproposMedia : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP154\A0010648.dll -> Spyware.AproposMedia : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP154\A0010650.dll -> Spyware.AproposMedia : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP154\A0010651.exe -> Spyware.AproposMedia : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP179\A0011549.dll -> Trojan.Pakes : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP179\A0011550.dll -> Trojan.Pakes : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP179\A0011552.exe -> Trojan.Pakes : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP179\A0011554.dll -> Heuristic.Win32.Hijacker1 : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP179\A0011555.dll -> Trojan.Pakes : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP179\A0011557.exe -> Trojan.Pakes : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP179\A0011558.dll -> Trojan.Pakes : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP188\A0011726.exe -> TrojanDropper.Small.wp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP188\A0011728.dll -> TrojanDownloader.Small.ajp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP188\A0011729.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP188\A0011738.exe -> TrojanDownloader.Small.aqt : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP188\A0011739.exe -> Trojan.LowZones.y : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP188\A0011740.exe -> TrojanDropper.Small.wv : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP188\A0011741.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP188\A0011743.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP188\A0011744.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP188\A0011745.dll -> TrojanProxy.Small.bk : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP188\A0011747.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP189\A0011751.exe -> TrojanDownloader.Intexp.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP189\A0011754.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP189\A0011759.exe -> TrojanDropper.Small.wp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP189\A0011760.dll -> TrojanDownloader.Small.ajp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP189\A0011761.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP189\A0011770.exe -> TrojanDownloader.Small.aqt : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP189\A0011771.exe -> Trojan.LowZones.y : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP189\A0011772.exe -> TrojanDropper.Small.wv : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP189\A0011773.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP189\A0011774.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP189\A0011775.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP189\A0011776.dll -> TrojanProxy.Small.bk : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP189\A0011777.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP189\A0011779.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP190\A0011788.exe -> Spyware.AproposMedia : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP190\A0011791.exe -> Spyware.BargainBuddy : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP190\A0011807.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP190\A0011814.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0011818.exe -> TrojanDropper.Small.wp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0011820.dll -> TrojanDownloader.Small.ajp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0011826.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0011827.exe -> Trojan.LowZones.y : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0011833.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0011838.DLL -> Trojan.WebSearch.i : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0011839.exe -> TrojanDropper.Small.wp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0011841.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0011842.dll -> TrojanDownloader.Small.ajp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0011850.exe -> TrojanDownloader.Small.aqt : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0011851.exe -> TrojanSpy.PdPinch : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0011853.exe -> TrojanDropper.Small.wv : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0011854.exe -> Trojan.LowZones.y : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0011855.exe -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0011856.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0011857.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0011858.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0011859.dll -> TrojanProxy.Small.bk : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0011860.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0011862.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0011864.exe -> TrojanDropper.Small.qn : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012838.DLL -> Trojan.WebSearch.i : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012840.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012841.exe -> TrojanDropper.Small.wp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012842.dll -> TrojanDownloader.Small.ajp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012849.exe -> TrojanSpy.PdPinch : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012850.exe -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012852.exe -> TrojanDownloader.Small.aqt : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012853.dll -> TrojanDownloader.Dyfuca.eg : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012854.exe -> Trojan.LowZones.y : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012855.exe -> TrojanDropper.Small.wv : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012856.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012857.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012858.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012859.dll -> TrojanProxy.Small.bk : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012860.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012867.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012868.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012869.exe -> TrojanDownloader.Dyfuca.ei : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012873.exe -> TrojanDownloader.Dyfuca.ei : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012879.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012880.DLL -> Trojan.WebSearch.i : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012881.exe -> TrojanDropper.Small.wp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012883.dll -> TrojanDownloader.Small.ajp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012886.exe -> TrojanSpy.PdPinch : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012887.exe -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012890.exe -> TrojanDownloader.Small.aqt : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012891.exe -> Trojan.LowZones.y : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012892.exe -> TrojanDropper.Small.wv : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012893.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012894.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012895.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012898.dll -> TrojanProxy.Small.bk : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012899.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012901.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012908.DLL -> Trojan.WebSearch.i : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012911.exe -> TrojanDropper.Small.wp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012912.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012913.dll -> TrojanDownloader.Small.ajp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012920.exe -> TrojanSpy.PdPinch : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012921.exe -> TrojanDownloader.Small.aqt : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012923.exe -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012924.exe -> Trojan.LowZones.y : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012925.exe -> TrojanDropper.Small.wv : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012926.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012927.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012928.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012929.dll -> TrojanProxy.Small.bk : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012930.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012932.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012939.DLL -> Trojan.WebSearch.i : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012941.exe -> TrojanDropper.Small.wp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012942.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012943.dll -> TrojanDownloader.Small.ajp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012951.exe -> TrojanSpy.PdPinch : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012952.exe -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012953.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012954.exe -> TrojanDownloader.Small.aqt : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012955.exe -> Trojan.LowZones.y : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012956.exe -> TrojanDropper.Small.wv : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012957.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012958.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012959.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012960.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012961.dll -> TrojanProxy.Small.bk : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012962.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012964.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012976.DLL -> Trojan.WebSearch.i : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012977.exe -> TrojanDropper.Small.wp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012979.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012981.dll -> TrojanDownloader.Small.ajp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012985.exe -> TrojanSpy.PdPinch : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012987.exe -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012989.exe -> TrojanDropper.Small.wv : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012990.exe -> Trojan.LowZones.y : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012992.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012994.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012995.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012996.dll -> TrojanProxy.Small.bk : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012997.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0012999.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0013977.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0013978.DLL -> Trojan.WebSearch.i : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0013980.exe -> TrojanDropper.Small.wp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0013981.dll -> TrojanDownloader.Small.ajp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0013987.exe -> TrojanSpy.PdPinch : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0013988.exe -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0013998.DLL -> Trojan.WebSearch.i : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0013999.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014000.exe -> TrojanDropper.Small.wp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014001.dll -> TrojanDownloader.Small.ajp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014012.exe -> TrojanDropper.Small.wv : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014013.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014014.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014015.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014016.dll -> TrojanProxy.Small.bk : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014018.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014019.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014021.exe -> Trojan.LowZones.y : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014138.DLL -> Trojan.WebSearch.i : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014140.exe -> TrojanDropper.Small.wp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014141.dll -> TrojanDownloader.Small.ajp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014143.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014154.exe -> Trojan.LowZones.y : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014155.exe -> TrojanDropper.Small.wv : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014157.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014158.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014159.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014160.dll -> TrojanProxy.Small.bk : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014161.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014163.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014170.DLL -> Trojan.WebSearch.i : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014172.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014173.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014174.exe -> TrojanDropper.Small.wp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014175.dll -> TrojanDownloader.Small.ajp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014184.exe -> TrojanDropper.Small.wv : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014185.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014186.exe -> Trojan.LowZones.y : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014187.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014188.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014190.dll -> TrojanProxy.Small.bk : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014191.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0014193.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0015170.DLL -> Trojan.WebSearch.i : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0015172.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0015173.exe -> TrojanDropper.Small.wp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0015174.dll -> TrojanDownloader.Small.ajp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0015183.exe -> TrojanDropper.Small.wv : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0015184.exe -> Trojan.LowZones.y : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0015185.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0015187.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0015188.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0015189.dll -> TrojanProxy.Small.bk : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0015190.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0015193.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0015199.DLL -> Trojan.WebSearch.i : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0015200.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0015201.exe -> TrojanDropper.Small.wp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0015203.dll -> TrojanDownloader.Small.ajp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0015212.exe -> TrojanDropper.Small.wv : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0015213.exe -> Trojan.LowZones.y : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0015214.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0015215.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0015217.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0015218.dll -> TrojanProxy.Small.bk : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0015219.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016199.DLL -> Trojan.WebSearch.i : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016200.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016201.exe -> TrojanDropper.Small.wp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016203.dll -> TrojanDownloader.Small.ajp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016212.exe -> TrojanDropper.Small.wv : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016213.exe -> Trojan.LowZones.y : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016214.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016216.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016217.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016218.dll -> TrojanProxy.Small.bk : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016219.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016221.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016225.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016231.DLL -> Trojan.WebSearch.i : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016233.exe -> TrojanDropper.Small.wp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016234.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016235.dll -> TrojanDownloader.Small.ajp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016244.exe -> TrojanDropper.Small.wv : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016245.exe -> Trojan.LowZones.y : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016247.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016251.DLL -> Trojan.WebSearch.i : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016252.exe -> TrojanDropper.Small.wp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016253.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016255.dll -> TrojanDownloader.Small.ajp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016264.exe -> TrojanDropper.Small.wv : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016265.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016266.exe -> Trojan.LowZones.y : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016267.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016268.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016270.dll -> TrojanProxy.Small.bk : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016271.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016273.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP191\A0016276.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0016285.DLL -> Trojan.WebSearch.i : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0016286.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0016288.exe -> TrojanDropper.Small.wp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0016289.dll -> TrojanDownloader.Small.ajp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0016293.exe -> TrojanDropper.Small.wv : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0016294.exe -> Trojan.LowZones.y : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0016295.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0016297.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0016298.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0016300.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0016302.dll -> TrojanProxy.Small.bk : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0016303.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0016305.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0016306.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0017320.DLL -> Trojan.WebSearch.i : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0017322.dll -> Backdoor.Agent.iw : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0017323.exe -> TrojanDropper.Small.wp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0017325.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0017326.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0017327.dll -> TrojanDownloader.Small.ajp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0017337.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0017338.exe -> Trojan.LowZones.y : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0017339.exe -> TrojanDropper.Small.wv : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0017340.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0017341.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0017342.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0017343.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0017345.dll -> TrojanProxy.Small.bk : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0017346.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0017349.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0018356.DLL -> Trojan.WebSearch.i : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0018357.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0018358.exe -> TrojanDropper.Small.wp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0018362.dll -> TrojanDownloader.Small.ajp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0018364.dll -> Backdoor.Agent.iw : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0018369.exe -> TrojanDropper.Small.wv : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0018370.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0018371.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0018372.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0018374.dll -> TrojanProxy.Small.bk : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0018376.exe -> TrojanDownloader.Agent.ho : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0018377.exe -> Backdoor.Agent.iw : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0018379.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0018380.exe -> Trojan.LowZones.y : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0018383.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP193\A0018385.dll -> TrojanDownloader.Apropo.ad : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP194\A0018400.exe -> Spyware.AproposMedia : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP194\A0018401.EXE -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP194\A0018402.EXE -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP194\A0018403.DLL -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP194\A0018404.DLL -> Trojan.WebSearch.i : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP194\A0018405.EXE -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP194\A0018406.EXE -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP194\A0018407.DLL -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP194\A0018408.EXE -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP194\A0018409.EXE -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP194\A0018410.DLL -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP194\A0018411.DLL -> Trojan.WebSearch.i : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP194\A0018412.EXE -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP195\A0018414.EXE -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP195\A0018415.DLL -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP195\A0018416.DLL -> Trojan.WebSearch.i : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP195\A0018417.EXE -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP195\A0018418.EXE -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP195\A0018419.DLL -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP195\A0018420.DLL -> Trojan.WebSearch.i : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP195\A0018421.EXE -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP202\A0018428.EXE -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP202\A0018429.DLL -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP211\A0018440.exe -> Spyware.BargainBuddy : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP224\A0019352.exe -> TrojanDownloader.Apropo.ac : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP224\A0019353.exe -> TrojanDownloader.Agent.ed : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP224\A0019361.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP224\A0019364.exe -> TrojanDropper.Small.wp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP224\A0019367.DLL -> Trojan.WebSearch.i : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP224\A0019368.dll -> TrojanDownloader.Small.ajp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP224\A0019370.dll -> Backdoor.Agent.iw : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP234\A0019398.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP234\A0019399.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP234\A0019400.exe -> Backdoor.Agent.iw : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP234\A0019401.exe -> Trojan.LowZones.y : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP236\A0019411.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP239\A0019415.DLL -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP239\A0019416.DLL -> Trojan.WebSearch.i : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP239\A0019417.EXE -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP239\A0019418.DLL -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP239\A0019419.EXE -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP239\A0019420.DLL -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP239\A0019421.DLL -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP239\A0019422.DLL -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP239\A0019423.DLL -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP239\A0019424.DLL -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP239\A0019425.DLL -> Trojan.WebSearch.j : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP239\A0019428.exe -> TrojanDropper.Small.wp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP239\A0019429.dll -> TrojanDownloader.Small.ajp : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP245\A0019444.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP245\A0019445.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP245\A0019446.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP245\A0019447.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP245\A0019448.exe -> TrojanDownloader.Small.agq : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP245\A0019472.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP250\A0019699.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP250\A0019700.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP250\A0019701.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP252\A0019725.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP252\A0019752.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP252\A0019759.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP252\A0019765.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP252\A0019766.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP252\A0019767.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP253\A0019768.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP255\A0021498.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP255\A0021500.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP255\A0021888.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP255\A0021915.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP255\A0021922.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP255\A0021923.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP255\A0021931.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP255\A0021943.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP255\A0021948.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP255\A0021949.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP255\A0021963.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP255\A0021976.exe -> Adware.BetterInternet : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP255\A0021981.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP255\A0021982.exe -> Trojan.Crypt.c : Cleaned with backup C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP255\A0021984.dll -> TrojanDownloader.Apropo.ad :

Slow down a little Mike, this is not something that should be rushed, that's when mistakes get made. You may have cut off the Ewido scan at the bottom, but that's ok, I know it worked now. I will give you instructions for getting all of that junk out of your restore files as soon as cleanup is completed. Please see this:

Ewido normally removes during the scan have been removed, please review the instructions, scan as directed, remove the bad items when prompted then save the report. Make sure you reboot after your scan then post the scan log and a new HJT log. Thanks.

Thanks…waiting on the log…make sure you have done a reboot after running Ewido for the changes to be made on the computer. Thanks…Phil

On second thought, I would like to clean out those system restore files. Follow these directions to turnoff System Restore reboot your computer, then turn System Restore back on. Here are instructions:
http://service1.symantec.com/SUPPORT/tsgen…src=sec_doc_nam

MANUAL INSTRUCTIONS FOR SYSTEM RESTORE
1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore,
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.

Once you have sent me a HJT log, as soon as you can after that, please scan again with Ewido and post that scan log. I want to see what is left in the log once System Restore is purged.

Thanks…Phil

Mike, I am waiting for the HJT log that was run after the last Ewido scan…Thanks

OK Mike, We still have quite a bit of infection still in the log. Try to stay offline as much as possible while we clean it up. It may be that something like SpySheriff is inviting additional malware in. Let's do a removal with HJT.

1) I don't see any antivirus software running, if this is the case, please download free AVG, update it and run a complete system scan:
http://free.grisoft.com/freeweb.php

2) Download, update, configure and run these two programs:
http://tomcoyote.org/aawsb.php

3) Download DelDomains: http://www.mvps.org/winhelp2002/DelDomains.inf
Save the file to the desktop.
Then go to the desktop, right click on DelDomains.inf, and choose Install.
You may not see any noticeable changes or prompts; this is normal.
**Note** This will remove all entries in the "Trusted Zone"

Note that since the Restricted Domains are deleted by this fix, SpywareBlaster protection must be re-enabled. Spybot's Immunize feature must be used again, and you will also have to re-install IE-SpyAd if installed.

4) Look in Add Remove programs, uninstall these items if there:
VBouncer or virtual bouncer
SpySheriff

5) Open your Task Manager then the processes tab. End process on these two items:
C:\WINDOWS\system32\nlspdmoe.exe
C:\WINDOWS\System32\r?ndll.exe

6) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
O2 - BHO: Bucket Class - {00000001-C003-4A2F-9142-7CB1D78DE6C1} - C:\WINDOWS\tct101.dll (file missing)
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [27th37W] nlspdmoe.exe
O4 - HKLM\..\Run: [pxkkiid] c:\windows\system32\ccobncc.exe r
O4 - HKCU\..\Run: [Jw2nRXaEW] netpack.exe
O4 - HKCU\..\Run: [wupd] C:\WINDOWS\system32\win32.exe
O4 - HKCU\..\Run: [Ncao] C:\Program Files\nrpn\osoa.exe
O4 - HKCU\..\Run: [Zckc] C:\WINDOWS\System32\r?ndll.exe
O4 - HKCU\..\Run: [SpySheriff] C:\Program Files\SpySheriff\SpySheriff.exe
O21 - SSODL: Data Access Objects (DAO) 3.5 - {9B7DA653-DEAB-07AA-0A98-CADC97868263} - c:\program files\common files\microsoft shared\dao\winkfwf32.dll (file missing)

Close all programs but HJT and all browser windows, then click on "Fix Checked"

7) SHOW HIDDEN FILES: Follow the instructions in the link to enable hidden files for your operating system.
You may wish to reverse this process if you have any concern about anyone getting into these hidden system files.
http://www.xtra.co.nz/help/0,,4155-1916458,00.html

RIGHT Click on Start then click on Explore. Locate and delete these items:

C:\PROGRAM FILES ~1\VBouncer\ >>> folder

C:\Program Files\SpySheriff\ >>> folder

C:\Program Files\nrpn\ >>> folder

C:\Program Files\AutoUpdate\ >>> folder

C:\WINDOWS\wupdt.exe >>> file

C:\WINDOWS\system32\nlspdmoe.exe >>> file

c:\windows\system32\ccobncc.exe r >>> file

C:\WINDOWS\system32\win32.exe >>> file

C:\WINDOWS\System32\r?ndll.exe … file (careful of the spelling, a valid file is near it. Must be spelled with the ?) Do not delete the wrong file

netpack.exe >>> file <<< Mike, you will have to search for this one.

Locate C:\Windows\Prefetch folder and open it. Delete the contents of the folder (NOT THE FOLDER) if there are many choose Edit then Select all then Delete. You may not be able to remove them all, don't be concerned unless any have the name of the items we need to remove. Here is some information about the Prefetch for you:
http://techrepublic.com.com/5100-6270-5165773.html
http://www.pcmag.com/article2/0,1759,1683520,00.asp

Restart the computer, then scan for a new log with HJT and post it to this tread.

Mike, this is a lot of complex work, I am at my computer, if you have questions, please send them to me. thanks

got the repy after i sent the ewido and hjt log, so not trying to go to fast ( your not the first person to point that out to me) should I do the restore? or just move to your last post? Won't be getting on line with the sic computer any more and yes I don't have any anti- virus installed. Looks like a will be making a donation to your cause. thanks mike

OK Mike, Anytime you see me in your thread and you know I am sending a post, always wait until you are sure I am done. I was have issues with highliting. Afer I post you still want to refresh to windows to make sure you are looking at the newest page. Let's take our time and get through this, for some reason the Ewido removed a lot but left a lot, I am not sure if it was the way you ran it or not. I may also have to use a special fix for SpySheriff, we will see. I go on vacation in two weeks so let's hope things fall into place… You can purge those system restore files whenever you want. I will probably want another Ewido scan or so before we are done.

did the restore procedure, what do you want me to do know???? Thanks mike

I do not know what you are asking me Mike?