Spyware / Malware / Virus Removal

Spyware and Viruses?

117 min read

Looking for the outcome? Ask AI

poporacer Topic Starter

Post #1April 25, 2006, 5:24 AM UTC

I am trying to fix a friends computer, I think he has major viruses/and or spyware. When you start the computer, a window pops up on the lower right corner that states, " Your computer is infected. Spyware has been detected…." When you hit Ctrl-alt-del, it says that task manager has been disabled by the administrator. You can not run programs, the mouse buttons seems like they are disabled. A screen comes up, blue background, black box in the middle that says there is spyware. I can run programs, but only if I log on as administrator and run them through task manager. I ran HJT and the log is on the desktop, but I don't know how to open it or put it on a floppy to post it. I noticed a few suspicious files…. crk32.exe, efsdfgxg.exe, appyz.exe. I have tried the fixes, but I an unable to get to control panel or explorer to remove the items. I have HJT remove the items but they come back (probably because I can't access explorer and control panel) Where do I go from here?

Siggyx

Post #2April 25, 2006, 6:09 AM UTC

Download hijackthis to its own folder C:/HJT for example. Extrat the zip file to that folder. Then close all browseer windows, open hijackthis and click on scan. Once the scan has completed click on Save Log, this will produce a text file log. Highlight all of the information from in that text box then right click and copy. Come back to this post you made and click on "add reply" at the bottom right and a new window will open. Paste the hijackthis log into the new window hit add reply in that new window.

HJT download >>> http://www.softpedia.com/public/cat/10/17/10-17-69.shtml

poporacer

Post #3April 25, 2006, 4:14 PM UTC

I guess I wasn't clear. On the infected computer, I can't run programs, it seems like the mouse buttons are disabled. I can run HJT and it creates a log, but I haven't figured out how I can copy it to a disk so that I can post it. I am able to open notepad but when I try to open any document, it freezes. When I close windows, I get a message that explorer is not responding. It appears that the computer is running real slow, I left it running and Norton virus detected Bloodhound.exploit.6 but was unable to fix it. I will try to figure out a way to get the file to disk, Any suggestion?

poporacer

Post #4April 25, 2006, 4:46 PM UTC

OK, I was able to get the log, I had to start up in command prompt and run things from there. Here it is:

Logfile of HijackThis v1.99.1
Scan saved at 9:33:29 AM, on 4/25/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\cmd.exe
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://store.presario.net/scripts/redirect…&c=1c02&lc=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://rd.yahoo.com/customize/yessentials_…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://store.presario.net/scripts/redirect…&c=1c02&lc=0409
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\System32\search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = C:\WINDOWS\System32\search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = C:\WINDOWS\System32\search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = C:\WINDOWS\System32\search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\zkqso.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://store.presario.net/scripts/redirect…&c=1c02&lc=0409
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\System32\search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
O2 - BHO: (no name) - {08B062B7-0572-9CCE-27F2-A318B78A3677} - C:\WINDOWS\ntye32.dll
O2 - BHO: (no name) - {BB48572C-295E-5F17-1B6B-3589DA7CAB9B} - C:\WINDOWS\system32\sysnp32.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [multitran] C:\WINDOWS\System32\multitran.exe
O4 - HKLM\..\Run: [WindowsUpdateNT] C:\WINDOWS\System\svwhost.exe /s
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [System] C:\WINDOWS\System32\kernels32.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [sdkvc32.exe] C:\WINDOWS\system32\sdkvc32.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [QD FastAndSafe] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [ntqr32.exe] C:\WINDOWS\system32\ntqr32.exe
O4 - HKLM\..\Run: [msqn32.exe] C:\WINDOWS\system32\msqn32.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1107146022\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] c:\compaq\cpqsetup\cpqset.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\kernels32.exe
O4 - HKLM\..\RunServices: [multitran] C:\WINDOWS\System32\multitran.exe
O4 - HKLM\..\RunServicesOnce: [washindex] C:\Program Files\Cookie Washer\washidx.exe "Brazeal"
O4 - HKCU\..\Run: [taskmgr] C:\WINDOWS\system32\NOTEPAD.EXE
O4 - Global Startup: D-Link AirPlus G Configuration Utility.lnk = ?
O4 - Global Startup: ItsDeductiblePopUp.lnk = C:\Program Files\ItsDeductible\ItsDeductible.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Advisor - {0F2E637F-E3AF-49BB-8BCF-2CFAEDF862EF} - C:\Program Files\COMPAQ\Compaq Advisor\bin\rbaLauncher.exe (file missing) (HKCU)
O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for ¸æu
: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=1c02&lc=0409
O16 - DPF: {11111111-1111-1111-1111-111111111123} - ms-its:mhtml:file://C:\ss.MHT!http://little-flowers-######.com/ebook.chm::/loader.exe
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} (AOL Content Update) - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/169de9359f5c3f…ip/RdxIE601.cab
O20 - Winlogon Notify: docent0 - C:\WINDOWS\SYSTEM32\docent0.dll
O20 - Winlogon Notify: mdfpro - C:\WINDOWS\SYSTEM32\mdfpro.dll
O20 - Winlogon Notify: st3i - C:\WINDOWS\q1083678.dll
O23 - Service: Workstation NetLogon Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\ipxq32.exe
O23 - Service: .NET Framework Service (.NET Connection Service) - Unknown owner - C:\WINDOWS\svchost.exe (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

I hope this helps

Siggyx

Post #5April 25, 2006, 6:46 PM UTC

You have a lot of nasty infections. Lets see if we can get some of it cleaned off. This will take a number of steps.

You may need to conenct in safe mode with network options to download these.

Please download Look2Me-Destroyer.exe to your desktop.

Close all windows before continuing.
Double-click Look2Me-Destroyer.exe to run it.
Put a check next to Run this program as a task .
You will receive a message saying Look2Me-Destroyer will close and re-open in approximately 10 seconds. Click OK
When Look2Me-Destroyer re-opens, click the Scan for L2M button , your desktop icons will disappear, this is normal.
Once it's done scanning, click the Remove L2M button .
You will receive a Done Scanning message, click OK .
When completed, you will receive this message: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, click OK .
Your computer will then shutdown.
Turn your computer back on.
Please post the contents of C:\Look2Me-Destroyer.txt and a new HiJackThis log.

If you receive a message from your firewall about this program accessing the internet please allow it.

If you receive a runtime error '339'. please download MSWINSCK.OCX from the link below and place it in your C:\Windows\System32. Directory
http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX

poporacer

Post #6April 25, 2006, 7:53 PM UTC

Just to make things clear, I am not connected to the internet with the infected computer. I am connecting with another computer and transferring the files to the infected computer. I am running in Safe Mode (any other way, I can't do anything) To run programs, I have to hit Ctrl-alt-Del to bring up Task Manager and run programs from there. Some things I have to start in Command prompt. A pain in the A$$ do get things done. Thanks for your help. Could you tell me what things are infecting my computer and what indicated this ( I like gaining knowledge). OK I was able to get the program on my desktop but when I run it, after I click the check box, I get a nessage that the Task Scheduler service is not runnin and that Destroyer will start it now. I then click OK and get the message that destroyer will close and reopen in one minute, everything closes and then nothing happens, I waited several minutes. I ran it from the task manager in Safe mode and from the command prompt and got the same thing. I was also able to double-click it from the desktop (it looks like the buttons don't lock up right away) Still same thing. I really appreciate your help!!! Rick

Siggyx

Post #7April 25, 2006, 8:22 PM UTC

Did it produce a log?

poporacer

Post #8April 26, 2006, 12:32 AM UTC last edited April 26, 2006, 12:37 AM UTC

No it didn't create a log. The log will be on the desktop right? It seems like the proggram shuts down. When I bring up task manager it doesn't show that it is running, and in command prompt, I get the blinking cursor and can type commands

Siggyx

Post #9April 26, 2006, 2:23 AM UTC

Are you able to download progreams? If so let me know and we will do this the long way.

poporacer

Post #10April 26, 2006, 3:43 AM UTC

I can dowload programs on this computer and then transfer them to the infected one. Ok here is what I have. I did some snooping, and found that Task Scheduler does not work in Safe Mode and that is why Look2me-destroyer would not run! Well I snooped arounf a bit (sorry I was bored) and installed and ran SmitRem and then I was able to access the desktop!!! Now I was able to log on normally and run Look2me. Things are getting better, here is my HJT log and the Look2me log:

Look 2 me log:

Look2Me-Destroyer V1.0.12

Scanning for infected files…..
Scan started at 4/25/2006 8:22:05 PM

Attempting to delete infected files…

Making registry repairs.

Restoring Windows certificates.

Replaced hosts file with default windows hosts file

Restoring SeDebugPrivilege for Administrators - Succeeded

HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 8:40:33 PM, on 4/25/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ipxq32.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\sdkvc32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Compaq\EAB\EabServr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\atiptaxx.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\PROGRA~1\COMMON~1\AOL\110714~1\EE\AOLHOS~1.EXE
C:\Program Files\Cookie Washer\aolwasher.exe
C:\Program Files\AOL Computer Check-Up\ACCAgnt.exe
C:\PROGRA~1\COMMON~1\AOL\110714~1\EE\AOLServiceHost.exe
C:\hjt\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = C:\WINDOWS\System32\search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = C:\WINDOWS\System32\search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = C:\WINDOWS\System32\search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\zkqso.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\System32\search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {4476003E-1C4F-1EF2-097F-B2D801824FD1} - C:\WINDOWS\addao.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [sdkvc32.exe] C:\WINDOWS\system32\sdkvc32.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [QD FastAndSafe] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [ntqr32.exe] C:\WINDOWS\system32\ntqr32.exe
O4 - HKLM\..\Run: [msqn32.exe] C:\WINDOWS\system32\msqn32.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1107146022\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] c:\compaq\cpqsetup\cpqset.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\RunServicesOnce: [washindex] C:\Program Files\Cookie Washer\washidx.exe "Brazeal"
O4 - HKCU\..\Run: [ccWasher] C:\Program Files\Cookie Washer\aolwasher.exe /0
O4 - HKCU\..\Run: [AOLCC] "C:\Program Files\AOL Computer Check-Up\ACCAgnt.exe" /startup
O4 - HKCU\..\Run: [taskmgr] C:\WINDOWS\system32\NOTEPAD.EXE
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [multitran] C:\WINDOWS\System32\multitran.exe
O4 - HKCU\..\Run: [WindowsUpdateNT] C
O4 - Global Startup: D-Link AirPlus G Configuration Utility.lnk = ?
O4 - Global Startup: ItsDeductiblePopUp.lnk = C:\Program Files\ItsDeductible\ItsDeductible.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Advisor - {0F2E637F-E3AF-49BB-8BCF-2CFAEDF862EF} - C:\Program Files\COMPAQ\Compaq Advisor\bin\rbaLauncher.exe (file missing) (HKCU)
O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for ¸æu
: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=1c02&lc=0409
O16 - DPF: {11111111-1111-1111-1111-111111111123} - ms-its:mhtml:file://C:\ss.MHT!http://little-flowers-######.com/ebook.chm::/loader.exe
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} (AOL Content Update) - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/169de9359f5c3f…ip/RdxIE601.cab
O20 - Winlogon Notify: docent0 - C:\WINDOWS\SYSTEM32\docent0.dll
O20 - Winlogon Notify: mdfpro - C:\WINDOWS\SYSTEM32\mdfpro.dll
O23 - Service: Workstation NetLogon Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\ipxq32.exe
O23 - Service: .NET Framework Service (.NET Connection Service) - Unknown owner - C:\WINDOWS\svchost.exe (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Siggyx

Post #11April 26, 2006, 3:46 AM UTC

Good, ok hang on. I need to write up the next part of the fix and it is a long one.

Siggyx

Post #12April 26, 2006, 3:54 AM UTC

The Fix:

Step#1:Getting Ready

Please save these instructions to WordPad so that you have them accessible while following the steps. You also may want to print out these directions as the Internet will not be available.

After downloading the tools, you must disconnect from the internet totally, because staying connected while fixing will prevent the fix from working. Also please keep Internet Explorer and Outlook Express closed throughout as opening either will reinstall the infection.

To replace Internet Explorer to use during this fix, please use Internet Explorer once to download and install FireFox, to be used as your alternate browser throughout this fix.

Close Outlook Express and Internet Explorer for the duration of this fix

Read through all the instructions so that you can ask any questions now, before you disconnect from the Internet.

Please start by downloading the tools you will need to clean this infection with FireFox. If you have a problem or question with any please continue to follow the list step by step to the end and ask the questions when you are asked to reply. Just be sure to let us know what the problem was when you finally reply.

Step#2:Show All Hidden Files Very Important

Please download and open the following zip file. Double-click on the file inside the zip and when it asks you if you would like to merge the file into your registry, please answer yes. This will make sure all files are visible on your computer.
http://www.davehigham.zen.co.uk/downloads/xphidden.zip

(or copy all of the instructions for the specific OS from http://www.xtra.co.nz/help/0,,4155-1916458,00.html to the post)

Step#3:Download CWShredder Do Not Use Yet

1. Please Download the most recent version of CWShredder, from CWSInstall.exe

2. Check for Updates but please Do NOT use it yet

Step#4:Download About Buster Do Not Use Yet

1. Please download About:Buster from here: http://www.malwarebytes.org/AboutBuster.zip

2. Once it is downloaded extract it to c:\aboutbuster.

Step#5:Download Registrar Lite Do Not Use Yet

Another program to download is Registrar Lite for use later: Please download Registrar Lite and install it to C:\Program Files\RegLite\ . This is a registry editor that is very easy to use. Caution should be exercised when editing the registry as it is very easy to render a Computer unbootable by deleting the wrong key

Step#6:Download Ewido Security Suite Only For Windows 2000 and XP Do Not Use Yet

Download and install Ewido security suite
Right Click on the “E” icon in your taskbar and open Ewido Security Suite then click “update” to get the most recent definitions for it to use.
When it prompts you to update, click the OK button.
download the updates and when they are finished installing, close the window
Please Do Not Use It Yet

Step#6:Download A Registry File to Remove Registry Entries Do Not Use Yet

Please download the following zip file to your desktop:
HSfix
Double Click on HSfix.zip and it will unzip to a new folder it makes on your desktop, called HSfix
Do Not Use It Yet

Please disconnect from the Internet

Step#7:Disable The Bad Service ** Very Important!!**

Reboot your computer into Safe Mode by tapping F8 while booting up and continue for the rest of the fix in SAFE MODE
Click on start > control panel > administrative programs or could be administrative tools > services. Look for a service called Workstation NetLogon Service . Double click on that service and click stop and then set the startup to disabled. Also write down the name and path of the file listed in the Path to executable field. This filename must be deleted below.

Step#8:Stop The Running Processes

Press control-alt-delete to get into the task manager and end the following processes if they exist:

sdkvc32.exe
ntqr32.exe
msqn32.exe
ipxq32.exe

Step#9:Use HijackThis to Delete About Blank Bad Files

I now need you to delete the following files:

C:\WINDOWS\system32\zkqso.dll
C:\WINDOWS\system32\sdkvc32.exe
C:\WINDOWS\system32\ntqr32.exe
C:\WINDOWS\system32\msqn32.exe
C:\winstall.exe
C:\WINDOWS\system32\ipxq32.exe

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. if it is uncheck it and try again.

Step#10:Cleaning With HijackThis

Then close all programs and windows and run hijackthis. Put a checkmark next to each of these entries and click 'fix checked' button when ready (some may be gone after uninstalling some programs):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = C:\WINDOWS\System32\search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = C:\WINDOWS\System32\search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = C:\WINDOWS\System32\search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\zkqso.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\System32\search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

R3 - Default URLSearchHook is missing

O4 - HKLM\..\Run: [sdkvc32.exe] C:\WINDOWS\system32\sdkvc32.exe
O4 - HKLM\..\Run: [ntqr32.exe] C:\WINDOWS\system32\ntqr32.exe
O4 - HKLM\..\Run: [msqn32.exe] C:\WINDOWS\system32\msqn32.exe
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [WindowsUpdateNT] C

O16 - DPF: {11111111-1111-1111-1111-111111111123} - ms-its:mhtml:file://C:\ss.MHT!http://little-flowers-######.com/ebook.chm::/loader.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/169de9359f5c3f…ip/RdxIE601.cab

O20 - Winlogon Notify: docent0 - C:\WINDOWS\SYSTEM32\docent0.dll
O20 - Winlogon Notify: mdfpro - C:\WINDOWS\SYSTEM32\mdfpro.dll

O23 - Service: Workstation NetLogon Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\ipxq32.exe

O23 - Service: .NET Framework Service (.NET Connection Service) - Unknown owner - C:\WINDOWS\svchost.exe (file missing)

click "fix checked"

Step#11: Backup The Registry

In the next step we are going to remove a service that gets installed by this malware.

1. Open Registrar Lite and run it.

2. Copy and paste the bold text below into the address bar of Registrar Lite:(this is making a Registry backup for safety in case of error)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\

Go to File> Export and and save as (in the C:\Program Files\Registrar Lite (Reglite) folder):

1.) Winkey.reg (Save as type: regedit4 .reg type)
2.) Winkey.hiv (Save as type: Scroll to select-regetd32/WinAPI *hiv *dat files)

Step#12: Use the HSfix.reg file

Navigate to the HSfix folder on your Desktop
Then double-click on the HSfix.reg file, and when it prompts to merge say yes, and this will clear some registry entries left behind by the process.
if you have a popup from any of your protection programs asking if you want to make a change to the registry, say Yes or Accept it

Step#13:Fixing With CWShredder

CLOSE ALL WINDOWS except CWShredder
Run the program by clicking 'fix' and letting it fix all CWS remnants.

Step#14:Fixing With About Buster

This is the step where we will use About:Buster that you had downloaded previously.

Navigate to the c:\aboutbuster directory
double-click on aboutbuster.exe
When the tool opens press the OK button, then Start button, then the OK button
then finally the Yes button. It will start scanning your computer for files.
If it asks if you would like to do a second pass, allow it to do so.
Post the log file in your next reply

Step#15:Scan With Ewido Security Suite

Launch Ewido again
Click on Scanner>Complete System Scan.
Let the program scan your PC.
When the scan asks to clean files click OK.
When scan is completed, click Save report. to your desktop.
Post the report in your next reply.

Reboot your computer back to normal mode and

Reconnect To The Internet

NEXT

Please download VundoFix.exe from here:

http://www.atribune.org/ccount/click.php?id=4

and save it to your desktop

Double-click VundoFix.exe to run it.

Checkmark the box "Run Vundo as task"

You will receive a message saying vundofix will close and re-open in a minute or less. Click OK

When VundoFix re-opens, click the Scan for Vundo button

Once it's done scanning, click the Remove Vundo button.

You will receive a prompt asking if you want to remove the files, click YES

Once you click yes, your desktop will go blank as it starts removing Vundo.

When completed, it will prompt that it will shutdown your computer, click OK.

Turn your computer back on.

Step#16:Scan and Post a New HJT log with other logs

Scan again with HijackThis.
Post your logs from HijackThis, About Buster, and Ewido Security Suite here in this thread with any questions or problems that you have run into.
There are still some steps that are necessary to clear out all of the malware. There will be necessary files that it has deleted that will need to be replaced.

Good Luck!

poporacer

Post #13April 27, 2006, 6:27 AM UTC

OK things went well with the exception of a few issues, until I got to step #15.

On step 9, I couldn't find a way to delete files from HJT. I used Explorer to delete these files. Winstall.exe was not there.

On Step 11, I clicked file-export-save as…and I got the prompt, I saved it as a .reg file and and then export again and save as a hiv file? (thats what I did)

Step 15, I did a complete system scan and the program froze during the memory scan. I tried a couple of times and it froze at the sam point. I tried just a memory scan and it froze at the same point… 33 objects [120] VM_7FFE0000.

Here is the most recent HJT log and AboutBuster log. I did notice that a couple of entries we removed earlier are back:
O20 - Winlogon Notify: docent0 - C:\WINDOWS\SYSTEM32\docent0.dll
O20 - Winlogon Notify: mdfpro - C:\WINDOWS\SYSTEM32\mdfpro.dll

also notepad is not working, does this line affect this?

O4 - HKCU\..\Run: [taskmgr] C:\WINDOWS\system32\NOTEPAD.EXE

HJT log:
Logfile of HijackThis v1.99.1
Scan saved at 10:49:11 PM, on 4/26/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\ewido anti-malware\SecuritySuite.exe
C:\Program Files\ewido anti-malware\SecuritySuite.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
C:\Program Files\ewido anti-malware\SecuritySuite.exe
C:\Program Files\ewido anti-malware\SecuritySuite.exe
C:\Program Files\ewido anti-malware\SecuritySuite.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://store.presario.net/scripts/redirect…&c=1c02&lc=0409
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://cwshredder.net/cwshredder/cwsredir.php?target=tmas
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
O2 - BHO: (no name) - {4476003E-1C4F-1EF2-097F-B2D801824FD1} - C:\WINDOWS\addao.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [QD FastAndSafe] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1107146022\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] c:\compaq\cpqsetup\cpqset.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\RunServicesOnce: [washindex] C:\Program Files\Cookie Washer\washidx.exe "Brazeal"
O4 - HKCU\..\Run: [taskmgr] C:\WINDOWS\system32\NOTEPAD.EXE
O4 - Global Startup: D-Link AirPlus G Configuration Utility.lnk = ?
O4 - Global Startup: ItsDeductiblePopUp.lnk = C:\Program Files\ItsDeductible\ItsDeductible.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Advisor - {0F2E637F-E3AF-49BB-8BCF-2CFAEDF862EF} - C:\Program Files\COMPAQ\Compaq Advisor\bin\rbaLauncher.exe (file missing) (HKCU)
O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for ¸æu
: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=1c02&lc=0409
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} (AOL Content Update) - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O20 - Winlogon Notify: docent0 - C:\WINDOWS\SYSTEM32\docent0.dll
O20 - Winlogon Notify: mdfpro - C:\WINDOWS\SYSTEM32\mdfpro.dll
O23 - Service: .NET Framework Service (.NET Connection Service) - Unknown owner - C:\WINDOWS\svchost.exe (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

I will post the AboutBuster on the next post (too long)

poporacer

Post #14April 27, 2006, 6:53 AM UTC

AboutBuster log (I removed a several lines of Streams that were removed, The post was still too long, if you need them let me know and I will post those) AboutBuster 6.01 Scan started on [4/26/2006] at [1:01:36 PM] ————————————————————- Internet Explorer Instances Terminated! HomeSearch Service stopped if present ————————————————————- Removed Stream! C:\WINDOWS\sdkqh32.dll:daowi Removed Stream! C:\WINDOWS\sdkqh32.dll:hmqwsb Removed Stream! C:\WINDOWS\sdkqh32.dll:prjye Removed Stream! C:\WINDOWS\sdkrs.exe.bak:fsphgs Removed Stream! C:\WINDOWS\sdkry32.dll:nviuub Removed Stream! C:\WINDOWS\sdkry32.dll:ufdkp Removed Stream! C:\WINDOWS\sdkvg32.exe:qtxrc Removed Stream! C:\WINDOWS\sdkvg32.exe:xtamac Removed Stream! C:\WINDOWS\sdkvg32.exe:zbgkqs Removed Stream! C:\WINDOWS\sdkyo.exe:gvazwl Removed Stream! C:\WINDOWS\sdkyo.exe:ocrhe Removed Stream! C:\WINDOWS\sdkyo.exe:xdsvg Removed Stream! C:\WINDOWS\sefwk.log:atmja Removed Stream! C:\WINDOWS\sefwk.log:lptwi Removed Stream! C:\WINDOWS\setdebug.exe:awajgk Removed Stream! C:\WINDOWS\setdebug.exe:ymfni Removed Stream! C:\WINDOWS\setupact.log:jtpww Removed Stream! C:\WINDOWS\setupact.log:kocqez Removed Stream! C:\WINDOWS\setupact.log:tufwu Removed Stream! C:\WINDOWS\setupapi.log:kdjdmf Removed Stream! C:\WINDOWS\setuperr.log:podox Removed Stream! C:\WINDOWS\setuperr.log:txsoiu Removed Stream! C:\WINDOWS\setuperr.log:wjwgf Removed Stream! C:\WINDOWS\sfigr.dat:lupbw Removed Stream! C:\WINDOWS\sgyjx.txt:cecihq Removed Stream! C:\WINDOWS\sgyjx.txt:comvyk Removed Stream! C:\WINDOWS\shvfts.dat:apotr Removed Stream! C:\WINDOWS\sicyf.dll:vhfabm Removed Stream! C:\WINDOWS\SIREGIST.LOG:vennja Removed Stream! C:\WINDOWS\skvei.dat:djfetb Removed Stream! C:\WINDOWS\slcyo.txt:bsygmy Removed Stream! C:\WINDOWS\slcyo.txt:lqzmo Removed Stream! C:\WINDOWS\slfgh.dll:ntwwoe Removed Stream! C:\WINDOWS\slfgh.dll:ruftna Removed Stream! C:\WINDOWS\slxli.log:xjnbrm Removed Stream! C:\WINDOWS\smscfg.ini:drkri Removed Stream! C:\WINDOWS\smscfg.ini:jqvms Removed Stream! C:\WINDOWS\smscfg.ini:vkpknl Removed Stream! C:\WINDOWS\snrvo.log:gtokqg Removed Stream! C:\WINDOWS\snrvo.log:jvxhhd Removed Stream! C:\WINDOWS\snrvo.log:qygxht Removed Stream! C:\WINDOWS\snrvo.log:usrtpj Removed Stream! C:\WINDOWS\snrvo.log:vxbzmo Removed Stream! C:\WINDOWS\Soap Bubbles.bmp:pkxgtw Removed Stream! C:\WINDOWS\Soap Bubbles.bmp:yfatpu Removed Stream! C:\WINDOWS\spuninst.log:cjnsu Removed Stream! C:\WINDOWS\spuninst.log:wscwk Removed Stream! C:\WINDOWS\spupdsvc.log:ilqlnh Removed Stream! C:\WINDOWS\spupdsvc.log:rgsyrx Removed Stream! C:\WINDOWS\spupdsvc.log:wqqlg Removed Stream! C:\WINDOWS\Status.mif:gzejib Removed Stream! C:\WINDOWS\Status.mif:otvce Removed Stream! C:\WINDOWS\Sti_Trace.log:dnldj Removed Stream! C:\WINDOWS\Sti_Trace.log:nmypfa Removed Stream! C:\WINDOWS\Sti_Trace.log:qmdxy Removed Stream! C:\WINDOWS\Sti_Trace.log:ukyfp Removed Stream! C:\WINDOWS\stunp.dat:orbyj Removed Stream! C:\WINDOWS\subsu.dat:dtnnf Removed Stream! C:\WINDOWS\surmpj.dat:hgeff Removed Stream! C:\WINDOWS\svcpack.log:teqzb Removed Stream! C:\WINDOWS\svlvd.dll:zstdd Removed Stream! C:\WINDOWS\syhlx.dll:ooonf Removed Stream! C:\WINDOWS\syhlx.dll:svydc Removed Stream! C:\WINDOWS\syhlx.dll:wtgbh Removed Stream! C:\WINDOWS\syhlx.dll:wtgbhd Removed Stream! C:\WINDOWS\SynCor.exe:cjqqp Removed Stream! C:\WINDOWS\SynCor.exe:hpgbh Removed Stream! C:\WINDOWS\SynInst.log:eftjy Removed Stream! C:\WINDOWS\SynInst.log:epbek Removed Stream! C:\WINDOWS\SynInst.log:kwiie Removed Stream! C:\WINDOWS\SynInst.log:ymnrgs Removed Stream! C:\WINDOWS\SynthCoreA.Dll:rzrgi Removed Stream! C:\WINDOWS\synxq.dat:jhesxi Removed Stream! C:\WINDOWS\syple.log:ytkkez Removed Stream! C:\WINDOWS\sysdq32.dll:rnyxiu Removed Stream! C:\WINDOWS\sysdq32.dll:xqujm Removed Stream! C:\WINDOWS\sysdt.dll:kajuc Removed Stream! C:\WINDOWS\sysdu.dll:cxbvy Removed Stream! C:\WINDOWS\sysdu.dll:qudpzb Removed Stream! C:\WINDOWS\sysdu.dll:vkbdr Removed Stream! C:\WINDOWS\sysea32.dll:preog Removed Stream! C:\WINDOWS\sysgj.exe:cbuzf Removed Stream! C:\WINDOWS\syslf32.exe:tdnaj Removed Stream! C:\WINDOWS\sysmr.exe:vzpjgm Removed Stream! C:\WINDOWS\sysnt32.dll:leyfe Removed Stream! C:\WINDOWS\sysnt32.dll:vcnez Removed Stream! C:\WINDOWS\syspl.dll:eeqsg Removed Stream! C:\WINDOWS\syspl.dll:naghl Removed Stream! C:\WINDOWS\sysra32.dll:npyzgw Removed Stream! C:\WINDOWS\sysrf32.exe:oahpax Removed Stream! C:\WINDOWS\sysuz.dll:pgbdc Removed Stream! C:\WINDOWS\sysvj.dll:jarwi Removed Stream! C:\WINDOWS\sysyk.exe:xjenvm Removed Stream! C:\WINDOWS\syszm32.dll:fcfsb Removed Stream! C:\WINDOWS\syszm32.dll:nkujl Removed Stream! C:\WINDOWS\syszm32.dll:sjckh Removed Stream! C:\WINDOWS\syszm32.dll:wtaxkk Removed Stream! C:\WINDOWS\szwib.txt:rblhwk Removed Stream! C:\WINDOWS\szylw.txt:pjxspo Removed Stream! C:\WINDOWS\szylw.txt:putcmv Removed Stream! C:\WINDOWS\TASKMAN.EXE:pbpba Removed Stream! C:\WINDOWS\tavgt.dll:jcdnqu Removed Stream! C:\WINDOWS\tfguj.dll:zvlak Removed Stream! C:\WINDOWS\titaai.dat:kcuyk Removed Stream! C:\WINDOWS\tmjag.txt:duknzy Removed Stream! C:\WINDOWS\tncpk.dat:aflkuw Removed Stream! C:\WINDOWS\tncpk.dat:ldpjec Removed Stream! C:\WINDOWS\tncpk.dat:rgmnp Removed Stream! C:\WINDOWS\tokhz.dll:vuxblv Removed Stream! C:\WINDOWS\trqmf.txt:kbsuny Removed Stream! C:\WINDOWS\tsbha.dll:sgvxog Removed Stream! C:\WINDOWS\tsoc.log:ddnde Removed Stream! C:\WINDOWS\tsoc.log:djopvb Removed Stream! C:\WINDOWS\tsoc.log:vvcbtb Removed Stream! C:\WINDOWS\ttkjm.dll:jgxsr Removed Stream! C:\WINDOWS\ttkjm.dll:lzocij Removed Stream! C:\WINDOWS\tuwrd.dat:nvphff Removed Stream! C:\WINDOWS\twain.dll:wkhcpl Removed Stream! C:\WINDOWS\twain.dll:xuysbw Removed Stream! C:\WINDOWS\twain_32.dll:jmnzft Removed Stream! C:\WINDOWS\twunk_16.exe:ywamih Removed Stream! C:\WINDOWS\twunk_32.exe:pvixwz Removed Stream! C:\WINDOWS\txqze.log:oarnee Removed Stream! C:\WINDOWS\tyfim.log:vcveks Removed Stream! C:\WINDOWS\tzzyj.dll:hfnybe Removed Stream! C:\WINDOWS\ucsguu.dat:uoqkbg Removed Stream! C:\WINDOWS\ujplu.dat:coynld Removed Stream! C:\WINDOWS\ulonu.log:aotpsu Removed Stream! C:\WINDOWS\ulonu.log:hjevvo Removed Stream! C:\WINDOWS\ulonu.log:uznygx Removed Stream! C:\WINDOWS\uninst.exe:jxlfec Removed Stream! C:\WINDOWS\uninst.exe:mpixvq Removed Stream! C:\WINDOWS\uninst.exe:uprsnn Removed Stream! C:\WINDOWS\uninst.exe:zkwaqz Removed Stream! C:\WINDOWS\unvise32qt.exe:sgyjxr Removed Stream! C:\WINDOWS\unvise32qt.exe:tpevuw Removed Stream! C:\WINDOWS\unvise32qt.exe:ygemj Removed Stream! C:\WINDOWS\upst.ini:fsglii Removed Stream! C:\WINDOWS\uqooi.dll:xqucja Removed Stream! C:\WINDOWS\urhwo.dat:hqlrnt Removed Stream! C:\WINDOWS\uuwky.dat:qyabvn Removed Stream! C:\WINDOWS\uuwky.dat:sryclt Removed Stream! C:\WINDOWS\uvklh.dll:qjmqdk Removed Stream! C:\WINDOWS\uwrdb.dll:iykgxx Removed Stream! C:\WINDOWS\uwrdb.dll:krrhod Removed Stream! C:\WINDOWS\vb.ini:rzopn Removed Stream! C:\WINDOWS\vb.ini:xxmxi Removed Stream! C:\WINDOWS\vbaddin.ini:nuztco Removed Stream! C:\WINDOWS\vfknn.log:jahdp Removed Stream! C:\WINDOWS\vikzb.txt:tmjcqd Removed Stream! C:\WINDOWS\vjaoh.dat:mycjiy Removed Stream! C:\WINDOWS\vjaoh.dat:txgmny Removed Stream! C:\WINDOWS\vjnxo.txt:szwibg Removed Stream! C:\WINDOWS\vjnzs.dat:ltfxlx Removed Stream! C:\WINDOWS\vjnzs.dat:mfbpsn Removed Stream! C:\WINDOWS\vminst.log:auupsi Removed Stream! C:\WINDOWS\vminst.log:aywsyf Removed Stream! C:\WINDOWS\vminst.log:lxyspi Removed Stream! C:\WINDOWS\vmmreg32.dll:lapndq Removed Stream! C:\WINDOWS\vmmreg32.dll:muknm Removed Stream! C:\WINDOWS\vmmreg32.dll:nbzks Removed Stream! C:\WINDOWS\vmofx.dll:pziwtn Removed Stream! C:\WINDOWS\vnkfg.log:gaspk Removed Stream! C:\WINDOWS\vnkfg.log:kypxai Removed Stream! C:\WINDOWS\vnkfg.log:lmprct Removed Stream! C:\WINDOWS\vorwn.dat:bbwypr Removed Stream! C:\WINDOWS\vorwn.dat:tvfums Removed Stream! C:\WINDOWS\vovfw.log:habknx Removed Stream! C:\WINDOWS\vovfw.log:xaasaj Removed Stream! C:\WINDOWS\vpvve.txt:dralus Removed Stream! C:\WINDOWS\vpvve.txt:ittll Removed Stream! C:\WINDOWS\vrpla.dat:deieee Removed Stream! C:\WINDOWS\vrvqy.dat:mdhqee Removed Stream! C:\WINDOWS\vrvqy.dat:patxct Removed Stream! C:\WINDOWS\vrxaqd.dat:gotawe Removed Stream! C:\WINDOWS\vrxaqd.dat:mosbs Removed Stream! C:\WINDOWS\vrxaqd.dat:vssqwd Removed Stream! C:\WINDOWS\vrxaqd.dat:xhges Removed Stream! C:\WINDOWS\vtmbg.dat:fukavx Removed Stream! C:\WINDOWS\vtmbg.dat:rblcf Removed Stream! C:\WINDOWS\vtmbg.dat:rijbat Removed Stream! C:\WINDOWS\vzvkz.dat:ezexbq Removed Stream! C:\WINDOWS\vzvkz.dat:iblcxe Removed Stream! C:\WINDOWS\vzvkz.dat:izgvm Removed Stream! C:\WINDOWS\vzvkz.dat:jjbouv Removed Stream! C:\WINDOWS\wanmpsvc.exe:mbvram Removed Stream! C:\WINDOWS\wcvba.dll:acwhzg Removed Stream! C:\WINDOWS\wcvba.dll:cyshw Removed Stream! C:\WINDOWS\wdjwb.txt:xwnphy Removed Stream! C:\WINDOWS\wegju.txt:wzxddt Removed Stream! C:\WINDOWS\whesp.dll:mzcqae Removed Stream! C:\WINDOWS\wiaservc.log:fftlq Removed Stream! C:\WINDOWS\wiaservc.log:jwcqb Removed Stream! C:\WINDOWS\wiaservc.log:nzdat Removed Stream! C:\WINDOWS\winas32.dll:gekjr Removed Stream! C:\WINDOWS\winbj32.dll:xbfbwr Removed Stream! C:\WINDOWS\winch.exe:gamdvo Removed Stream! C:\WINDOWS\WindowsUpdate.log:pcyoqb Removed Stream! C:\WINDOWS\WindowsUpdate.log:zteipz Removed Stream! C:\WINDOWS\winhelp.exe:isbaml Removed Stream! C:\WINDOWS\winhi32.dll:emtirx Removed Stream! C:\WINDOWS\winhi32.dll:nxsisk Removed Stream! C:\WINDOWS\winhlp32.exe:itfmb Removed Stream! C:\WINDOWS\winhlp32.exe:objvnh Removed Stream! C:\WINDOWS\winhlp32.exe:tkbnul Removed Stream! C:\WINDOWS\winlj32.dll:fxcnmu Removed Stream! C:\WINDOWS\winmi.dll:fmhzzi Removed Stream! C:\WINDOWS\winmi.dll:ogdpia Removed Stream! C:\WINDOWS\winmi.dll:wipldl Removed Stream! C:\WINDOWS\winmw.exe:llusww Removed Stream! C:\WINDOWS\winmw.exe:xnmvti Removed Stream! C:\WINDOWS\winnt256.bmp:bamejr Removed Stream! C:\WINDOWS\winnt256.bmp:hhockk Removed Stream! C:\WINDOWS\winnt256.bmp:ojiqfv Removed Stream! C:\WINDOWS\winoo32.exe:xmsett Removed Stream! C:\WINDOWS\winpz32.dll:auxsd Removed Stream! C:\WINDOWS\winpz32.dll:izxjh Removed Stream! C:\WINDOWS\winpz32.dll:oztox Removed Stream! C:\WINDOWS\winvi.dll:qflkvv Removed Stream! C:\WINDOWS\winvi.dll:zdufjc Removed Stream! C:\WINDOWS\winxm.dll:vmeukk Removed Stream! C:\WINDOWS\winxp.dll:heljyi Removed Stream! C:\WINDOWS\wkrne.log:mbxxfe Removed Stream! C:\WINDOWS\wkrne.log:onwifu Removed Stream! C:\WINDOWS\WMSysPrx.prx:gnhnhw Removed Stream! C:\WINDOWS\WMSysPrx.prx:qabvq Removed Stream! C:\WINDOWS\wpwno.log:lwakz Removed Stream! C:\WINDOWS\wpwno.log:sywtmv Removed Stream! C:\WINDOWS\wpwno.log:yozsbh Removed Stream! C:\WINDOWS\wueyw.dll:rpsydr Removed Stream! C:\WINDOWS\wvgyb.dat:fvctim Removed Stream! C:\WINDOWS\wvgyb.dat:npcucr Removed Stream! C:\WINDOWS\wvyca.dat:jpdlxu Removed Stream! C:\WINDOWS\wyxxr.txt:otcjrt Removed Stream! C:\WINDOWS\wzkht.dll:kcepul Removed Stream! C:\WINDOWS\xfvet.log:guuxtd Removed Stream! C:\WINDOWS\xmhoe.dat:ddxvxo Removed Stream! C:\WINDOWS\xmnik.log:bbuak Removed Stream! C:\WINDOWS\xpxjj.txt:ywaequ Removed Stream! C:\WINDOWS\xsvfm.dat:jfircn Removed Stream! C:\WINDOWS\xsvfm.dat:vdsxs Removed Stream! C:\WINDOWS\xtgbu.log:qxtjtx Removed Stream! C:\WINDOWS\xygng.dat:aphhek Removed Stream! C:\WINDOWS\xygng.dat:tbnfm Removed Stream! C:\WINDOWS\ydwyt.dat:ljpte Removed Stream! C:\WINDOWS\yjiaw.dat:popohj Removed Stream! C:\WINDOWS\yjiaw.dat:sizmyv Removed Stream! C:\WINDOWS\ykjlx.dat:dkhyy Removed Stream! C:\WINDOWS\ykjlx.dat:hqgqav Removed Stream! C:\WINDOWS\yttyz.dat:ezqilf Removed Stream! C:\WINDOWS\yttyz.dat:gboyem Removed Stream! C:\WINDOWS\yttyz.dat:rmmlc Removed Stream! C:\WINDOWS\Zapotec.bmp:arzdvg Removed Stream! C:\WINDOWS\Zapotec.bmp:qzcwuv Removed Stream! C:\WINDOWS\zehch.txt:yuapdd Removed Stream! C:\WINDOWS\zeowq.log:gggnnm Removed Stream! C:\WINDOWS\zfcrf.dat:eswxut Removed Stream! C:\WINDOWS\zihvt.dat:aanbox Removed Stream! C:\WINDOWS\zihvt.dat:jneqw Removed Stream! C:\WINDOWS\zijfe.dll:rvtugf Removed Stream! C:\WINDOWS\zkxgx.txt:wsgcwd Removed Stream! C:\WINDOWS\zkxgx.txt:zonpka Removed Stream! C:\WINDOWS\zmazt.dat:qgzshx Removed Stream! C:\WINDOWS\zmxvv.log:jweiaq Removed Stream! C:\WINDOWS\zmyrt.txt:tgifne Removed Stream! C:\WINDOWS\znybg.txt:xdlmxx Removed Stream! C:\WINDOWS\zpniu.dll:cwwnca Removed Stream! C:\WINDOWS\zpniu.dll:jzkyjh Removed Stream! C:\WINDOWS\zqywo.log:khqhhn Removed Stream! C:\WINDOWS\zrbkd.dll:wnagcd Removed Stream! C:\WINDOWS\zrrdu.txt:bacdej Removed Stream! C:\WINDOWS\zrtkx.dll:wyvqeu Removed Stream! C:\WINDOWS\zucle.dll:coxey Removed Stream! C:\WINDOWS\zucle.dll:diinbx Removed Stream! C:\WINDOWS\zucle.dll:ftivtx Removed Stream! C:\WINDOWS\zwczs.dat:lckeph Removed Stream! C:\WINDOWS\_default.pif:kzsfm Removed Stream! C:\WINDOWS\_default.pif:oznwyx Removed Stream! C:\WINDOWS\_default.pif:vitsdz Removed Stream! C:\WINDOWS\{224CFCBF-D155-48CE-9923-21627B2BA31E}.dat:lbezx Removed Stream! C:\WINDOWS\{224CFCBF-D155-48CE-9923-21627B2BA31E}.dat:maxea Removed Stream! C:\WINDOWS\{224CFCBF-D155-48CE-9923-21627B2BA31E}.dat:xtbivz Removed Stream! C:\WINDOWS\{3564A736-4C6C-4806-BF06-373E8387CB8C}.dat:hzgbah Removed Stream! C:\WINDOWS\{4164F21D-4D05-4583-95AB-727EC398167C}.dat:fbhkd Removed Stream! C:\WINDOWS\{4164F21D-4D05-4583-95AB-727EC398167C}.dat:fdkznm Removed Stream! C:\WINDOWS\{4164F21D-4D05-4583-95AB-727EC398167C}.dat:vcxez Removed Stream! C:\WINDOWS\{64276F4F-54A1-47E9-8AE4-80743A4CDCB5}.dat:wenxlu Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:fpptsk Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:fuqtlw Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:hyufjs Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:jbeagk Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:jcfkf Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:jwwtmb Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:khoefk Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:kxkjux Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:ljvhro Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:odhrt Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:ojksdr Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:opwamz Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:ozdgah Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:pcyuwt Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:pxcapi Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:qaunma Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:qvjyfg Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:rwissh Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:ufjlrr Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:vadpi Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:vddzxe Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:vlyzfb Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:vzvtrs Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:wjznbp Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:xbfhcj Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:xecehp Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:ybczj Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:yqagmm Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:ywqepf Removed Stream! C:\WINDOWS\{F0AB8E0D-81A1-4627-A734-5C24FA694F79}.dat:zbhrwc ————————————————————- Removed File! : C:\WINDOWS\abdwp.log Removed File! : C:\WINDOWS\addao.dll Removed File! : C:\WINDOWS\addbd.exe Removed File! : C:\WINDOWS\addbr32.exe Removed File! : C:\WINDOWS\adddg32.exe Removed File! : C:\WINDOWS\addfv32.dll Removed File! : C:\WINDOWS\addgn.exe Removed File! : C:\WINDOWS\addhg32.exe Removed File! : C:\WINDOWS\addoi.exe Removed File! : C:\WINDOWS\addov.exe Removed File! : C:\WINDOWS\addpf32.dll Removed File! : C:\WINDOWS\addpo.exe Removed File! : C:\WINDOWS\addpz.exe Removed File! : C:\WINDOWS\addqp.dll Removed File! : C:\WINDOWS\addqr.exe Removed File! : C:\WINDOWS\addra32.exe Removed File! : C:\WINDOWS\addrx32.exe Removed File! : C:\WINDOWS\addsh32.exe Removed File! : C:\WINDOWS\addtt.exe Removed File! : C:\WINDOWS\adduu.exe Removed File! : C:\WINDOWS\adduu32.exe Removed File! : C:\WINDOWS\adduz32.dll Removed File! : C:\WINDOWS\addvy.dll Removed File! : C:\WINDOWS\addwr32.dll Removed File! : C:\WINDOWS\addxm.exe Removed File! : C:\WINDOWS\addyf.exe Removed File! : C:\WINDOWS\addyj.exe Removed File! : C:\WINDOWS\addzv.exe Removed File! : C:\WINDOWS\afeos.dat Removed File! : C:\WINDOWS\aflra.txt Removed File! : C:\WINDOWS\ajevv.dat Removed File! : C:\WINDOWS\ambam.dat Removed File! : C:\WINDOWS\amenu.dat Removed File! : C:\WINDOWS\amxci.dll Removed File! : C:\WINDOWS\anviv.dll Removed File! : C:\WINDOWS\aoafx.txt Removed File! : C:\WINDOWS\apiah32.exe Removed File! : C:\WINDOWS\apiba.exe Removed File! : C:\WINDOWS\apibk32.dll Removed File! : C:\WINDOWS\apibn.exe Removed File! : C:\WINDOWS\apiby32.exe Removed File! : C:\WINDOWS\apien.exe Removed File! : C:\WINDOWS\apier32.exe Removed File! : C:\WINDOWS\apife32.exe Removed File! : C:\WINDOWS\apihm32.exe Removed File! : C:\WINDOWS\apihy32.exe Removed File! : C:\WINDOWS\apijo32.exe Removed File! : C:\WINDOWS\apilg.exe Removed File! : C:\WINDOWS\apils.exe Removed File! : C:\WINDOWS\apimi.exe Removed File! : C:\WINDOWS\apina.exe Removed File! : C:\WINDOWS\apiod32.exe Removed File! : C:\WINDOWS\apiow.exe Removed File! : C:\WINDOWS\apipi32.exe Removed File! : C:\WINDOWS\apiqa.exe Removed File! : C:\WINDOWS\apiqg32.exe Removed File! : C:\WINDOWS\apiqo.exe Removed File! : C:\WINDOWS\apirk32.exe Removed File! : C:\WINDOWS\apisn.exe Removed File! : C:\WINDOWS\apita32.exe Removed File! : C:\WINDOWS\apity32.exe Removed File! : C:\WINDOWS\apitz32.exe Removed File! : C:\WINDOWS\apiup32.exe Removed File! : C:\WINDOWS\apiwd.exe Removed File! : C:\WINDOWS\apixk32.exe Removed File! : C:\WINDOWS\appaj.exe Removed File! : C:\WINDOWS\appav.exe Removed File! : C:\WINDOWS\appay32.exe Removed File! : C:\WINDOWS\appdg.exe Removed File! : C:\WINDOWS\appfm32.exe Removed File! : C:\WINDOWS\appfz.exe Removed File! : C:\WINDOWS\appgv32.dll Removed File! : C:\WINDOWS\apphq32.exe Removed File! : C:\WINDOWS\apphz32.dll Removed File! : C:\WINDOWS\appir.exe Removed File! : C:\WINDOWS\appiz.exe Removed File! : C:\WINDOWS\appkm.exe Removed File! : C:\WINDOWS\appkm32.exe Removed File! : C:\WINDOWS\appkt.dll Removed File! : C:\WINDOWS\apple.exe Removed File! : C:\WINDOWS\appnq32.exe Removed File! : C:\WINDOWS\apppi32.dll Removed File! : C:\WINDOWS\apppj.exe Removed File! : C:\WINDOWS\apppr.exe Removed File! : C:\WINDOWS\appqp32.exe Removed File! : C:\WINDOWS\apprg.exe Removed File! : C:\WINDOWS\apprq32.exe Removed File! : C:\WINDOWS\appvf.exe Removed File! : C:\WINDOWS\appxd.dll Removed File! : C:\WINDOWS\appyl32.exe Removed File! : C:\WINDOWS\appzj.exe Removed File! : C:\WINDOWS\aprbb.txt Removed File! : C:\WINDOWS\apvmu.dll Removed File! : C:\WINDOWS\atlba.exe Removed File! : C:\WINDOWS\atlbo.exe Removed File! : C:\WINDOWS\atlbx.exe Removed File! : C:\WINDOWS\atlcv32.exe Removed File! : C:\WINDOWS\atlho.exe Removed File! : C:\WINDOWS\atlhz.exe Removed File! : C:\WINDOWS\atljd.dll Removed File! : C:\WINDOWS\atllw32.exe Removed File! : C:\WINDOWS\atlnq.exe Removed File! : C:\WINDOWS\atlnw.exe Removed File! : C:\WINDOWS\atloc.dll Removed File! : C:\WINDOWS\atlpa.dll Removed File! : C:\WINDOWS\atlpf.exe Removed File! : C:\WINDOWS\atlpg.exe Removed File! : C:\WINDOWS\atlpg32.exe Removed File! : C:\WINDOWS\atlph32.exe Removed File! : C:\WINDOWS\atlqa.exe Removed File! : C:\WINDOWS\atlqg.exe Removed File! : C:\WINDOWS\atlqn32.exe Removed File! : C:\WINDOWS\atltp32.exe Removed File! : C:\WINDOWS\atlui.exe Removed File! : C:\WINDOWS\atlvt32.dll Removed File! : C:\WINDOWS\atlwc32.exe Removed File! : C:\WINDOWS\atlwd.exe Removed File! : C:\WINDOWS\atlwr.exe Removed File! : C:\WINDOWS\azedy.dat Removed File! : C:\WINDOWS\bacms.dat Removed File! : C:\WINDOWS\bbwyp.txt Removed File! : C:\WINDOWS\bcwbj.log Removed File! : C:\WINDOWS\befmb.txt Removed File! : C:\WINDOWS\bephf.dat Removed File! : C:\WINDOWS\binqx.txt Removed File! : C:\WINDOWS\biuee.dll Removed File! : C:\WINDOWS\bjwet.dll Removed File! : C:\WINDOWS\bkbpc.dat Removed File! : C:\WINDOWS\bkljk.dat Removed File! : C:\WINDOWS\blywv.log Removed File! : C:\WINDOWS\bpvkg.log Removed File! : C:\WINDOWS\brpld.dat Removed File! : C:\WINDOWS\brzun.log Removed File! : C:\WINDOWS\bsicy.dat Removed File! : C:\WINDOWS\btfds.dat Removed File! : C:\WINDOWS\btxkw.dat Removed File! : C:\WINDOWS\btytc.txt Removed File! : C:\WINDOWS\bveeo.log Removed File! : C:\WINDOWS\bvpvq.log Removed File! : C:\WINDOWS\bwyuj.dat Removed File! : C:\WINDOWS\bxcni.log Removed File! : C:\WINDOWS\bxpzp.log Removed File! : C:\WINDOWS\ccasq.dat Removed File! : C:\WINDOWS\cdkmq.txt Removed File! : C:\WINDOWS\cdsjk.txt Removed File! : C:\WINDOWS\cfctt.dat Removed File! : C:\WINDOWS\cfypy.dll Removed File! : C:\WINDOWS\cjdff.dat Removed File! : C:\WINDOWS\cjsql.dat Removed File! : C:\WINDOWS\cjtjf.dat Removed File! : C:\WINDOWS\ckrsf.log Removed File! : C:\WINDOWS\cmdco.log Removed File! : C:\WINDOWS\cmfmq.dat Removed File! : C:\WINDOWS\cowxj.dat Removed File! : C:\WINDOWS\coyqe.log Removed File! : C:\WINDOWS\cqphp.log Removed File! : C:\WINDOWS\crbs.exe Removed File! : C:\WINDOWS\crcm32.exe Removed File! : C:\WINDOWS\cres.exe Removed File! : C:\WINDOWS\crgl32.exe Removed File! : C:\WINDOWS\crhh.dll Removed File! : C:\WINDOWS\crid.exe Removed File! : C:\WINDOWS\crjb32.dll Removed File! : C:\WINDOWS\crki32.exe Removed File! : C:\WINDOWS\crkm.exe Removed File! : C:\WINDOWS\crkt32.exe Removed File! : C:\WINDOWS\crlc32.dll Removed File! : C:\WINDOWS\crlri.dat Removed File! : C:\WINDOWS\crmcz.dat Removed File! : C:\WINDOWS\crmw32.exe Removed File! : C:\WINDOWS\crno.exe Removed File! : C:\WINDOWS\crnv32.exe Removed File! : C:\WINDOWS\crof32.exe Removed File! : C:\WINDOWS\crqh.exe Removed File! : C:\WINDOWS\crsy32.exe Removed File! : C:\WINDOWS\crwf.exe Removed File! : C:\WINDOWS\crwl.exe Removed File! : C:\WINDOWS\crwo32.exe Removed File! : C:\WINDOWS\ctfgu.log Removed File! : C:\WINDOWS\ctwrv.dat Removed File! : C:\WINDOWS\cufyy.dll Removed File! : C:\WINDOWS\czuvq.dll Removed File! : C:\WINDOWS\d3ai32.exe Removed File! : C:\WINDOWS\d3av.exe Removed File! : C:\WINDOWS\d3do32.exe Removed File! : C:\WINDOWS\d3ea.exe Removed File! : C:\WINDOWS\d3gl32.exe Removed File! : C:\WINDOWS\d3ht32.exe Removed File! : C:\WINDOWS\d3ii32.exe Removed File! : C:\WINDOWS\d3mo.exe Removed File! : C:\WINDOWS\d3mu32.exe Removed File! : C:\WINDOWS\d3nr32.exe Removed File! : C:\WINDOWS\d3qv32.exe Removed File! : C:\WINDOWS\d3rc32.exe Removed File! : C:\WINDOWS\d3sp.exe Removed File! : C:\WINDOWS\d3su.exe Removed File! : C:\WINDOWS\dcujo.dll Removed File! : C:\WINDOWS\ddqsb.dat Removed File! : C:\WINDOWS\dfhdp.dat Removed File! : C:\WINDOWS\dgwly.dat Removed File! : C:\WINDOWS\dkdqv.dat Removed File! : C:\WINDOWS\dmarx.dat Removed File! : C:\WINDOWS\dndce.dat Removed File! : C:\WINDOWS\dnfjl.dat Removed File! : C:\WINDOWS\dpnaj.dll Removed File! : C:\WINDOWS\duvlz.dat Removed File! : C:\WINDOWS\dzhyp.log Removed File! : C:\WINDOWS\dzmfn.dll Removed File! : C:\WINDOWS\eaeie.txt Removed File! : C:\WINDOWS\eairn.dat Removed File! : C:\WINDOWS\eaovl.dat Removed File! : C:\WINDOWS\ecbjx.dat Removed File! : C:\WINDOWS\eclwi.log Removed File! : C:\WINDOWS\edmkh.dll Removed File! : C:\WINDOWS\efmge.dat Removed File! : C:\WINDOWS\egaks.dat Removed File! : C:\WINDOWS\eguum.txt Removed File! : C:\WINDOWS\ejkbi.log Removed File! : C:\WINDOWS\ennkb.dat Removed File! : C:\WINDOWS\eoswj.txt Removed File! : C:\WINDOWS\epjsr.dat Removed File! : C:\WINDOWS\epncv.dat Removed File! : C:\WINDOWS\erccm.dat Removed File! : C:\WINDOWS\euong.dll Removed File! : C:\WINDOWS\fcdyj.dat Removed File! : C:\WINDOWS\fcucv.dat Removed File! : C:\WINDOWS\fektt.dll Removed File! : C:\WINDOWS\fexcs.dat Removed File! : C:\WINDOWS\fggbj.dat Removed File! : C:\WINDOWS\fibja.log Removed File! : C:\WINDOWS\fimpp.dat Removed File! : C:\WINDOWS\fixiu.dat Removed File! : C:\WINDOWS\fjacv.log Removed File! : C:\WINDOWS\fmyum.txt Removed File! : C:\WINDOWS\foqnq.log Removed File! : C:\WINDOWS\fozan.txt Removed File! : C:\WINDOWS\frcfx.txt Removed File! : C:\WINDOWS\frqrg.log Removed File! : C:\WINDOWS\fulrz.dat Removed File! : C:\WINDOWS\fxqlq.dat Removed File! : C:\WINDOWS\ggizc.log Removed File! : C:\WINDOWS\ghhgx.dat Removed File! : C:\WINDOWS\ghxcf.dll Removed File! : C:\WINDOWS\gmzak.dat Removed File! : C:\WINDOWS\goqjn.txt Removed File! : C:\WINDOWS\gotaw.log Removed File! : C:\WINDOWS\gtqqq.log Removed File! : C:\WINDOWS\gwaew.txt Removed File! : C:\WINDOWS\gwgqk.dat Removed File! : C:\WINDOWS\gyeqs.dat Removed File! : C:\WINDOWS\gyqqk.log Removed File! : C:\WINDOWS\gyyik.txt Removed File! : C:\WINDOWS\haeuz.txt Removed File! : C:\WINDOWS\hfrvs.log Removed File! : C:\WINDOWS\hidpl.dat Removed File! : C:\WINDOWS\hntxf.dat Removed File! : C:\WINDOWS\hqdnb.log Removed File! : C:\WINDOWS\htjei.dat Removed File! : C:\WINDOWS\htztt.txt Removed File! : C:\WINDOWS\hwkce.log Removed File! : C:\WINDOWS\hxbmx.dat Removed File! : C:\WINDOWS\hxfik.dll Removed File! : C:\WINDOWS\hxmpx.txt Removed File! : C:\WINDOWS\hyzlz.dat Removed File! : C:\WINDOWS\icagu.dat Removed File! : C:\WINDOWS\icktb.log Removed File! : C:\WINDOWS\iecw.dll Removed File! : C:\WINDOWS\iedz32.exe Removed File! : C:\WINDOWS\ieea.exe Removed File! : C:\WINDOWS\ieem.dll Removed File! : C:\WINDOWS\ieeq32.exe Removed File! : C:\WINDOWS\iees32.exe Removed File! : C:\WINDOWS\iefo.exe Removed File! : C:\WINDOWS\iegu32.exe Removed File! : C:\WINDOWS\iehq.exe Removed File! : C:\WINDOWS\ieij.exe Removed File! : C:\WINDOWS\ieix32.exe Removed File! : C:\WINDOWS\ieja32.exe Removed File! : C:\WINDOWS\iejl32.exe Removed File! : C:\WINDOWS\ieky32.dll Removed File! : C:\WINDOWS\ielb32.dll Removed File! : C:\WINDOWS\ielh.exe Removed File! : C:\WINDOWS\ielm32.dll Removed File! : C:\WINDOWS\iend32.exe Removed File! : C:\WINDOWS\iepi32.exe Removed File! : C:\WINDOWS\iepy.exe Removed File! : C:\WINDOWS\ieub.exe Removed File! : C:\WINDOWS\ieuq.exe Removed File! : C:\WINDOWS\ievg32.exe Removed File! : C:\WINDOWS\ievk.exe Removed File! : C:\WINDOWS\ievr.exe Removed File! : C:\WINDOWS\ievt.dll Removed File! : C:\WINDOWS\iewa32.exe Removed File! : C:\WINDOWS\iewp.exe Removed File! : C:\WINDOWS\ieyg32.exe Removed File! : C:\WINDOWS\ieyw32.exe Removed File! : C:\WINDOWS\ieza32.exe Removed File! : C:\WINDOWS\iezm32.exe Removed File! : C:\WINDOWS\ifhdn.dat Removed File! : C:\WINDOWS\ifpyu.dll Removed File! : C:\WINDOWS\ihvld.txt Removed File! : C:\WINDOWS\iixnj.txt Removed File! : C:\WINDOWS\ijlsb.dat Removed File! : C:\WINDOWS\ijnkk.txt Removed File! : C:\WINDOWS\iodlc.dat Removed File! : C:\WINDOWS\iofyt.dat Removed File! : C:\WINDOWS\ipaf.exe Removed File! : C:\WINDOWS\ipal.exe Removed File! : C:\WINDOWS\ipbd.exe Removed File! : C:\WINDOWS\ipbw32.exe Removed File! : C:\WINDOWS\ipch32.exe Removed File! : C:\WINDOWS\ipih.exe Removed File! : C:\WINDOWS\ipkg32.exe Removed File! : C:\WINDOWS\ipko32.exe Removed File! : C:\WINDOWS\ipnt.dll Removed File! : C:\WINDOWS\ipoe.exe Removed File! : C:\WINDOWS\ippa32.exe Removed File! : C:\WINDOWS\ippo.exe Removed File! : C:\WINDOWS\ipqp32.exe Removed File! : C:\WINDOWS\iprk.exe Removed File! : C:\WINDOWS\ipry.exe Removed File! : C:\WINDOWS\ipsa.exe Removed File! : C:\WINDOWS\iptc32.exe Removed File! : C:\WINDOWS\ipte32.exe Removed File! : C:\WINDOWS\iptn32.exe Removed File! : C:\WINDOWS\ipur.exe Removed File! : C:\WINDOWS\ipvi32.exe Removed File! : C:\WINDOWS\ipvp.exe Removed File! : C:\WINDOWS\ipvx32.exe Removed File! : C:\WINDOWS\ipxb32.exe Removed File! : C:\WINDOWS\ipxj.exe Removed File! : C:\WINDOWS\ipxu.exe Removed File! : C:\WINDOWS\iqaty.txt Removed File! : C:\WINDOWS\iqump.txt Removed File! : C:\WINDOWS\irljg.dat Removed File! : C:\WINDOWS\isiia.dat Removed File! : C:\WINDOWS\isotw.dat Removed File! : C:\WINDOWS\ispxm.dat Removed File! : C:\WINDOWS\isxck.txt Removed File! : C:\WINDOWS\iuemi.txt Removed File! : C:\WINDOWS\ivmbe.dat Removed File! : C:\WINDOWS\ivwcv.dat Removed File! : C:\WINDOWS\ixqze.log Removed File! : C:\WINDOWS\izbra.dat Removed File! : C:\WINDOWS\jaofc.dll Removed File! : C:\WINDOWS\javabr.exe Removed File! : C:\WINDOWS\javaci32.exe Removed File! : C:\WINDOWS\javaco.exe Removed File! : C:\WINDOWS\javaeg32.exe Removed File! : C:\WINDOWS\javagd32.exe Removed File! : C:\WINDOWS\javagy.dll Removed File! : C:\WINDOWS\javahf.exe Removed File! : C:\WINDOWS\javajg32.exe Removed File! : C:\WINDOWS\javaji.exe Removed File! : C:\WINDOWS\javakf32.exe Removed File! : C:\WINDOWS\javakq.exe Removed File! : C:\WINDOWS\javalw.exe Removed File! : C:\WINDOWS\javaoc32.exe.bak Removed File! : C:\WINDOWS\javapg32.exe Removed File! : C:\WINDOWS\javapr.exe Removed File! : C:\WINDOWS\javaqp.exe Removed File! : C:\WINDOWS\javaqu.dll Removed File! : C:\WINDOWS\javarx32.exe Removed File! : C:\WINDOWS\javavx.exe Removed File! : C:\WINDOWS\javawb32.exe Removed File! : C:\WINDOWS\javawk.exe Removed File! : C:\WINDOWS\javaxu.exe Removed File! : C:\WINDOWS\javayq32.exe Removed File! : C:\WINDOWS\javazk32.exe Removed File! : C:\WINDOWS\javazn32.exe Removed File! : C:\WINDOWS\jcbre.dll Removed File! : C:\WINDOWS\jcdaw.dat Removed File! : C:\WINDOWS\jcjdl.log Removed File! : C:\WINDOWS\jdfvg.txt Removed File! : C:\WINDOWS\jdufe.txt Removed File! : C:\WINDOWS\jebgi.dat Removed File! : C:\WINDOWS\jhesx.dat Removed File! : C:\WINDOWS\jiexs.txt Removed File! : C:\WINDOWS\jiqof.dll Removed File! : C:\WINDOWS\jlxxb.dat Removed File! : C:\WINDOWS\jlzqx.txt Removed File! : C:\WINDOWS\jnock.txt Removed File! : C:\WINDOWS\jpwcn.dat Removed File! : C:\WINDOWS\jqmhg.dat Removed File! : C:\WINDOWS\jqrci.log Removed File! : C:\WINDOWS\jrasq.dat Removed File! : C:\WINDOWS\jucej.dat Removed File! : C:\WINDOWS\jvhuz.dat Removed File! : C:\WINDOWS\jwmop.txt Removed File! : C:\WINDOWS\jxgjj.dat Removed File! : C:\WINDOWS\kdhfb.txt Removed File! : C:\WINDOWS\khvno.log Removed File! : C:\WINDOWS\kmcoi.dat Removed File! : C:\WINDOWS\kmehh.dat Removed File! : C:\WINDOWS\kndsp.dat Removed File! : C:\WINDOWS\knglc.dat Removed File! : C:\WINDOWS\knxdd.dat Removed File! : C:\WINDOWS\kojpm.dat Removed File! : C:\WINDOWS\kqhyo.dat Removed File! : C:\WINDOWS\krclr.log Removed File! : C:\WINDOWS\kscor.log Removed File! : C:\WINDOWS\kuhks.dat Removed File! : C:\WINDOWS\kwhja.dat Removed File! : C:\WINDOWS\larzq.txt Removed File! : C:\WINDOWS\lbspu.txt Removed File! : C:\WINDOWS\lhhin.dat Removed File! : C:\WINDOWS\ligtr.dat Removed File! : C:\WINDOWS\ljpte.log Removed File! : C:\WINDOWS\lozym.dll Removed File! : C:\WINDOWS\lptwi.log Removed File! : C:\WINDOWS\lteag.dat Removed File! : C:\WINDOWS\ludtc.dat Removed File! : C:\WINDOWS\lvsnz.log Removed File! : C:\WINDOWS\lwmfv.txt Removed File! : C:\WINDOWS\lwwxl.dat Removed File! : C:\WINDOWS\lzdvn.dll Removed File! : C:\WINDOWS\mbxxf.txt Removed File! : C:\WINDOWS\mdhqe.txt Removed File! : C:\WINDOWS\mfcah32.dll Removed File! : C:\WINDOWS\mfcap32.exe Removed File! : C:\WINDOWS\mfcdq.exe Removed File! : C:\WINDOWS\mfcen.exe Removed File! : C:\WINDOWS\mfcep32.exe Removed File! : C:\WINDOWS\mfcfa.exe Removed File! : C:\WINDOWS\mfchw32.exe Removed File! : C:\WINDOWS\mfcip.exe Removed File! : C:\WINDOWS\mfcjd32.exe Removed File! : C:\WINDOWS\mfckd32.exe Removed File! : C:\WINDOWS\mfcls.exe Removed File! : C:\WINDOWS\mfcmq32.exe Removed File! : C:\WINDOWS\mfcng.exe Removed File! : C:\WINDOWS\mfcpb32.exe Removed File! : C:\WINDOWS\mfcpe32.exe Removed File! : C:\WINDOWS\mfcqp.exe Removed File! : C:\WINDOWS\mfctm32.exe Removed File! : C:\WINDOWS\mfctr32.exe Removed File! : C:\WINDOWS\mfcts.dll Removed File! : C:\WINDOWS\mfcvm.exe Removed File! : C:\WINDOWS\mfcwd32.exe Removed File! : C:\WINDOWS\mfcyo.exe Removed File! : C:\WINDOWS\mfcyt.exe Removed File! : C:\WINDOWS\mfczk32.exe Removed File! : C:\WINDOWS\mfqer.txt Removed File! : C:\WINDOWS\mgrxk.dat Removed File! : C:\WINDOWS\mimmu.txt Removed File! : C:\WINDOWS\miuye.dat Removed File! : C:\WINDOWS\mkpoz.dat Removed File! : C:\WINDOWS\mnarp.log Removed File! : C:\WINDOWS\moipd.log Removed File! : C:\WINDOWS\msbf32.exe Removed File! : C:\WINDOWS\msbm32.exe Removed File! : C:\WINDOWS\msck32.exe Removed File! : C:\WINDOWS\msdh.dll Removed File! : C:\WINDOWS\msdr.exe Removed File! : C:\WINDOWS\msfj.exe Removed File! : C:\WINDOWS\msft32.dll Removed File! : C:\WINDOWS\mshrr.dat Removed File! : C:\WINDOWS\msic.exe Removed File! : C:\WINDOWS\msjn.exe Removed File! : C:\WINDOWS\msml32.exe Removed File! : C:\WINDOWS\msnr32.dll Removed File! : C:\WINDOWS\msnr32.exe Removed File! : C:\WINDOWS\msnz.exe Removed File! : C:\WINDOWS\msoj32.exe Removed File! : C:\WINDOWS\mspv32.exe Removed File! : C:\WINDOWS\mspw32.dll Removed File! : C:\WINDOWS\msrk.exe.bak Removed File! : C:\WINDOWS\msro.exe Removed File! : C:\WINDOWS\mstt32.dll Removed File! : C:\WINDOWS\mstv.exe Removed File! : C:\WINDOWS\mswd.exe Removed File! : C:\WINDOWS\mswx.exe Removed File! : C:\WINDOWS\msxk.exe Removed File! : C:\WINDOWS\mtbpt.log Removed File! : C:\WINDOWS\muhtp.log Removed File! : C:\WINDOWS\mupbo.log Removed File! : C:\WINDOWS\mwlun.log Removed File! : C:\WINDOWS\mznly.txt Removed File! : C:\WINDOWS\naghl.txt Removed File! : C:\WINDOWS\napts.txt Removed File! : C:\WINDOWS\ndepq.dat Removed File! : C:\WINDOWS\netah32.exe Removed File! : C:\WINDOWS\netbv32.exe Removed File! : C:\WINDOWS\netea.exe Removed File! : C:\WINDOWS\netew32.exe Removed File! : C:\WINDOWS\nethy32.dll Removed File! : C:\WINDOWS\netjs.dll Removed File! : C:\WINDOWS\netln.exe Removed File! : C:\WINDOWS\netoc32.dll Removed File! : C:\WINDOWS\netpw.exe Removed File! : C:\WINDOWS\netrl.exe Removed File! : C:\WINDOWS\netsy.exe Removed File! : C:\WINDOWS\netue.exe Removed File! : C:\WINDOWS\netxl32.exe Removed File! : C:\WINDOWS\netyj32.exe Removed File! : C:\WINDOWS\netyk.exe Removed File! : C:\WINDOWS\netzk.exe Removed File! : C:\WINDOWS\netzl32.exe Removed File! : C:\WINDOWS\netzy.exe Removed File! : C:\WINDOWS\nfcbr.dat Removed File! : C:\WINDOWS\nfwqj.txt Removed File! : C:\WINDOWS\nhcgj.txt Removed File! : C:\WINDOWS\niffh.txt Removed File! : C:\WINDOWS\niiot.log Removed File! : C:\WINDOWS\njesk.txt Removed File! : C:\WINDOWS\nkycq.txt Removed File! : C:\WINDOWS\nqbsa.dat Removed File! : C:\WINDOWS\nqdmm.log Removed File! : C:\WINDOWS\nrsad.log Removed File! : C:\WINDOWS\ntai.exe Removed File! : C:\WINDOWS\ntbr32.dll Removed File! : C:\WINDOWS\ntck32.exe Removed File! : C:\WINDOWS\ntgd.exe Removed File! : C:\WINDOWS\ntgp32.exe Removed File! : C:\WINDOWS\nthd.exe Removed File! : C:\WINDOWS\nthr.exe Removed File! : C:\WINDOWS\ntiw.exe Removed File! : C:\WINDOWS\ntjw32.exe Removed File! : C:\WINDOWS\ntjz.exe Removed File! : C:\WINDOWS\ntkc32.exe Removed File! : C:\WINDOWS\ntkg.exe Removed File! : C:\WINDOWS\ntoa32.exe Removed File! : C:\WINDOWS\ntok.exe Removed File! : C:\WINDOWS\ntos32.exe Removed File! : C:\WINDOWS\ntpl.exe Removed File! : C:\WINDOWS\ntpv.exe Removed File! : C:\WINDOWS\ntqa.exe Removed File! : C:\WINDOWS\ntqz.exe Removed File! : C:\WINDOWS\ntrd32.exe Removed File! : C:\WINDOWS\ntrg.exe Removed File! : C:\WINDOWS\ntrv.exe Removed File! : C:\WINDOWS\ntrw32.exe Removed File! : C:\WINDOWS\nttp32.exe Removed File! : C:\WINDOWS\ntuc.exe Removed File! : C:\WINDOWS\ntuf.exe Removed File! : C:\WINDOWS\ntuu32.exe Removed File! : C:\WINDOWS\ntve32.exe Removed File! : C:\WINDOWS\ntwd32.exe Removed File! : C:\WINDOWS\ntwq.exe Removed File! : C:\WINDOWS\ntwwo.dat Removed File! : C:\WINDOWS\ntxe.dll Removed File! : C:\WINDOWS\ntye32.exe Removed File! : C:\WINDOWS\nvzlp.dat Removed File! : C:\WINDOWS\nwfyb.dat Removed File! : C:\WINDOWS\nwjju.log Removed File! : C:\WINDOWS\nyleg.dat Removed File! : C:\WINDOWS\nyyfz.dat Removed File! : C:\WINDOWS\nzyoo.txt Removed File! : C:\WINDOWS\n_aactdp.log Removed File! : C:\WINDOWS\n_aphwrm.log Removed File! : C:\WINDOWS\n_asxvkq.txt Removed File! : C:\WINDOWS\n_berkjg.dat Removed File! : C:\WINDOWS\n_bfphub.log Removed File! : C:\WINDOWS\n_bnczld.log Removed File! : C:\WINDOWS\n_buvmdn.dat Removed File! : C:\WINDOWS\n_byysvu.txt Removed File! : C:\WINDOWS\n_celjfv.log Removed File! : C:\WINDOWS\n_cxebzo.log Removed File! : C:\WINDOWS\n_cyhnqv.txt Removed File! : C:\WINDOWS\n_dasbfx.dat Removed File! : C:\WINDOWS\n_ddnkll.txt Removed File! : C:\WINDOWS\n_dezlvi.dat Removed File! : C:\WINDOWS\n_dgvlyz.log Removed File! : C:\WINDOWS\n_dkhyyk.txt Removed File! : C:\WINDOWS\n_dsvytq.dat Removed File! : C:\WINDOWS\n_dtexmq.dat Removed File! : C:\WINDOWS\n_edtybc.log Removed File! : C:\WINDOWS\n_eggewe.txt Removed File! : C:\WINDOWS\n_ejwlnk.log Removed File! : C:\WINDOWS\n_elvgau.dat Removed File! : C:\WINDOWS\n_enhpot.dat Removed File! : C:\WINDOWS\n_eveizu.txt Removed File! : C:\WINDOWS\n_ewbtqe.dat Removed File! : C:\WINDOWS\n_ewiqxr.txt Removed File! : C:\WINDOWS\n_fmlmfl.log Removed File! : C:\WINDOWS\n_fuymhg.txt Removed File! : C:\WINDOWS\n_fwhoxg.txt Removed File! : C:\WINDOWS\n_fwytdc.log Removed File! : C:\WINDOWS\n_fzveds.dat Removed File! : C:\WINDOWS\n_gggitd.dat Removed File! : C:\WINDOWS\n_gkqilk.log Removed File! : C:\WINDOWS\n_gngdpq.log Removed File! : C:\WINDOWS\n_goqjnc.dat Removed File! : C:\WINDOWS\n_gqmowz.log Removed File! : C:\WINDOWS\n_gztzdx.txt Removed File! : C:\WINDOWS\n_hhdbja.log Removed File! : C:\WINDOWS\n_hkwmgg.txt Removed File! : C:\WINDOWS\n_hpddmv.txt Removed File! : C:\WINDOWS\n_hqjktq.log Removed File! : C:\WINDOWS\n_hthzcz.dat Removed File! : C:\WINDOWS\n_hugmpa.txt Removed File! : C:\WINDOWS\n_hyxpuj.log Removed File! : C:\WINDOWS\n_ibwiie.dat Removed File! : C:\WINDOWS\n_ipxjqw.dat Removed File! : C:\WINDOWS\n_irmjia.dat Removed File! : C:\WINDOWS\n_iuvahp.txt Removed File! : C:\WINDOWS\n_iwkxtr.dat Removed File! : C:\WINDOWS\n_jbvpij.log Removed File! : C:\WINDOWS\n_jebqdq.txt Removed File! : C:\WINDOWS\n_jewcar.txt Removed File! : C:\WINDOWS\n_jgfyjs.txt Removed File! : C:\WINDOWS\n_jgzcea.txt Removed File! : C:\WINDOWS\n_jiexss.log Removed File! : C:\WINDOWS\n_jjqeat.dat Removed File! : C:\WINDOWS\n_jkfhrp.dat Removed File! : C:\WINDOWS\n_jklllz.dat Removed File! : C:\WINDOWS\n_jlkmpm.dat Removed File! : C:\WINDOWS\n_jluifl.txt Removed File! : C:\WINDOWS\n_jmkpft.txt Removed File! : C:\WINDOWS\n_kabvtw.dat Removed File! : C:\WINDOWS\n_kqnhoy.log Removed File! : C:\WINDOWS\n_kvejxv.log Removed File! : C:\WINDOWS\n_kxwlgs.dat Removed File! : C:\WINDOWS\n_lfawwf.txt Removed File! : C:\WINDOWS\n_lfciyl.dat Removed File! : C:\WINDOWS\n_lijaxv.dat Removed File! : C:\WINDOWS\n_lkfgvd.dat Removed File! : C:\WINDOWS\n_lkjijk.txt Removed File! : C:\WINDOWS\n_lkvrwb.log Removed File! : C:\WINDOWS\n_lmuvwy.log Removed File! : C:\WINDOWS\n_lsbwjc.txt Removed File! : C:\WINDOWS\n_lsksyx.log Removed File! : C:\WINDOWS\n_ltxbdc.log Removed File! : C:\WINDOWS\n_miewtz.log Removed File! : C:\WINDOWS\n_mkyjzw.dat Removed File! : C:\WINDOWS\n_mnmlhy.txt Removed File! : C:\WINDOWS\n_mowqdk.log Removed File! : C:\WINDOWS\n_moydft.dat Removed File! : C:\WINDOWS\n_mpixvq.txt Removed File! : C:\WINDOWS\n_mwxuap.log Removed File! : C:\WINDOWS\n_mxstxk.txt Removed File! : C:\WINDOWS\n_nikagi.dat Removed File! : C:\WINDOWS\n_nomker.log Removed File! : C:\WINDOWS\n_nuzbiq.dat Removed File! : C:\WINDOWS\n_nwhfcx.log Removed File! : C:\WINDOWS\n_nysrxe.dat Removed File! : C:\WINDOWS\n_nzsuvr.txt Removed File! : C:\WINDOWS\n_ocmppj.txt Removed File! : C:\WINDOWS\n_omnowf.txt Removed File! : C:\WINDOWS\n_ongrzg.txt Removed File! : C:\WINDOWS\n_otmfml.txt Removed File! : C:\WINDOWS\n_otxqzd.log Removed File! : C:\WINDOWS\n_ovyqaq.txt Removed File! : C:\WINDOWS\n_owgkpa.log Removed File! : C:\WINDOWS\n_pbvpwv.dat Removed File! : C:\WINDOWS\n_pekmca.dat Removed File! : C:\WINDOWS\n_pgdozf.txt Removed File! : C:\WINDOWS\n_phkzdl.log Removed File! : C:\WINDOWS\n_pjkxov.dat Removed File! : C:\WINDOWS\n_plljks.dat Removed File! : C:\WINDOWS\n_pmysjg.txt Removed File! : C:\WINDOWS\n_pokrxo.txt Removed File! : C:\WINDOWS\n_qekwra.txt Removed File! : C:\WINDOWS\n_qfqgch.dat Removed File! : C:\WINDOWS\n_quirop.log Removed File! : C:\WINDOWS\n_qvblex.dat Removed File! : C:\WINDOWS\n_qytsqm.dat Removed File! : C:\WINDOWS\n_rcwoic.log Removed File! : C:\WINDOWS\n_reomfb.log Removed File! : C:\WINDOWS\n_rhuouq.txt Removed File! : C:\WINDOWS\n_richod.dat Removed File! : C:\WINDOWS\n_rnrhtr.log Removed File! : C:\WINDOWS\n_rvpyig.log Removed File! : C:\WINDOWS\n_ryadqd.txt Removed File! : C:\WINDOWS\n_rzytis.txt Removed File! : C:\WINDOWS\n_sbtmoh.txt Removed File! : C:\WINDOWS\n_sotlyr.txt Removed File! : C:\WINDOWS\n_sykljc.dat Removed File! : C:\WINDOWS\n_tdhvda.dat Removed File! : C:\WINDOWS\n_teaxfm.dat Removed File! : C:\WINDOWS\n_tjnebk.log Removed File! : C:\WINDOWS\n_tlgytb.txt Removed File! : C:\WINDOWS\n_tlwwih.log Removed File! : C:\WINDOWS\n_ttstoz.log Removed File! : C:\WINDOWS\n_turyem.txt Removed File! : C:\WINDOWS\n_tvyrez.txt Removed File! : C:\WINDOWS\n_tyrhme.dat Removed File! : C:\WINDOWS\n_uaasiv.log Removed File! : C:\WINDOWS\n_uetipf.log Removed File! : C:\WINDOWS\n_uhgszg.log Removed File! : C:\WINDOWS\n_uiqtmv.txt Removed File! : C:\WINDOWS\n_ujtyxe.txt Removed File! : C:\WINDOWS\n_upnsdy.txt Removed File! : C:\WINDOWS\n_utmemm.txt Removed File! : C:\WINDOWS\n_uudavl.txt Removed File! : C:\WINDOWS\n_uxanfb.dat Removed File! : C:\WINDOWS\n_uxtwgp.txt Removed File! : C:\WINDOWS\n_vwvupc.log Removed File! : C:\WINDOWS\n_wbrsgp.log Removed File! : C:\WINDOWS\n_wkrnen.txt Removed File! : C:\WINDOWS\n_wqryni.log Removed File! : C:\WINDOWS\n_wsbgcm.txt Removed File! : C:\WINDOWS\n_wsrlfb.dat Removed File! : C:\WINDOWS\n_wtxwxz.txt Removed File! : C:\WINDOWS\n_wudxfz.log Removed File! : C:\WINDOWS\n_wvxkgo.dat Removed File! : C:\WINDOWS\n_wyuyzp.log Removed File! : C:\WINDOWS\n_xidvsd.log Removed File! : C:\WINDOWS\n_xjylpu.dat Removed File! : C:\WINDOWS\n_xngoje.log Removed File! : C:\WINDOWS\n_xniulk.log Removed File! : C:\WINDOWS\n_xnizxv.txt Removed File! : C:\WINDOWS\n_xpassg.log Removed File! : C:\WINDOWS\n_xpocvz.txt Removed File! : C:\WINDOWS\n_xpurvv.dat Removed File! : C:\WINDOWS\n_xqnthh.txt Removed File! : C:\WINDOWS\n_xrojkk.dat Removed File! : C:\WINDOWS\n_xsdchl.dat Removed File! : C:\WINDOWS\n_xyvslm.dat Removed File! : C:\WINDOWS\n_yaojpe.log Removed File! : C:\WINDOWS\n_yhttwr.txt Removed File! : C:\WINDOWS\n_yoqman.dat Removed File! : C:\WINDOWS\n_ypwgrk.txt Removed File! : C:\WINDOWS\n_ywwchn.log Removed File! : C:\WINDOWS\n_yznooh.txt Removed File! : C:\WINDOWS\n_zkafxr.log Removed File! : C:\WINDOWS\n_zqswtb.dat Removed File! : C:\WINDOWS\n_zrfdsc.log Removed File! : C:\WINDOWS\n_zstvir.txt Removed File! : C:\WINDOWS\n_zxcgce.txt Removed File! : C:\WINDOWS\oakay.dat Removed File! : C:\WINDOWS\obvze.dll Removed File! : C:\WINDOWS\ocrhe.log Removed File! : C:\WINDOWS\oddcr.dll Removed File! : C:\WINDOWS\ofmnw.dat Removed File! : C:\WINDOWS\oiesh.txt Removed File! : C:\WINDOWS\okyis.dat Removed File! : C:\WINDOWS\oncsv.log Removed File! : C:\WINDOWS\oqeff.dat Removed File! : C:\WINDOWS\oqtaw.dat Removed File! : C:\WINDOWS\oqvwp.dat Removed File! : C:\WINDOWS\oqzfz.txt Removed File! : C:\WINDOWS\orpjl.dat Removed File! : C:\WINDOWS\owjnb.dat Removed File! : C:\WINDOWS\paadt.dat Removed File! : C:\WINDOWS\pcjgu.dat Removed File! : C:\WINDOWS\peect.dat Removed File! : C:\WINDOWS\pemgl.dat Removed File! : C:\WINDOWS\pgtxn.txt Removed File! : C:\WINDOWS\pgvbz.log Removed File! : C:\WINDOWS\phnih.txt Removed File! : C:\WINDOWS\pizjv.log Removed File! : C:\WINDOWS\pptig.dat Removed File! : C:\WINDOWS\ptokh.log Removed File! : C:\WINDOWS\pwvrf.txt Removed File! : C:\WINDOWS\pxoow.dat Removed File! : C:\WINDOWS\pzxic.dat Removed File! : C:\WINDOWS\qawve.txt Removed File! : C:\WINDOWS\qbcbu.dat Removed File! : C:\WINDOWS\qeeai.log Removed File! : C:\WINDOWS\qezzn.log Removed File! : C:\WINDOWS\qhnzp.txt Removed File! : C:\WINDOWS\qjkhu.dat Removed File! : C:\WINDOWS\qmdxy.log Removed File! : C:\WINDOWS\qmjha.dll Removed File! : C:\WINDOWS\qqbzv.log Removed File! : C:\WINDOWS\qrpeu.dll Removed File! : C:\WINDOWS\qsckv.txt Removed File! : C:\WINDOWS\qsrly.dll Removed File! : C:\WINDOWS\qstkd.log Removed File! : C:\WINDOWS\qsuxi.dat Removed File! : C:\WINDOWS\qtaag.dat Removed File! : C:\WINDOWS\qtaxc.log Removed File! : C:\WINDOWS\quztn.dat Removed File! : C:\WINDOWS\qwkkn.log Removed File! : C:\WINDOWS\qxwos.dat

Siggyx

Post #15April 27, 2006, 3:06 PM UTC

The disabling of Notepad is part of the infection. Please scan with Ewido again, in safe mode, fix whats it finds and then post a new hijackthis log please.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Spyware and Viruses?

✨ Ask AI

Ask AI