Surf Sidekick Removal Help

staniv

Welcome to Tom Coyote, sorry for the delay in responding but we are just overwhelmed with logs.

You have a few things we need to work on, but lets do this first.


Download Brute Force Uninstaller to your desktop.

• Right click the file on your Desktop, and choose Extract All.
• Click Next.
• In the box to choose where to extract the files to:
• Click Browse.
• Click on the + sign next to My Computer
• Click on Local Disk (C:) or whatever your primary drive is.
• Click Make New Folder
• Type in BFU
• Click Next, and uncheck the Show Extracted Files box and then click Finish.

Download sidekickFix.bat (rightclick on that link and choose save as)

• Place sidekickFix.bat in your C:\BFU - folder. (Important!)
• Close all browsers and explorer folders.
• Double-click on sidekickFix.bat
• Click Yes and follow the prompts, when prompted to restart the PC please do so.

Post a new HJT log please.

staniv

Your HIJACKTHIS program is current, but it is very important that it resides in its own folder.
We will use Hijackthis (HJT) to make changes to your system and HJT will make backups of those changes,
If HJT is not in its own folder, those backups could be lost.

Easy to fix,
* just go to My Computer > YOUR C:\ DRIVE and create a new folder and name it Hijackthis.
* Now scroll to where you have HJT currently, right click on the HJT icon and select CUT .
* Now open the new folder you just created and right click within that folder and select PASTE .
* Now HJT should reside in C:\Hijackthis\Hijackthis.exe


Please do not proceed until you move HJT to it's own folder.




spywarebegone This is on our list of non recommended programs, I suggest you uninstall it via the Add-Remove Programs in the Control Panel.




* Click on My Computer
* Then on your C: Drive
* Then to Tools/ Folder Options/ View
* Choose the radio button to Show Hidden Files and Folders
* Take the checkmark out of Hide Extensions for Known File Types
* Then Apply/ OK




Download and install the 30 day trial of Ewido Anti-Spyware from HERE and save that file to your desktop.

* Once you have downloaded Ewido Anti-Spyware, locate the icon on the desktop and double-click it to launch the set up program.
* Once the setup is complete you will need run Ewido and update the definition files.
* On the main screen select the icon Update then select the Update now link.
* Next select the Start Update button, the update will start and a progress bar will show the updates being installed.
* Once the update has completed select the Scanner icon at the top of the screen, then select the Settings tab.
* Once in the Settings screen click on Recommended actions and then select Quarantine
* Under Reports
* Select Automatically generate report after every scan
* Un-Select Only if threats were found
* Close Ewido Anti-Spyware <– Do not run the scan yet.


You can delete the folder you already created for Surfside
2. Please download Brute Force Uninstaller to your desktop.

• Right click the BFU folder on your desktop, and choose Extract All
• Click "Next"
• In the box to choose where to extract the files to,
• Click "Browse"
• Click on the + sign next to "My Computer"
• Click on "Local Disk (C:) or whatever your primary drive is
• Click "Make New Folder"
• Type in BFU
• Click "Next", and Uncheck the "Show Extracted Files" box and then click "Finish".

3. RIGHT-CLICK HERE and choose "Save As" (in IE it's "Save Target As") in order to download Alcra PLUS Remover.
Save it in the same folder you made earlier (c:\BFU).

Do not do anything with these yet!




Boot your computer into Safemode

* Go to Start> Shut Off your Computer> Restart
* As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,
this will bring up a menu.
* Use the Up and Down Arrow Keys to scroll up to SAFEMODE
* Then press the Enter on your Keyboard

IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning proccess:

* Lauch Ewido-Anti-Spyware by double-clicking the icon on your desktop.
* Select the Scanner icon at the top and then the Scan tab then click on Complete System Scan.
* Ewido will now begin the scanning process, be patient this may take a little time.
* Once the scan is complete do the following:
* If you have any infections you will prompted, then select Apply all actions
* Next select the Reports icon at the top.
* Select the Save report as button in the lower left hand of the screen and save it to a text file on your system
*** make sure to remember where you saved that file, this is important
* Close Ewido



5. Then, please go to Start > My Computer and navigate to the C:\BFU folder.

• Start the Brute Force Uninstaller by doubleclicking BFU.exe
• Behind the scriptline to execute field click the folder icon [external image: Posted Image] and select alcanshorty.bfu
• Press Execute and let the program do it’s job. (You ought to see a progress bar if you did this correctly.)
• Wait for the complete script execution box to pop up and press OK.
• Press exit to terminate the BFU program.

Reboot into normal windows and post the contents of Ewido text report that you saved and a new HiJackThis log.

——————————————————— ewido anti-spyware - Scan Report ——————————————————— + Created at: 9:51:59 PM 8/14/2006 + Scan result: C:\WINDOWS\system32\nodeipproc.dll -> Adware.BHO : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP184\A0013671.dll -> Adware.CASClient : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015854.dll -> Adware.CASClient : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP186\A0015714.EXE -> Adware.CommAd : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP186\A0015715.DLL -> Adware.CommAd : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP182\A0013601.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP183\A0013621.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP183\A0013631.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP184\A0013640.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP184\A0013641.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP184\A0013652.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP184\A0013655.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP184\A0013662.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP185\A0013697.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP185\A0013698.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP185\A0013702.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP186\A0014710.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP186\A0015695.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP186\A0015717.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP186\A0015730.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP187\A0015738.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP187\A0015739.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP187\A0015740.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP187\A0015741.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP187\A0015742.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP187\A0015743.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP187\A0015744.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP187\A0015745.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP187\A0015746.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP187\A0015747.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP187\A0015748.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP187\A0015752.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP187\A0015774.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015851.exe -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015852.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015902.exe -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015922.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015923.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP190\A0016044.exe -> Adware.Look2Me : Cleaned with backup (quarantined). C:\Program Files\PSLister\PSLister.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015861.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015864.exe -> Adware.SearchAssistant : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015866.exe -> Adware.SearchAssistant : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015888.exe -> Adware.SearchAssistant : Cleaned with backup (quarantined). C:\WINDOWS\system32\ghynf.exe -> Adware.SearchAssistant : Cleaned with backup (quarantined). C:\WINDOWS\system32ghynf.exe -> Adware.SearchAssistant : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP182\A0013597.dll -> Adware.Softomate : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015865.exe -> Adware.Suggestor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015883.EXE -> Adware.Suggestor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015889.exe -> Adware.Suggestor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015909.dll -> Adware.Suggestor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015910.exe -> Adware.Suggestor : Cleaned with backup (quarantined). C:\WINDOWS\system32\zqskw.exe -> Adware.Suggestor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015916.dll -> Adware.SurfSide : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015882.DLL -> Adware.TargetServer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP185\A0013690.dll -> Adware.Ucmore : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP185\A0013696.dll -> Adware.Ucmore : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015876.exe/IUCMORE.DLL -> Adware.Ucmore : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015876.exe/UCMTSAIE.DLL -> Adware.Ucmore : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015876.exe/empty_00000001 -> Adware.Ucmore : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP190\A0016029.exe/IUCMORE.DLL -> Adware.Ucmore : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP190\A0016029.exe/UCMTSAIE.DLL -> Adware.Ucmore : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP190\A0016029.exe/empty_00000001 -> Adware.Ucmore : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP196\A0016158.exe -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP196\snapshot\MFEX-3.DAT -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP196\snapshot\MFEX-4.DAT -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP196\snapshot\MFEX-5.DAT -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP184\A0013679.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015871.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015872.EXE -> Adware.ZenoSearch : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015904.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015905.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015863.exe -> Backdoor.Rbot : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP190\A0016033.exe -> Downloader.Adload.dj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP190\A0016037.exe -> Downloader.Adload.ds : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP190\A0016041.exe -> Downloader.Adload.ds : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP190\A0016042.exe -> Downloader.Adload.ds : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP190\A0016045.exe -> Downloader.Adload.dv : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP184\A0013669.exe -> Downloader.Agent.aaf : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015853.exe -> Downloader.Agent.aaf : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015895.exe -> Downloader.Agent.aaf : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015918.DLL -> Downloader.Agent.agw : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP185\A0013695.dll -> Downloader.Agent.ahv : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP190\A0016036.exe -> Downloader.Agent.ala : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015911.exe -> Downloader.Dyfuca.ei : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP185\A0013694.exe -> Downloader.Qoologic.at : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP186\A0015694.exe -> Downloader.Qoologic.at : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP186\A0015716.exe -> Downloader.Qoologic.at : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP187\A0015751.exe -> Downloader.Qoologic.at : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP187\A0015773.exe -> Downloader.Qoologic.at : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015903.exe -> Downloader.Qoologic.at : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015846.exe -> Downloader.Qoologic.bj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015847.EXE -> Downloader.Qoologic.bj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015848.EXE -> Downloader.Qoologic.bj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015849.EXE -> Downloader.Qoologic.bj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015917.DLL -> Downloader.Qoologic.bj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015919.EXE -> Downloader.Qoologic.bj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015920.EXE -> Downloader.Qoologic.bj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015921.EXE -> Downloader.Qoologic.bj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015867.dll -> Downloader.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015869.dll -> Downloader.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP184\A0013683.exe -> Downloader.Small.ajc : Cleaned with backup (quarantined). C:\WINDOWS\lt.exe -> Downloader.Small.ajc : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015838.exe -> Downloader.Small.buy : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015839.exe -> Downloader.Small.buy : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015897.exe -> Downloader.Small.cyh : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015906.exe -> Downloader.TSUpdate.f : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015880.EXE -> Downloader.TSUpdate.l : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015881.EXE -> Downloader.TSUpdate.n : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015908.exe -> Downloader.TSUpdate.o : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP190\A0016030.exe -> Downloader.TSUpdate.o : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015907.exe -> Downloader.TSUpdate.r : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP200\A0016759.exe -> Downloader.VB.aga : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP190\A0016039.exe -> Downloader.VB.agk : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP190\A0016034.exe -> Downloader.VB.aiy : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP184\A0013667.exe -> Downloader.VB.nw : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP184\A0013668.exe -> Downloader.VB.nw : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015862.exe -> Downloader.VB.nw : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015884.exe -> Downloader.VB.nw : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015896.exe -> Dropper.Agent.aie : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015900.exe -> Dropper.Agent.hl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015901.exe -> Dropper.Agent.hl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015899.exe -> Dropper.Agent.mu : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP190\A0016027.exe -> Dropper.Agent.mu : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP190\A0016043.exe -> Dropper.Agent.mu : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015898.exe -> Dropper.Small.qn : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP190\A0016031.exe -> Dropper.Small.qn : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015836.EXE -> Hijacker.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP190\A0016038.exe -> Hijacker.VB.ly : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP190\A0016040.exe -> Hijacker.VB.ly : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015837.EXE -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@247realmedia[1].txt -> TrackingCookie.247realmedia : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@2o7[3].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@cbs.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][1].txt -> TrackingCookie.Addynamix : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Addynamix : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Adjuggler : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@adrevolver[2].txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@adrevolver[4].txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][1].txt -> TrackingCookie.Adserver : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Adserver : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@advertising[1].txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@advertising[3].txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@atdmt[3].txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@bfast[1].txt -> TrackingCookie.Bfast : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][1].txt -> TrackingCookie.Bridgetrack : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Burstbeacon : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@burstnet[3].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][1].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][1].txt -> TrackingCookie.Clickhype : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@com[1].txt -> TrackingCookie.Com : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@com[2].txt -> TrackingCookie.Com : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][1].txt -> TrackingCookie.Coremetrics : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][1].txt -> TrackingCookie.Coremetrics : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Coremetrics : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Cookies\system@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Cookies\system@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@doubleclick[3].txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Cookies\[removed][1].txt -> TrackingCookie.Enhance : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][1].txt -> TrackingCookie.Enhance : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][1].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][1].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][1].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][1].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][1].txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][3].txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Cookies\system@findwhat[1].txt -> TrackingCookie.Findwhat : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Cookies\[removed][2].txt -> TrackingCookie.Goclick : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Goclick : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][3].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][1].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@hitbox[3].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][1].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@linksynergy[2].txt -> TrackingCookie.Linksynergy : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][1].txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Cookies\system@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@mediaplex[2].txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Onestat : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][3].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@overture[1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][1].txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@questionmarket[3].txt -> TrackingCookie.Questionmarket : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Cookies\[removed][2].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@revenue[2].txt -> TrackingCookie.Revenue : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@edge.ru4[1].txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@edge.ru4[2].txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][1].txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Cookies\system@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@tacoda[3].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@targetnet[2].txt -> TrackingCookie.Targetnet : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@targetnet[3].txt -> TrackingCookie.Targetnet : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@valueclick[2].txt -> TrackingCookie.Valueclick : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Webtrendslive : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][3].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@yieldmanager[3].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][1].txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony [removed][2].txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@zedo[1].txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined). C:\Documents and Settings\Sony User\Cookies\sony user@zedo[2].txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP184\A0013675.exe -> Trojan.Agent.sx : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015855.exe -> Trojan.Agent.sx : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015870.dll -> Trojan.Agent.sx : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP184\A0013674.exe -> Trojan.Qoologic : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP185\A0014704.exe -> Trojan.Qoologic : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP186\A0015706.exe -> Trojan.Qoologic : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP186\A0015735.exe -> Trojan.Qoologic : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP187\A0015766.exe -> Trojan.Qoologic : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP188\A0015789.exe -> Trojan.Qoologic : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015850.exe -> Trojan.Qoologic : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015841.EXE -> Trojan.VB.tg : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015886.exe -> Trojan.VB.tg : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015887.exe -> Trojan.VB.tg : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D04C7C8E-7574-402A-A060-0473BD78FD19}\RP189\A0015860.exe -> Worm.VB.dw : Cleaned with backup (quarantined). ::Report end

staniv,

Ewido found bad files in your system restore program, lets flush it all out.

System Restore makes regular backups of all your settings, if you ever had to use this program to restore your
system to a previous date, you will be infected all over again so we need to clean out the previous Restore Points

Turn off System Restore.

* Right-click My Computer.
* Click Properties.
* Click the System Restore tab.
* Check Turn off System Restore on all Drives.
* Click Apply, and then click OK.

Reboot your System

Turn ON System Restore.

* Right-click My Computer.
* ClickProperties.
* Click the System Restore tab.
* UN-Check Turn off System Restore on all Drives.
* Click Apply, and then click OK.

* Go to Start/ Control Panel/ Performance and Maintenance/ System Restore/ Create a New Restore Point
You can name the restore point anything you like, something that you can remember, You will have to be in Catagory View to see this
DONT FORGET TO MAKE A RESTORE POINT


Open Ewido and go into the Quarantine folder, nothing in there you want to keep on your system.



I need to see a new HJT log please.

Be back in the AM, been a long day

staniv,

Were getting there a little at a time.



Please download Qoofix by Rubber Ducky to your desktop.

• Right click on the Qoofix folder, and choose "Extract All". Extract Qoofix to your C: drive
• Close all windows and programs, including internet windows.
• Go to C:\Qoofix and open the folder, then double click on Qoofix.exe
• Click Begin Removal and wait for the scan to finish
• If Qoofix finds an infection, select yes to restart your computer
• You will now find a log from this tool, located at C:\Qoofix\Qoofix Logfile.txt Copy and paste the contents of that report into your next reply here.

Let me see this report and a new HJT log

Qoofix removed a lot of nasty entries.


C:\Program Files\Viewpoint <—This not malware itself but installs without your knowledge or consent, you can remove it via the Add-Remove Programs in the Control Panel.



Open HJT Scan Only, close your browser and all open windows, check these entries and click on Fix Checked

O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\system32\swinkpex.exe CORN003
O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\swinkpex.exe


O16 - DPF: {3C648A72-C49A-48EF-9F90-68EF13293F97} (Cacher Class) - http://www2.priv.cmls.xmlsweb.com/XMLSearch/XMLCache.CAB
O16 - DPF: {886DDE35-E955-11D0-A707-000000881958} - http://69.56.176.75/webplugin.cab
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://download.cdn.winsoftware.com/files/…FreeInstall.cab



Download Killbox to your desktop.
Pocket Killbox
* Copy the files with the complete path in the quote box by highlighting them and pressing Ctrl C

C:\Program Files\Common Files\Update.exe
C:\WINDOWS\system32\qsnlg.exe
C:\WINDOWS\system32\nodeipproc.dll
C:\WINDOWS\system32\swinkpex.exe

* Click on File > Paste from Clipboard
* Check Delete on Reboot
* Check End Explorer Shell while Killing File
* Click on All Files
* Click the Red Circle with the White X.
* It will ask you to confirm > Say Yes
* It will ask you to reboot > Say Yes



Post one last HJT log and lets make sure all is gone.

How are things running now?????

Stan,

All the 016 entries will come back, when you visit the site , they will just prompt you to download it again. Thats why some 016s that do not look familiar I have you remove. You can open HJT> View the List of Backups and restore
O16 - DPF: {3C648A72-C49A-48EF-9F90-68EF13293F97} (Cacher Class) - http://www2.priv.cmls.xmlsweb.com/XMLSearch/XMLCache.CAB




Your Java is out of date and leaving your system vunerable.

Go here to download and install JRE 5.0 Upgrade 8

Java Runtime Environment (JRE) 5.0 Update 8 <– This is what you need


Try that program and lets see if it works, if not just download it again.

Let me know.

Everything seems to be working just fine. No more error messages etc. IS there anything else I need to do? Thanks again for all of your help. You don't know how much this has meant to me. IT has gotten my life back in order when I never thought it could! -Stan

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php