This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

please reveiw log and advise

19 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Logfile of HijackThis v1.99.1
Scan saved at 1:59:02 PM, on 2/14/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust Antivirus\InoRT.exe
C:\Program Files\CA\eTrust Antivirus\InoTask.exe
C:\PROGRA~1\CA\SHARED~1\SCANEN~1\InoDist.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Director\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.christodora.org/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dmmbe.exe] C:\WINDOWS\system32\dmmbe.exe
O4 - HKCU\..\Run: [UnSpyPC] "C:\Program Files\UnSpyPC\UnSpyPC.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: officejet 6100.lnk = ?
O4 - Global Startup: Wireless-G Notebook Adapter.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Scan and protect your PC - {BF69DF00-4734-477F-8257-27CD04F88779} - C:\Program Files\UnSpyPC\UnSpyPC.exe (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Scan and protect your PC - {BF69DF00-4734-477F-8257-27CD04F88779} - C:\Program Files\UnSpyPC\UnSpyPC.exe (file missing) (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1138291687621
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2492CCDF-A03C-4BD0-A256-69D163F6C414}: NameServer = 85.255.114.60,85.255.112.89
O17 - HKLM\System\CS1\Services\Tcpip\..\{2492CCDF-A03C-4BD0-A256-69D163F6C414}: NameServer = 85.255.114.60,85.255.112.89
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
You may want to print out these instructions for reference, since you will have to restart your computer during the fix.

Go to add/remove programs and remove UnSpyPC if present

Please download FixWareout from one of these sites:
http://downloads.subratam.org/Fixwareout.exe
http://swandog46.geekstogo.com/Fixwareout.exe

Save it to your desktop and run it. Click Next, then Install, then make sure "Run fixit" is checked and click Finish. The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal.

When your system reboots, follow the prompts. Afterwards, HijackThis will launch. Please click Scan, and check the following items (if they appear):


O4 - HKLM\..\Run: [dmmbe.exe] C:\WINDOWS\system32\dmmbe.exe
O4 - HKCU\..\Run: [UnSpyPC] "C:\Program Files\UnSpyPC\UnSpyPC.exe"

O17 - HKLM\System\CCS\Services\Tcpip\..\{2492CCDF-A03C-4BD0-A256-69D163F6C414}: NameServer = 85.255.114.60,85.255.112.89
O17 - HKLM\System\CS1\Services\Tcpip\..\{2492CCDF-A03C-4BD0-A256-69D163F6C414}: NameServer = 85.255.114.60,85.255.112.89


If you see a new item that wasn't in your last log in the O4 section of HijackThis, five-letters long, starting with dm… for example:
O4 - HKLM\..\Run: [dm***.exe] C:\WINDOWS\system32\dm***.exe (the *** stand for random letters)
or starting with hg***.exe for example:
O4 - HKLM\..\Run: [hg***.exe] C:\Windows\System32\hg***.exe
or starting with cs***.exe for example:
O4 - HKLM\..\Run: [cscyd.exe] cscyd.exe
Check it as well. If you're not sure, leave it and only check the ones I asked you to check.


Then click Fix Checked. Close HijackThis, and click OK to proceed.

At the end of the fix, you may need to restart your computer again.

Finally, please post the contents of the logfile C:\fixwareout\report.txt, along with a new HijackThis log.
Here are the logs of Fixer and HJT:

HJT:
Logfile of HijackThis v1.99.1
Scan saved at 2:09:24 PM, on 2/16/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust Antivirus\InoRT.exe
C:\Program Files\CA\eTrust Antivirus\InoTask.exe
C:\PROGRA~1\CA\SHARED~1\SCANEN~1\InoDist.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Documents and Settings\Director\Desktop\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: officejet 6100.lnk = ?
O4 - Global Startup: Wireless-G Notebook Adapter.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1138291687621
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

Fixwareout log:
Fixwareout ver 1.003
Last edited 2/15/2006
Post this report in the forums please

Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\wbzmd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\xedocne
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\gib_ogol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\repiwoh
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llun
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\23plhps
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\mgcppp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\tesvaf
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\golmedi
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\32refaselif
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\putesprpgd
…

Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dmzbw.exe"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
…

PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.

»»»»» Search by size and names…
C:\WINDOWS\SYSTEM32\DMZBW.EXE
C:\WINDOWS\SYSTEM32\IPSEC6.EXE

»»»»» Misc files

»»»»» Checking for older varients covered by the Rem3 tool
Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/

Install it, and update the definitions to the newest files.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

Then please run Ewido, and run a full scan. Save the logfile from the scan.

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.
Seems we are making progress. Ewido found and encrypted/quarantined two more items. Here is the latest HJT log but I could not find anything called a "log" for the Ewido results. I'll just say it caught something called TrackingCookie.Tacoda and something else called TrojanDNSChanger.aw.
If more is needed from the Ewido results please let me know how. Also should I "remove finally" with Ewido?
Thanks,
Mike

Logfile of HijackThis v1.99.1
Scan saved at 6:18:35 PM, on 2/16/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust Antivirus\InoRT.exe
C:\Program Files\CA\eTrust Antivirus\InoTask.exe
C:\PROGRA~1\CA\SHARED~1\SCANEN~1\InoDist.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Documents and Settings\Director\Desktop\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: officejet 6100.lnk = ?
O4 - Global Startup: Wireless-G Notebook Adapter.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1138291687621
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
Remove finally? If you are asking should you allow it to celete anything bad then yes, if you are asking if you can remove ewido from your system that also is a yes as it looks clean. How is it running?
"Remove Finally" is a button of the Quaratine section of Ewido. It took the two bit of malware, encrypted and quaratined them. So I'm guessing "remove finally" means it gets rid of them completely. The browser seems to be back to normal (though it did delete my selected homepage.) There are also a few unremovable browser pages in the memory. As in, when I start to type a page in manually, some old ones that I never chose are given as choices.
I'm just astounded that each step in this process is getting something new or different. For the past few days it is the only thing I have been doing with this computer besides email (web based and Outlook). I have noticed that there are two updates for Windows that are failing to download. I looked on line and found I was not the only person having this specific problem. I'm wondering if the inability of these patches to download is causing a security breach.
The two are:
-Security Update for Outlook 2003 (KB892843)
-Update for Outlook 2003 Junk Email Filter (KB911961)

Here is my latest HJT log after upgrading and running Spy Bot S&D, and Ad-AWare SE

Logfile of HijackThis v1.99.1
Scan saved at 3:39:30 PM, on 2/19/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust Antivirus\InoRT.exe
C:\Program Files\CA\eTrust Antivirus\InoTask.exe
C:\PROGRA~1\CA\SHARED~1\SCANEN~1\InoDist.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\msiexec.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Director\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.christodora.org/
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: officejet 6100.lnk = ?
O4 - Global Startup: Wireless-G Notebook Adapter.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1138291687621
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
Scan with hijackthis and put a check beside these lines and choose FIX F2 - REG:system.ini: UserInit=userinit.exe Then reboot and a new log please. How is it after the reboot?
Latest log to review

Logfile of HijackThis v1.99.1
Scan saved at 6:51:54 PM, on 2/20/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust Antivirus\InoRT.exe
C:\Program Files\CA\eTrust Antivirus\InoTask.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\CA\SHARED~1\SCANEN~1\InoDist.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Director\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.christodora.org/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: officejet 6100.lnk = ?
O4 - Global Startup: Wireless-G Notebook Adapter.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1138291687621
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
Hmmmmm

Please download hoster from the link below.

http://www.funkytoad.com/download/hoster.zip

Open Hoster.exe.

Then click on "Restore Original Hosts"

Close program when complete.

NEXT

Please do an online scan with Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then start to download the latest definition files.
  • Once the scanner is installed and the definitions downloaded, click Next.
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
      • Extended (If available otherwise Standard)
    • Scan Options:
      • Scan Archives
      • Scan Mail Bases
  • Click OK
  • Now under select a target to scan select My Computer
  • The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post as well as a bew hijackthis log please.
As recommended, I did the Kaspersky Scan and here are the results. I notice the majority of the entries were found in Norton Anti Virus Quarantine files. I also did not notice a follow-up command to correct any of the problems found: no "fix" buttons. Anyhow, here are the logs for Kaspersky and HJT. Its kind of long. (P.S. It was good to see you misspell the word "new" bew in the last message. I was beginning to think you might just be a clever response program and not a person;-) But do you ever sleep? I didn't expect responses on the weekend.) ——————————————————————————- KASPERSKY ON-LINE SCANNER REPORT Tuesday, February 21, 2006 12:27:25 Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky On-line Scanner version: 5.0.67.0 Kaspersky Anti-Virus database last update: 21/02/2006 Kaspersky Anti-Virus database records: 177951 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ Scan Statistics: Total number of scanned objects: 50961 Number of viruses found: 34 Number of infected objects: 500 Number of suspicious objects: 246 Duration of the scan process: 5449 sec Infected Object Name - Virus Name C:\Documents and Settings\Director\.housecall\Quarantine\1.dat.bac_a01080 Infected: Trojan-Downloader.Win32.Small.awa C:\Documents and Settings\Director\.housecall\Quarantine\csdvn.exe.bac_a01080 Infected: Trojan-Downloader.Win32.Agent.uj C:\Documents and Settings\Director\.housecall\Quarantine\dgprpsetup.exe.bac_a01080 Infected: Trojan-Downloader.Win32.Agent.sy C:\Documents and Settings\Director\.housecall\Quarantine\favset.exe.bac_a01080 Infected: Trojan.Win32.Favadd.an C:\Documents and Settings\Director\.housecall\Quarantine\howiper.exe.bac_a01080 Infected: Trojan.Win32.Small.gq C:\Documents and Settings\Director\.housecall\Quarantine\popcorn72.exe.bac_a01080 Infected: Trojan-Downloader.Win32.Agent.sy C:\Documents and Settings\Director\.housecall\Quarantine\winctrl64.exe.bac_a01080 Infected: Trojan-Downloader.Win32.Small.awa C:\Program Files\Norton AntiVirus\Quarantine\00402FEF Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\00833282.class Infected: Trojan.Java.ClassLoader.Dummy.e C:\Program Files\Norton AntiVirus\Quarantine\00865C7E.class Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\00A40EBB.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\00A625F7 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\00F27E65.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\00FF1F0C Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\013014D6/[From [removed]][Date Tue, 14 Dec 2004 18:28:57 -0500]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\013014D6/[From [removed]][Date Tue, 14 Dec 2004 18:28:57 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\013014D6 Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\01E82BEA.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\02636D39/qfqdktjts.exe Suspicious: Password-protected-EXE C:\Program Files\Norton AntiVirus\Quarantine\02636D39 Suspicious: Password-protected-EXE C:\Program Files\Norton AntiVirus\Quarantine\02F654DA Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0347683D/details.txt .pif Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\0347683D Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\039F55DC Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\03B027CA/[From [removed]][Date Sun, 25 Jul 2004 22:30:58 -0500]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\03B027CA/[From [removed]][Date Sun, 25 Jul 2004 22:30:58 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\03B027CA Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\049F0864 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\04E1501C/[From [removed]][Date Tue, 9 Nov 2004 08:11:06 -0800]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\04E1501C/[From [removed]][Date Tue, 9 Nov 2004 08:11:06 -0800]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\04E1501C Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\06037B65.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\065C3959/instruction.pif Infected: Email-Worm.Win32.Mydoom.m C:\Program Files\Norton AntiVirus\Quarantine\065C3959 Infected: Email-Worm.Win32.Mydoom.m C:\Program Files\Norton AntiVirus\Quarantine\07545FF3.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\078B29B6.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\07D9195F.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\080E3926.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\087D297B Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\0897795E/[From [removed]][Date Thu, 3 Mar 2005 13:14:55 -0600]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\0897795E/[From [removed]][Date Thu, 3 Mar 2005 13:14:55 -0600]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\0897795E Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\08BE1815.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\0963786C Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\09A11627/[From [removed]][Date Wed, 8 Dec 2004 23:08:36 -0800]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\09A11627/[From [removed]][Date Wed, 8 Dec 2004 23:08:36 -0800]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\09A11627 Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\09B36156.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\09FF4DE9 Infected: Email-Worm.Win32.Bagle.y C:\Program Files\Norton AntiVirus\Quarantine\0A1626D6 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0A593E9F.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\0A676A41.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\0ABD2585/document.txt .exe Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\0ABD2585 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\0AD67DC7.exe Infected: Trojan-Downloader.Win32.Donn.aa C:\Program Files\Norton AntiVirus\Quarantine\0B6550E6.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\0B6A75E6 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0B914E9C Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\0BB85607/rcowq.doc .exe Infected: Email-Worm.Win32.Mydoom.a C:\Program Files\Norton AntiVirus\Quarantine\0BB85607 Infected: Email-Worm.Win32.Mydoom.a C:\Program Files\Norton AntiVirus\Quarantine\0BD06BEE Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0BF673C3 Infected: Email-Worm.Win32.Mydoom.a C:\Program Files\Norton AntiVirus\Quarantine\0BF90E29 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\0C1C6460.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\0C3661F6 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0C7F4795/data.rtf .scr Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\0C7F4795 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\0C884A39.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\0CD1613B Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\0CDA63DF.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\0D112DA2.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\0D921EE5 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\0D9E45F0/test.htm .scr Infected: Email-Worm.Win32.Mydoom.a C:\Program Files\Norton AntiVirus\Quarantine\0D9E45F0 Infected: Email-Worm.Win32.Mydoom.a C:\Program Files\Norton AntiVirus\Quarantine\0DD504CA.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\0DED359A/qlwso.pif Infected: Email-Worm.Win32.Mydoom.a C:\Program Files\Norton AntiVirus\Quarantine\0DED359A Infected: Email-Worm.Win32.Mydoom.a C:\Program Files\Norton AntiVirus\Quarantine\0EA0618C Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0EA30B89 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0EA73585 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0EAA5F81 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0EB0337A Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0EB45D77 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0EB70773 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0EBA316F Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0EBE5B6C Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0EC10568 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0EC42F65 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0EC56A90 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\0EC75961 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0ECB035D Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0ECE2D5A Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0ED15756 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0ED40153 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0ED82B4F Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0EDB554B Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0EDE7F48 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0EE12944 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0EE55341 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0EE87D3D Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0EEB2739 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0EEF5136 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0EF27B32 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0EF5252F Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0EF84F2B Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0EFC7928 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0EFF2324 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0F024D20 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0F0525FC Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\0F05771D Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0F092119 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0F0A5C44/[From [removed]][Date Fri, 4 Mar 2005 09:47:02 -0600]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\0F0A5C44/[From [removed]][Date Fri, 4 Mar 2005 09:47:02 -0600]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\0F0A5C44 Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\0F0C4B16 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0F0D2544 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\0F0F7512 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0F121F0E Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0F16490B Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0F197307 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0F1C1D04 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0F1F4700 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\0F2370FC Infected: Virus.MSWord.Ethan C:\Program Files\Norton AntiVirus\Quarantine\0F7564D1 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\0F7E5AA8.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\0F923361/[From [removed]][Date Mon, 7 Mar 2005 08:47:05 -0600]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\0F923361/[From [removed]][Date Mon, 7 Mar 2005 08:47:05 -0600]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\0F923361 Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\0FDE245E Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\108D73CD.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\108E7F9C Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\10E66D3B Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\114A76FC.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\11C95C70.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\12071999.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\122F2CEC.htm Suspicious: Exploit.HTML.Mht C:\Program Files\Norton AntiVirus\Quarantine\12A7037C.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\12E97435.class Infected: Trojan.Java.ClassLoader.Dummy.d C:\Program Files\Norton AntiVirus\Quarantine\131A58B3.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\13F61A85 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\13FC086D Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\140A1670/[From [removed]][Date Fri, 11 Mar 2005 10:12:09 -0600]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\140A1670/[From [removed]][Date Fri, 11 Mar 2005 10:12:09 -0600]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\140A1670 Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\141C2C49/[From [removed]][Date Sun, 25 Jul 2004 22:30:58 -0500]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\141C2C49/[From [removed]][Date Sun, 25 Jul 2004 22:30:58 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\141C2C49 Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\143359A5 Infected: Email-Worm.Win32.Klez.h C:\Program Files\Norton AntiVirus\Quarantine\143F2328.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\14A51727 Infected: Email-Worm.Win32.Klez.h C:\Program Files\Norton AntiVirus\Quarantine\14F306D1 Infected: Email-Worm.Win32.Klez.h C:\Program Files\Norton AntiVirus\Quarantine\153B2282 Infected: Email-Worm.Win32.Klez.h C:\Program Files\Norton AntiVirus\Quarantine\157C6C5E.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\158D3C28 Infected: Email-Worm.Win32.Klez.h C:\Program Files\Norton AntiVirus\Quarantine\15C37589 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\15E06E3D Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\15EA6D5E/[From [removed]][Date Tue, 15 Feb 2005 19:08:21 -0600]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\15EA6D5E/[From [removed]][Date Tue, 15 Feb 2005 19:08:21 -0600]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\15EA6D5E Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\1632090F Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\16385D07/[From [removed]][Date Wed, 16 Feb 2005 09:25:01 -0600]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\16385D07/[From [removed]][Date Wed, 16 Feb 2005 09:25:01 -0600]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\16385D07 Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\16FB31E5 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\170227C2/document.txt .exe Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\170227C2 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\17383D2D Infected: Email-Worm.Win32.Bagle.y C:\Program Files\Norton AntiVirus\Quarantine\17595E51.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\176127ED Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\17C21DDE.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\17C71DF4 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\18006F34 Infected: Email-Worm.Win32.Sobig.e C:\Program Files\Norton AntiVirus\Quarantine\188C48FF.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\18B4588A.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\19502691 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\1974746A/[From [removed]][Date Wed, 2 Feb 2005 17:39:59 -0500]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\1974746A/[From [removed]][Date Wed, 2 Feb 2005 17:39:59 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\1974746A Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\199B3018.class Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\19F903FC Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\1A8963A9 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\1ADE2A2A.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\1AE61323 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\1B145EF0/[From [removed]][Date Fri, 28 Jan 2005 22:00:44 -0500]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\1B145EF0/[From [removed]][Date Fri, 28 Jan 2005 22:00:44 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\1B145EF0 Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\1B5571FC Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\1B5D4BEF Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\1B7A45CF/[From [removed]][Date Thu, 17 Feb 2005 21:21:58 -0600]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\1B7A45CF/[From [removed]][Date Thu, 17 Feb 2005 21:21:58 -0600]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\1B7A45CF Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\1B7F13CD/[From [removed]][Date Tue, 15 Feb 2005 09:49:22 -0600]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\1B7F13CD/[From [removed]][Date Tue, 15 Feb 2005 09:49:22 -0600]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\1B7F13CD Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\1B9240E0 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\1BAF3ABF/[From [removed]][Date Sun, 13 Feb 2005 13:54:08 -0600]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\1BAF3ABF/[From [removed]][Date Sun, 13 Feb 2005 13:54:08 -0600]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\1BAF3ABF Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\1BBE761D/body.txt .scr Infected: Email-Worm.Win32.Mydoom.a C:\Program Files\Norton AntiVirus\Quarantine\1BBE761D Infected: Email-Worm.Win32.Mydoom.a C:\Program Files\Norton AntiVirus\Quarantine\1CC2779F.htm Infected: Trojan.JS.Seeker C:\Program Files\Norton AntiVirus\Quarantine\1D1C63D6 Infected: Email-Worm.Win32.Klez.h C:\Program Files\Norton AntiVirus\Quarantine\1D1D60CF.class Infected: Trojan.Java.ClassLoader.f C:\Program Files\Norton AntiVirus\Quarantine\1D9A3F21.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\1DAB39FF/file.scr Infected: Email-Worm.Win32.Mydoom.a C:\Program Files\Norton AntiVirus\Quarantine\1DAB39FF Infected: Email-Worm.Win32.Mydoom.a C:\Program Files\Norton AntiVirus\Quarantine\1E877345.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\1E917DCB Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\1EBA1EF3 Infected: Email-Worm.Win32.Klez.h C:\Program Files\Norton AntiVirus\Quarantine\1ED238F2.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\1EDF57C9.htm Suspicious: Exploit.HTML.Mht C:\Program Files\Norton AntiVirus\Quarantine\1EED50C8 Infected: Email-Worm.Win32.Klez.h C:\Program Files\Norton AntiVirus\Quarantine\1EF93D58/[From [removed]][Date Fri, 25 Feb 2005 08:16:46 -0600]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\1EF93D58/[From [removed]][Date Fri, 25 Feb 2005 08:16:46 -0600]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\1EF93D58 Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\1F6946AF Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\1FA43A6E/[From [removed]][Date Mon, 7 Feb 2005 11:17:20 -0500]/UNNAMED/[From [removed]][Date Mon, 7 Feb 2005 11:15:30 -0500]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\1FA43A6E/[From [removed]][Date Mon, 7 Feb 2005 11:17:20 -0500]/UNNAMED/[From [removed]][Date Mon, 7 Feb 2005 11:15:30 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\1FA43A6E/[From [removed]][Date Mon, 7 Feb 2005 11:17:20 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\1FA43A6E Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\20203859.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\2063432E Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\20EB637B.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\21E37DAF.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\228B6DE4 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\22F163EB Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\23483369 Infected: Email-Worm.Win32.Bagle.gen C:\Program Files\Norton AntiVirus\Quarantine\235759F3 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\23BD4FFA Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\23C04C5D.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\23D04CE8 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\24046CAF/[From [removed]][Date Fri, 31 Dec 2004 22:00:27 -0500]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\24046CAF/[From [removed]][Date Fri, 31 Dec 2004 22:00:27 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\24046CAF Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\241839FC.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\24201235 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\2421668F Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\242B6484/[From [removed]][Date Sat, 1 Jan 2005 18:11:28 -0500]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\242B6484/[From [removed]][Date Sat, 1 Jan 2005 18:11:28 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\242B6484 Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\24380C75 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\24420A6B/[From [removed]][Date Sun, 2 Jan 2005 16:22:31 -0500]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\24420A6B/[From [removed]][Date Sun, 2 Jan 2005 16:22:31 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\24420A6B Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\25135AE7.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\25A94201 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\25CA65DD/[From [removed]][Date Mon, 21 Feb 2005 16:00:52 -0500]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\25CA65DD/[From [removed]][Date Mon, 21 Feb 2005 16:00:52 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\25CA65DD Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\262A2132 Infected: Email-Worm.Win32.Klez.h C:\Program Files\Norton AntiVirus\Quarantine\26431B99.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\26D648DF Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\26E43B7A Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\26FE1BED Infected: Email-Worm.Win32.Klez.h C:\Program Files\Norton AntiVirus\Quarantine\273B5E6F Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\27402ED5.class Infected: Trojan.Java.ClassLoader.Dummy.d C:\Program Files\Norton AntiVirus\Quarantine\276320EE/[From [removed]][Date Sat, 8 Jan 2005 16:58:44 -0500]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\276320EE/[From [removed]][Date Sat, 8 Jan 2005 16:58:44 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\276320EE Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\27A72333 Infected: Email-Worm.Win32.Klez.h C:\Program Files\Norton AntiVirus\Quarantine\27B11098 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\27BB0E8D/[From [removed]][Date Sun, 9 Jan 2005 10:02:21 -0800]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\27BB0E8D/[From [removed]][Date Sun, 9 Jan 2005 10:02:21 -0800]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\27BB0E8D Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\27C367AB Infected: Email-Worm.Win32.Sircam.c C:\Program Files\Norton AntiVirus\Quarantine\27E20662 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\27E24CC9/ieesxu.txt .scr Infected: Email-Worm.Win32.Mydoom.m C:\Program Files\Norton AntiVirus\Quarantine\27E24CC9 Infected: Email-Worm.Win32.Mydoom.m C:\Program Files\Norton AntiVirus\Quarantine\27EC0457/[From [removed]][Date Sun, 9 Jan 2005 15:06:14 -0500]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\27EC0457/[From [removed]][Date Sun, 9 Jan 2005 15:06:14 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\27EC0457 Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\2824107B.htm Suspicious: Exploit.HTML.Mht C:\Program Files\Norton AntiVirus\Quarantine\28277817 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\2831760C/[From [removed]][Date Mon, 10 Jan 2005 15:00:20 -0500]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\2831760C/[From [removed]][Date Mon, 10 Jan 2005 15:00:20 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\2831760C Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\28453457.htm Suspicious: Exploit.HTML.Mht C:\Program Files\Norton AntiVirus\Quarantine\28690230.htm Suspicious: Exploit.HTML.Mht C:\Program Files\Norton AntiVirus\Quarantine\28AA49E8.htm Suspicious: Exploit.HTML.Mht C:\Program Files\Norton AntiVirus\Quarantine\28C907A1 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\29405542.htm Suspicious: Exploit.HTML.Mht C:\Program Files\Norton AntiVirus\Quarantine\29820EF1 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\299B6CDE.htm Suspicious: Exploit.HTML.Mht C:\Program Files\Norton AntiVirus\Quarantine\29AA06C6/[From [removed]][Date Thu, 17 Feb 2005 13:14:46 -0600]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\29AA06C6/[From [removed]][Date Thu, 17 Feb 2005 13:14:46 -0600]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\29AA06C6 Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\2A360565 Infected: Email-Worm.Win32.Plexus.d C:\Program Files\Norton AntiVirus\Quarantine\2A3753D1.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\2B0A0107 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\2B2126EE/[From [removed]][Date Mon, 7 Feb 2005 13:05:53 -0500]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\2B2126EE/[From [removed]][Date Mon, 7 Feb 2005 13:05:53 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\2B2126EE Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\2B636EA6 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\2BC069ED/file.scr Infected: Email-Worm.Win32.Mydoom.a C:\Program Files\Norton AntiVirus\Quarantine\2BC069ED Infected: Email-Worm.Win32.Mydoom.a C:\Program Files\Norton AntiVirus\Quarantine\2C121428.htm Suspicious: Exploit.HTML.Mht C:\Program Files\Norton AntiVirus\Quarantine\2C38139D.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\2DA923E7 Infected: Email-Worm.Win32.Klez.h C:\Program Files\Norton AntiVirus\Quarantine\2E1B29E2 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\2E811FEA Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\2EE815F1 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\2F00548E.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\2F4E0BF9 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\30187488 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\303F6C5D/[From [removed]][Date Sun, 20 Feb 2005 14:24:36 -0600]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\303F6C5D/[From [removed]][Date Sun, 20 Feb 2005 14:24:36 -0600]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\303F6C5D Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\30C0007D Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\30E44E55/[From [removed]][Date Sun, 25 Jul 2004 18:29:27 -0500]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\30E44E55/[From [removed]][Date Sun, 25 Jul 2004 18:29:27 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\30E44E55 Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\312F1403 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\313911F8/[From [removed]][Date Mon, 26 Jul 2004 09:31:10 -0400]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\313911F8/[From [removed]][Date Mon, 26 Jul 2004 09:31:10 -0400]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\313911F8 Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\318B7F23.class Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\321318A0.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\32374D87 Infected: Email-Worm.Win32.Klez.h C:\Program Files\Norton AntiVirus\Quarantine\3261362D Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\32696521 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\32833504/[From [removed]][Date Mon, 3 Jan 2005 14:14:34 -0500]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\32833504/[From [removed]][Date Mon, 3 Jan 2005 14:14:34 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\32833504 Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\32DC07F8 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\32F657DB/[From [removed]][Date Tue, 8 Mar 2005 12:56:53 -0600]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\32F657DB/[From [removed]][Date Tue, 8 Mar 2005 12:56:53 -0600]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\32F657DB Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\33343C37 Infected: Email-Worm.Win32.Klez.h C:\Program Files\Norton AntiVirus\Quarantine\335D14B3 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\34A747FC Infected: Email-Worm.Win32.Klez.h C:\Program Files\Norton AntiVirus\Quarantine\35C02C78 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\36051522.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\370A2B98 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\375E6B58.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\381C03DF/[From [removed]][Date Mon, 24 Jan 2005 14:05:56 -0500]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\381C03DF/[From [removed]][Date Mon, 24 Jan 2005 14:05:56 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\381C03DF Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\385D4B97 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\38AC3B41 Infected: Email-Worm.Win32.Bagle.y C:\Program Files\Norton AntiVirus\Quarantine\390D117E.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\39A62CD4.class Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\39AC65E1 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\39AF683F.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\3A081C07 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\3A125BE9 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\3A3B2E1C Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\3A7851F0 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\3ABC37A4.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\3B206F87 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\3B280ACA/[From [removed]][Date Thu, 27 Jan 2005 13:50:28 -0500]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\3B280ACA/[From [removed]][Date Thu, 27 Jan 2005 13:50:28 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\3B280ACA Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\3B37156E/[From [removed]][Date Tue, 22 Feb 2005 09:57:58 -0600]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\3B37156E/[From [removed]][Date Tue, 22 Feb 2005 09:57:58 -0600]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\3B37156E Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\3B9631EC Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\3BEB758E Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\3BEE5B85 Infected: Email-Worm.Win32.Klez.h C:\Program Files\Norton AntiVirus\Quarantine\3C306743 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\3C5B1730 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\3C6E04FE Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\3CB620AF Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\3CF43E6B Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\3D69049D/[From [removed]][Date Sat, 12 Mar 2005 12:03:11 -0600]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\3D69049D/[From [removed]][Date Sat, 12 Mar 2005 12:03:11 -0600]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\3D69049D Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\3D690EB0.class Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\3D7A77D8 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\3DB16B88.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\3DC53D85 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\3DD24E3D.exe Infected: Trojan.Win32.StartPage.y C:\Program Files\Norton AntiVirus\Quarantine\3E0F61E5 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\3E1635DE/[From [removed]][Date Sun, 13 Mar 2005 02:31:25 -0600]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\3E1635DE/[From [removed]][Date Sun, 13 Mar 2005 02:31:25 -0600]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\3E1635DE Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\3E4422F9 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\3E6D7829 Infected: Email-Worm.Win32.Klez.h C:\Program Files\Norton AntiVirus\Quarantine\3F0553AC Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\3F810F24 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\40877CDC Infected: Email-Worm.Win32.Bagle.gen C:\Program Files\Norton AntiVirus\Quarantine\40B32C1E Infected: Email-Worm.Win32.Klez.h C:\Program Files\Norton AntiVirus\Quarantine\40C334F4 Infected: Email-Worm.Win32.Bagle.y C:\Program Files\Norton AntiVirus\Quarantine\40F17BD4 Infected: Email-Worm.Win32.Plexus.d C:\Program Files\Norton AntiVirus\Quarantine\41717D01 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\417C5AE1 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\41A7275D/[From [removed]][Date Wed, 26 Jan 2005 12:45:49 -0500]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\41A7275D/[From [removed]][Date Wed, 26 Jan 2005 12:45:49 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\41A7275D Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\41AD3F99/data.rtf .scr Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\41AD3F99 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\41E355C3 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\41E76480 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\4204799F/[From [removed]][Date Tue, 11 Jan 2005 11:00:37 -0800]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\4204799F/[From [removed]][Date Tue, 11 Jan 2005 11:00:37 -0800]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\4204799F Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\420F3C40 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\42151038/[From [removed]][Date Thu, 10 Feb 2005 20:26:49 -0600]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\42151038/[From [removed]][Date Thu, 10 Feb 2005 20:26:49 -0600]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\42151038 Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\42167F26 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\42265114/[From [removed]][Date Thu, 22 Jul 2004 09:35:54 -0400]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\42265114/[From [removed]][Date Thu, 22 Jul 2004 09:35:54 -0400]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\42265114 Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\428443D4 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\42D37300 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\443D42EC Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\446E6989 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\447262B3/[From [removed]][Date Wed, 5 Jan 2005 15:19:00 -0500]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\447262B3/[From [removed]][Date Wed, 5 Jan 2005 15:19:00 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\447262B3 Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\44990B5A/[From [removed]][Date Mon, 28 Feb 2005 09:17:23 -0600]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\44990B5A/[From [removed]][Date Mon, 28 Feb 2005 09:17:23 -0600]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\44990B5A Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\453C21E0 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\454B4F90 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\45A217E7 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\45AB3CEC Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\45E630AB/[From [removed]][Date Sat, 29 Jan 2005 18:49:36 -0500]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\45E630AB/[From [removed]][Date Sat, 29 Jan 2005 18:49:36 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\45E630AB Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\46080DEF Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\466E03F6 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\496B077E.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\49E8624F Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\49F444FC Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\4A162E1C/[From [removed]][Date Fri, 21 Jan 2005 15:55:03 -0500]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\4A162E1C/[From [removed]][Date Fri, 21 Jan 2005 15:55:03 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\4A162E1C Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\4BA73107.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\4C6A5ED7.htm Suspicious: Exploit.HTML.Mht C:\Program Files\Norton AntiVirus\Quarantine\4C887E4B Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\4C9B7A36/[From [removed]][Date Mon, 7 Mar 2005 11:38:02 -0600]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\4C9B7A36/[From [removed]][Date Mon, 7 Mar 2005 11:38:02 -0600]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\4C9B7A36 Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\4CCA5040 Infected: Email-Worm.Win32.Klez.h C:\Program Files\Norton AntiVirus\Quarantine\4D12037F.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\4D5D492C.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\4D7A6583 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\4D7E6550.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\4DDD5E0A.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\4DFA71C6 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\4EBB0F43.doc Infected: Virus.MSWord.Wazzu C:\Program Files\Norton AntiVirus\Quarantine\4EEB2D6F.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\4F5B0295 Infected: Email-Worm.Win32.Klez.h C:\Program Files\Norton AntiVirus\Quarantine\4F6B6A81 Infected: Virus.MSWord.Wazzu C:\Program Files\Norton AntiVirus\Quarantine\4F896461 Infected: Virus.MSWord.Wazzu C:\Program Files\Norton AntiVirus\Quarantine\4FA33444 Infected: Virus.MSWord.Wazzu C:\Program Files\Norton AntiVirus\Quarantine\4FAD6D24/details.txt .pif Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\4FAD6D24 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\4FCA2C19 Infected: Virus.MSWord.Wazzu C:\Program Files\Norton AntiVirus\Quarantine\4FE15200 Infected: Virus.MSWord.Wazzu C:\Program Files\Norton AntiVirus\Quarantine\4FFB21E3 Infected: Virus.MSWord.Wazzu C:\Program Files\Norton AntiVirus\Quarantine\501155C1 Infected: Email-Worm.Win32.NetSky.q C:\Program Files\Norton AntiVirus\Quarantine\501E5591.exe Infected: not-a-virus:AdWare.Win32.MadFinder C:\Program Files\Norton AntiVirus\Quarantine\50A4371F/[From [removed]][Date Mon, 31 Jan 2005 15:38:45 -0600]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\50A4371F/[From [removed]][Date Mon, 31 Jan 2005 15:38:45 -0600]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\50A4371F Suspicious: Exploit.HTML.Iframe.FileDownload C:\Program Files\Norton AntiVirus\Quarantine\513253E6 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\519949ED Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\51FF3FF5 Infected: Virus.MSWord.Marker.fq2 C:\Program Files\Norton AntiVirus\Quarantine\52634F07 Infected: Email-Worm.Win32.Klez.h C:\Program Files\Norton AntiVirus\Quarantine\52B013DF.exe Infected: not-a-virus:AdWare.Win32.MadFinder<

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI