What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

WORM_MUGLY.I

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Trend Micro shows theWORM_MUGLY.I virus when I scan. I have followed through with the Sysclean option to no avail.Encountered REGEDIT issues in similar posts and have been able to use REGEDIT.exe to gain access.The DLLMAN.exe ,etc files are not listed.When I restart after cleaning a Complete folder reappears in C:Doc.& Set. with Zip files-uaually 117-that have WORM_VB.AS asociated with it. Sysclean removes these files and those from WINUPDATES\atemp,azip,and WINUPDATES.exe.Also 2 from SYSTEM VOLUME RESTORE. They come back upon restart.
Hoping you can walk me through the extrication process.Below is my HJT log: cLogfile of HijackThis v1.99.1
Scan saved at 2:47:53 PM, on 8/20/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\WINDOWS\System32\hphmon04.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Microangelo\muamgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\winupdates\winupdates.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\HPHipm11.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cidaemon.exe
C:\HIJACK THIS\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;http://localhost;
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SafeGuard Protect PCShield - {564FFB73-9EEF-4969-92FA-5FC4A92E2C2A} - C:\WINDOWS\System32\sfg_69c1.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exe
O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [MOD] C:\Program Files\Microangelo\muamgr.exe
O4 - HKLM\..\Run: [PCShield] regsvr32 /s "C:\WINDOWS\System32\sfg_69c1.dll"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto
O4 - HKCU\..\Run: [PCShield] regsvr32 /s "C:\WINDOWS\System32\sfg_69c1.dll"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdccommon/…ad/tgctlins.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://bin.mcafee.com/molbin/shared/mcinsc…76/mcinsctl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://bin.mcafee.com/molbin/shared/mcgdmg…,16/mcgdmgr.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\System32\HPHipm11.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #2
Hello Dillo210, welcome to the TC.

Please download ewido Security Suite
  • Install ewido security suite
  • When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu."
  • Launch ewido, there should be a big "E" icon on your desktop, double-click it.
  • The program will prompt you to update click the "OK" button
  • The program will now go to the main screen

    You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update
  • Click on Start

    The update will start and a progress bar will show the updates being installed. After the updates are installed, exit ewido.

    Once the updates are installed do the following:
  • If you have an "always on" connection to the internet, physically disconnect that connection until you are finished with Safe Mode and have rebooted back into normal mode.
  • Reboot into Safe Mode, you can do this by restarting your computer, then contiunally tapping F8 until a menu appears. Use your up arrow key to highlight Safe Mode, then hit enter. Then, run ewido.
  • Close all open windows/programs/folders. Have nothing else open while ewido performs its scan!
  • Click on scanner
  • Click on Settings
    • Under "How to scan" all boxes should be selected
    • Under "Possibly unwanted software" all boxes should be selected
    • Under "What to scan" select scan every file
    • Click OK
  • Click on Complete system scan
  • Let the program scan the machine
  • If ewido finds anything, it will pop up a notification. NOTE: We have been finding some cases of false positives with the new version of Ewido, so we need to step through the fixes one-by-one. If Ewido finds something that you KNOW is legitimate (for example, parts of AVG Antivirus, AOL, pcAnywhere and the game "Risk" have been flagged. In particular, watch for alerts that have the word "Heuristic" in them - if you recognize the file name as "friendly," these may actually be false positives) select "none" as the action. DO NOT check "Perform action with all infections." If you are unsure of an entry, select "none" for the time being. I'll see that in the log you will post later and let you know if ewido needs to be run again.

    Once the scan has completed, there will be a button located on the bottom of the screen named Save report.
  • Click Save report
  • Save the report to your desktop
  • Exit ewido

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.
Post #3
Thanks for your response,your time.Below are the EWIDO log and HJT log.I left some items that were infected w/ VB_AS before I realized it would go through them all. These are the guys that keep coming back.When asked to clean the set-up .exes they noted they were embedded in ARCHIVE zips w/ the same title-I selected yes to remove the whole archive.

———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 3:45:54 PM, 8/27/2005
+ Report-Checksum: B78D882C

+ Scan result:

C:\Documents and Settings\Jeff\Complete\#1 DVD Ripper 1.3.50.zip/Setup.exe -> Worm.VB.an : Ignored
C:\Documents and Settings\Jeff\Complete\1Click DVD Copy 4.2.1.5.zip/Setup.exe -> Worm.VB.an : Ignored
C:\Documents and Settings\Jeff\Complete\1Click DVD Copy v4.2.1.5.zip/Setup.exe -> Worm.VB.an : Ignored
C:\Documents and Settings\Jeff\Complete\2 Beautiful Lesbians.zip/Setup.exe -> Worm.VB.an : Ignored
C:\Documents and Settings\Jeff\Local Settings\Temporary Internet Files\Content.IE5\4BSPEZOF\cmb_261234[1].exe -> Heuristic.Win32.Dialer : Ignored
C:\WINDOWS\SYSTEM32\osmim.dll -> Spyware.MarketScore : Ignored
C:\Documents and Settings\Jeff\Complete\3D Grandfather Clock Screensaver.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Absolute Video to Audio Converter v2.4.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\ABviewer 5.0.1.47.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Acronis Disk Director Suite 9.0.549.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Active KillDisk Professional v3.1.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Actual Title Buttons v3.7.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Actual Transparent Window v3.7.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Actual Window Guard v3.7.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Actual Window Manager v3.7.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Actual Window Menu 3.7.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Actual Window Menu v3.7.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Actual Window Minimizer 3.7.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Actual Window Minimizer v3.7.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Actual Window Rollup 3.7.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Actual Window Rollup v3.7.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Ad-Aware 2005.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Adobe Audition 1.5.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Advanced Security Level v6.1.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Ahead DVD Ripper 1.15.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Ahead DVD Ripper v1.1.4 w KeyGen New.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Ahead DVD Ripper v1.15.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\AirXonix 1.41.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Alchohol 120%.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Alexander DVD RiP Xvid FR.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Alicia Rhodes & Her Big Perfect Tits.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\All In One CoffeeCup Retail Software.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\All-In-One Learn To Speak Foreign Langua.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Allok MOV Converter v1.4.2.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Amazon DVD Shrink v2.4.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Amazon DVD Shrinker v2.31.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\American Pie 1-2-3.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Anti Tracks v5.4.2.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\AnyDVD 4.5.5.1.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\AoA DVD Ripper v3.79.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Apollo Audio DVD Creator 1.1.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Apollo DVD Copy v4.5.1..zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Apollo DVD Label Maker 1.5.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\AREA-51 iSO.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Audio DVD Creator 1.85.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Audio Edit Magic v7.5.5.640.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Aurora Media Workshop 2.417.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Aurora Media Workshop v2.4.17.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Ball7.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Barcode Maker For Office 3.5.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Barcode Maker For Office V3.5.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Basement Jaxx - The Singles.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Batch And Print Pro 2.00.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Battlefield 2 iSO.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Beast Of Bourbon - The Axeman Jazz.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Big Tit ######.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\BitDefender Plus 9.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\BitDefender Pro Plus v9.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\BitDefender Professional Plus v9.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\BlackICE PC Protection 3.6.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Blaze VideoMagic 1.0 Datecode 20050318.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Blaze VideoMagic v1.0 Datecode 20050318.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Blocking Spam and Spyware for Dummies.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Bloodrayne 2.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Brothers in Arms Road to Hill 30.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\BSplayer Pro 1.35.823.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Button Studio 2.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Carmen Electra- Playboy DVD.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\ChemEng Software ChemMaths v8.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\ChemEng Software DataPro v3.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\ChemEng Software Equations v3.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Chris TV Professional.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Church Treasurer v3.01e.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Cinderella Man (Good Quality).zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\CloneCD 5.1.0.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\CloneDVD 3.6.1.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\CloneDVD v3.6.1.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Coach Carter DVD Rip Xvid.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\CoffeeCup Retail Software.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Colin Mcrae Rally 2005.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\ColorImpact v2.8.6.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Comdev One Admin Suite v3.1 & Addons.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Corel WordPerfect Office 12.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Counter-Strike 1.6.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Counter-Strike Source + All Updates.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Crystalix.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Dark Water.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Database Tour.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\DFX 7.3 Audio Enhancer.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\DirectUpdate 4.05 Build 123.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\DirectUpdate v4.05 Build 123.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\DivX 6.02.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\DJ Tiesto - Revolution CD 1.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Download Master 4.3.3.907.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Drop! 2.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Dungeon Siege 2.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Dus (Hindi, Bollywood).zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\DVD Cloner Pro 3.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\DVD Cloner Pro v3.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\DVD Region 5.62.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\DVD Shrink 3.0.13.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\DVD-lab Pro version 1.53.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\DVDFab Platinum 2.89.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Easy DVD CD Burner v3.0.55.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Easy DVD to DivX VCD SVCD Converter v3.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\eBook Mastering Java Server Faces.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\eBook Unix For Dummies.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\eBooks Mastering Java Server Faces.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\EditPlus 2.20.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\EditPlus v2.20 Build 211 Full.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\EditPlus v2.20 Build 211.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Elektra.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Enon - High Society.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\ERUNT 1.1i.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Eternal Sunshine Of The Spotless Mind.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Everest 2.20 Corporate.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\EVEREST Ultimate Edition 2.20.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\EverQuest II.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Eye Candy 5.0 Nature.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Fantastic 4.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\FAST Defrag Pro 2.3.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Fax Machine 4.20.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Fax Machine v4.20.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\FIFA Soccer 2005.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\FinalRecovery 1.3.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\FinalRecovery v1.3.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\FindinSite-CD v6.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\FinePrint pdfFactory Pro v2.43.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\First Alert Service Monitor v9.80.01.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\FlashGet 1.71.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Fleetmate 1.2.028.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Ford Racing 3.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Froggy Castle.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Gangland iSO.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\GiPo DB Utilities v4.2.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Grand Theft Auto San Andreas [PC].zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\GTA San Andreas.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Hitch DVD Rip Xvid.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\HitchHikers Guide to the Galaxy Xvid.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Home Networking Bible.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Idera SQL Diagnostic Manager 3.5.450.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\ImTOO Audio Encoder 2.0.17 bu.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\ImTOO WMA MP3 Converter v2.0.36.809.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\IncrediMail Xe Premium 4.00 Build 2031 N.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Internet Kiosk Pro 2.4.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Ipod & Itunes for dummies, 2nd Edition.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\iPod & iTunes for Dummies.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\iPod2PC 2.11.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\iPod2PC v2.11.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\IPViewer 5.04.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\IPVisor Access Control 1.12.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\ISO Commander 1.5.052.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\ISO Commander v1.6.031 RC2.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\ISOpen 4.0.356.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Judgement Day 2004 + 2005 (WWE).zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Justin Timberlake - Justified.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\jv16 PowerTools 2005 1.5.1.306.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\jv16 PowerTools 2005 v1.5.1.306.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\K-Lite Codec Pack 2.53.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\K-Lite Mega Codec Pack 1.37.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Kaspersky Anti-Hacker v1.8.180.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Kaspersky Anti-Virus Personal 2006.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Kaylynn POV Blowjob.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Kelly Erickson [18+].zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Kerio Winroute Firewall 6.1.1 With McAfe.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Kingdia DVD Ripper Pro v2.4.3.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\KoolMoves 5.0.1.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Krystal First Time ######.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Krystal Steal Lesbian Scene [18+].zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Lavalys EVEREST Ultimate Edition v2.20.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\LeapFTP 2.7.6.612.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Limewire Pro 4.8.1.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\LimeWire Pro 4.9.0.1.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\LogiGuard Master Mechanic v1.4.1.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Macromedia Flash Player 8.0.15.0 Beta.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Magic DVD Copier 3.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Magic File Renamer 6.12.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Magic File Renamer v6.12.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\MagicISO Maker 5.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\MakeUp Pilot 1.20.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Making Waves Studio v5.21.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Maximum Wireless Security - Sams.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\McAfee Personal Firewall Plus 7.0.150.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\McAfee Personal Firewall Plus v7.0.150.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\McAfee QuickClean v6.00.7.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\McFunSoft Video Solution 3.2.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\MemoFace 2.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Microsoft Money 2006 FULL New.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Microsoft Office XP.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Microsoft Plus! Digital Media Edition.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Mobile Master 6.0.4.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Mobile Ringtone Converter 2.3.4.32.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Modest Mouse - The Moon & Antarctica.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\MP3 Stream Editor v3.2.2.281.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Mr. & Mrs. Smith.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\MuzicMan 5.1 Build 818.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\MuzicMan v5.1 Build 818.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\My Notes Keeper v1.2.2.428.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\n-Track Studio 4.1 Beta Build 1936.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Nero 6.6.0.16 Enterprise.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Nero Digital Pro v3.1.0.14a New.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Nesox Link Checker 1.00.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Nesox Link Checker v1.00.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\NetSpeeder 3.52.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Nicky Reed ###### and Suck.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\No1 DVD Ripper v1.3.50.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\No1 Video Converter 3.8.13.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Ofilter Player 1.1.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Ofilter Player v1.1.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Opera 8.02.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\OZ JAP PS2 DVD.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Paris Hilton Sex Tape.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Password Saver 2.2.4.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\PCBoost 3.8.15.2005.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Photo Screensaver Maker v4.8.6.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Photoshop CS2.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\pinnacle studio 9.4.3.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Playboy - Carmella DeCesare.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Playboy - In Bathroom.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Pop-Up Stopper Anti-Spyware v5.0.0.1200.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Power MP3 WMA Recorder 1.00.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Power MP3 WMA Recorder v1.00.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Powerdrome.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Prince Buster - Fabulous Greatest Hits.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Pro Evolution Soccer 4 iSO.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Rad Sport Manager Pro 2005 iSO.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Recover My Files v3.73.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\ReGet Deluxe v4.2.263.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Registry Clean Expert 3.64.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Registry Cleaner 32 1.1.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Registry Repair 1.45.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Registry Repair2006 v4.0.1.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Retro Fighter.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\RHEM 2.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\RockIt 200 Professional DJ Software v3.1.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Rolling Stones - Black and Blue.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Ruff Ryders- The Redemption Vol. 4 (2005).zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Sacred.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Search Engine Builder Professional.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Service Record v5.4.8.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Sex 13 min Japanese girl.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Shop Audio Player 1.0.95.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Shop Audio Player v1.0.95.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Sirid Pro v1.22.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Slick View v1.0.013a.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Slysoft AnyDVD 5.4.1.1.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\SmartFTP 1.5.990.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\SmartFTP v1.5.988.50.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\SmartFTP v1.5.990.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\SmartSoft Video Converter v2.1.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Sony ACID Pro v5.0c.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Sony Sound Forge v8.0b.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\SortPics 2.7.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\SortPics v2.7.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\SoundForge 8.0b Build 110.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\SpamEater Pro 4.05.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Sparx Systems Enterprise Architect v5.0.769.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Springboard 0.70.4.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Springboard v0.70.4.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Starship Troopers PC.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Station Ripper 2.23.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Station Ripper v2.23.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Stealth (2005).zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Still Life [PC].zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Street Fighter 2.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Style XP 3.13.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Style XP v3.13 Men + Ladies + Update.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Styler 1.35 + Crack.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Styler 1.35.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Sudeki-Reloaded.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Sudeki.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Super Mario Forever.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Super Utilities 5.3.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Super Utilities 5.4.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\SuperVideoCap 4.19.390.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Surprise Maker 3.3.0.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Suse Linux 10.0 Beta2.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\T72 Balkans on Fire! iSO.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Teleport Pro & Ultra.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Template Monster 6242.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Tennis Masters Series 2003.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\The Bat! 3.60.02 Beta.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\The Bat! 3.60.02.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\The Coral - The Invisible Invasion (2005).zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\The Dukes of Hazzard CAM SVCD.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\The Hitchhiker's Guide to the Galaxy (20.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\The Honeymooners VCD DE.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\The Interpreter DVD Screener XviD.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\The Last Dragon.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\The Palette Melody Composing Tool v3.3.1.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\The PC Detective Pro v2.8.8.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\The Prince and Me.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\The Reckoning LiMiTED DVD Rip XViD.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\The Ring Two.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\The Sixth Sense.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\They came back DVD Rip Xvid.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Toplang Internet Lock v3.0.6.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\TopOCR v1.03.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Ulead DVD MovieFactory 4.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\UltraEdit 11.10b+2.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\UltraEdit-32 11.10b+2.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Unleashed DVD RiP XViD.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\URL Helper 2.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Video Vault 3.0160.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\VirtuaJump v1.00.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\VisKeeper 2.2.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\VisKeeper v2.2.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Visualization Handbook.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\VMware Workstation 5.5 Build 15576.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Wallace&Gromit in Project Zoo.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\War of the Worlds XviD.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\War Of The Worlds.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Warez P2P 2.85 .zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\WavePad.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\WinAVI Video Converter 7.0 Final.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Windows XP Media Center 2005 2CD ISO.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\WinGet 2.1.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\WINner Tweak SE2 3.2.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\WinPatrol PLUS v9.7.0.15.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\WinReminders 2005 v1.7.3.0.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\WinSCP 3.76.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\WWE Wrestling Videos.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Xilisoft Audio Converter v2.0.36.809.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\XP Codec Pack 1.2.4.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\Zealot Software 10 In One.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Cookies\jeff@2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Jeff\Cookies\[removed][1].txt -> Spyware.Cookie.Specificclick : Cleaned with backup
C:\Documents and Settings\Jeff\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jeff\Cookies\jeff@trafficmp[2].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\Program Files\winupdates\a.tmp -> Worm.VB.an : Cleaned with backup
C:\Program Files\winupdates\a.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Program Files\winupdates\winupdates.exe -> Worm.VB.an : Cleaned with backup


::Report End


Logfile of HijackThis v1.99.1
Scan saved at 4:03:41 PM, on 8/27/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\WINDOWS\System32\hphmon04.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Microangelo\muamgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\HPHipm11.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\HIJACK THIS\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;http://localhost;
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SafeGuard Protect PCShield - {564FFB73-9EEF-4969-92FA-5FC4A92E2C2A} - C:\WINDOWS\System32\sfg_69c1.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exe
O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [MOD] C:\Program Files\Microangelo\muamgr.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdccommon/…ad/tgctlins.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://bin.mcafee.com/molbin/shared/mcinsc…76/mcinsctl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://bin.mcafee.com/molbin/shared/mcgdmg…,16/mcgdmgr.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\System32\HPHipm11.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Again,thanks for the help.
Post #4
That was alot. Lets do it again. We need to be sure it's mostly gone.

If you have an "always on" connection to the internet, physically disconnect that connection until you are finished with Safe Mode and have rebooted back into normal mode.

Reboot into Safe Mode, you can do this by restarting your computer, then contiunally tapping F8 until a menu appears. Use your up arrow key to highlight Safe Mode, then hit enter. Then, run ewido.

Close all open windows/programs/folders. Have nothing else open while ewido performs its scan!

Click on scanner
Click on Settings
Under "How to scan" all boxes should be selected
Under "Possibly unwanted software" all boxes should be selected
Under "What to scan" select scan every file
Click OK
Click on Complete system scan
Let the program scan the machine

If ewido finds anything, it will pop up a notification. NOTE: We have been finding some cases of false positives with the new version of Ewido, so we need to step through the fixes one-by-one. If Ewido finds something that you KNOW is legitimate (for example, parts of AVG Antivirus, AOL, pcAnywhere and the game "Risk" have been flagged. In particular, watch for alerts that have the word "Heuristic" in them - if you recognize the file name as "friendly," these may actually be false positives) select "none" as the action. DO NOT check "Perform action with all infections." If you are unsure of an entry, select "none" for the time being. I'll see that in the log you will post later and let you know if ewido needs to be run again.

Once the scan has completed, there will be a button located on the bottom of the screen named Save report.

Click Save report
Save the report to your desktop
Exit ewido


Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.
Post #5
Next run-certainly diminished. No mention though, of the MUGLY.

———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 6:26:43 PM, 8/27/2005
+ Report-Checksum: 550C81ED

+ Scan result:

C:\Documents and Settings\Jeff\Complete\#1 DVD Ripper 1.3.50.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\1Click DVD Copy 4.2.1.5.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\1Click DVD Copy v4.2.1.5.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Complete\2 Beautiful Lesbians.zip/Setup.exe -> Worm.VB.an : Cleaned with backup
C:\Documents and Settings\Jeff\Local Settings\Temporary Internet Files\Content.IE5\4BSPEZOF\cmb_261234[1].exe -> Heuristic.Win32.Dialer : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP3\A0000113.exe -> Worm.VB.an : Cleaned with backup
C:\WINDOWS\SYSTEM32\osmim.dll -> Spyware.MarketScore : Cleaned with backup


::Report End


Logfile of HijackThis v1.99.1
Scan saved at 6:32:38 PM, on 8/27/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\WINDOWS\System32\hphmon04.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Microangelo\muamgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\DSentry.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\HPHipm11.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\HIJACK THIS\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;http://localhost;
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SafeGuard Protect PCShield - {564FFB73-9EEF-4969-92FA-5FC4A92E2C2A} - C:\WINDOWS\System32\sfg_69c1.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exe
O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [MOD] C:\Program Files\Microangelo\muamgr.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdccommon/…ad/tgctlins.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://bin.mcafee.com/molbin/shared/mcinsc…76/mcinsctl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://bin.mcafee.com/molbin/shared/mcgdmg…,16/mcgdmgr.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\System32\HPHipm11.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #6
This virus scan should kill it if you still have it.
http://housecall.trendmicro.com/
allow it to delete whatever is find:


Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.
Post #7
Trend-Micro identified the Worm_MuglyI virus, as per usual. It is undeletable. All else is gone. My computers behavior is … fairly normal, subjectively speaking. I've had issues w/ video playback-herky-jerky, skipping stuff for several months. Dont know if its asociated w//Mugly, generally seen as an Email issue. I am getting odd Emails, but none of the ones tied in with the virus. Peroidically, my screen-saver program sputters when it launches and remains this way. Anyway, you asked. Thought you had the bugger.

Logfile of HijackThis v1.99.1
Scan saved at 10:01:20 PM, on 8/27/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\WINDOWS\System32\hphmon04.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Microangelo\muamgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\HPHipm11.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cidaemon.exe
C:\HIJACK THIS\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;http://localhost;
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SafeGuard Protect PCShield - {564FFB73-9EEF-4969-92FA-5FC4A92E2C2A} - C:\WINDOWS\System32\sfg_69c1.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exe
O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [MOD] C:\Program Files\Microangelo\muamgr.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdccommon/…ad/tgctlins.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://bin.mcafee.com/molbin/shared/mcinsc…76/mcinsctl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://bin.mcafee.com/molbin/shared/mcgdmg…,16/mcgdmgr.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\System32\HPHipm11.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #10
Navigate to and delete the following files if listed.
c:\windows\system32\attached.zip
c:\windows\system32\ANSMTP.DLL (an SMTP engine)
c:\windows\system32\bszip.dll
c:\windows\system32\uglym.jpg
c:\windows\system32\win32.exe


Next:
Backup your Registry… - Press "CTRL - ALT - DEL" keys all at the same time to start "Task Manager"
- In the Task Manager window click on "File", then from the drop-down menu select "New Task (Run…)"
- In the "Create New Task" window enter\type "regedit" (without quotes)
- Once Regedit opens click on the FILE menu and select Export
- Save the file as backup. Save the file somewhere you will remember and not delete.
IMPORTANT: make sure to set the export range to ALL


Next:
Click Start > Run.
Type regedit

Then click OK.


navigate to and delete the following registry entries:

HKEY_CLASSES_ROOT\ANSMTP.MassSender
HKEY_CLASSES_ROOT\ANSMTP.MassSender.1
HKEY_CLASSES_ROOT\ANSMTP.OBJ
HKEY_CLASSES_ROOT\ANSMTP.OBJ.1
HKEY_CLASSES_ROOT\CLSID{253664FB-EDFC-4AC6-BD69-B322F466AEED}
HKEY_CLASSES_ROOT\CLSID{887A577B-406B-48FF-80CB-70752BFCD7B4}
HKEY_CLASSES_ROOT\Interface{1E98666F-6260-42C9-B846-32B20FDEFE7B}
HKEY_CLASSES_ROOT\Interface{68B8DCDB-EFA4-420A-BB8A-71B9892A2063}
HKEY_CLASSES_ROOT\Interface{A5F6C90C-ABE4-4C57-A421-8C5A202AA9F8}
HKEY_CLASSES_ROOT\Interface{B13281CF-8778-4C98-AE23-ABBA4637A33D}
HKEY_CLASSES_ROOT\TypeLib{DE6317F7-6EF0-45C2-88D1-8E09415817F1}


Navigate to the key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
In the right pane, delete the value:

"winprotect" = "win32.exe"


Navigate to the key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
RunServices

In the right pane, delete the value:

"winprotect" = "win32.exe"


Navigate to the key:

HKEY_CURRENT_USER\Software\Microsoft\OLE

In the right pane, delete the value:

"winprotect" = "win32.exe"


Exit the Registry Editor.

Reboot and let me know if it's dead.
Post #11
A new day.Followed your directions:none of the listed files were in system32 file.Cant access system registry w/ just REGEDIT but must use REGEDIT.exe as in my original post.Here is a link to a similar post from another site with many things in common http://forums.spywareinfo.com/lofiversion/…/t48320.html.My message reads as follows:The NTVDM CPU has encountered an illegal instruction. CS:0564 IP: fff0 OP:fe ld 09 30. Choose "close \" to terminate operation. While in the registry I found none of the entries you suggested. RUN SERVICES and OLE were not listed as selection options in the navigator. Did another house call-no viruses were detected!!!!Now just the issue of the registry. I can certainly live with the the current limits. What caused this ,any ideas? Any suggestions for the future?
Post #12
RegCleaner Download Now! (540KB) Jouni Vuoro Software

Description: RegCleaner is an easy to use program. With RegCleaner you can easily get rid of those old and obsolete registry entries created by software that you have destroyed ages ago. And by easily, I mean easily. You don´t have to be any expert to use this program.


Here's how it goes:
  • Download and install it.
  • Click on the RegCleanr.exe
  • Tools (at the top) > Registry Cleanup > Do Them All
  • Then 'Select' (at top left) > choose ALL
    'Remove Selected" (at bottom right)
  • A backup of all that was removed will be made, just choose 'Backups' (top right) to view them, you can delete them when you're confident they're no longer needed.
Direct download:
Here
AlsoHere
Post #13
Did the Reg-Cleaner. Pretty snappy program. Rid myself of 112 useless entrys. However, I still get the same message: The NTVDM CPU has encountered an illegal instruction. CS:0564 IP: fff0 OP:fe ld 09 30. Choose "close" to terminate operation when I type in REGEDIT. What next?
Post #14
You can use windows sfc (system file checker) You'd need your XP CD to make this work.
Click Start> Run> type sfc /scannow Note the space.
(Note that there is a space between sfc and /scannow)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI