Logfile of HijackThis

That is a very old version of Hijackthis. Please delete it from your system.

Download hijackthis 1.99.1 to its own folder C:/HJT for example. Extrat the zip file to that folder. Then close all browser windows, open hijackthis and click on scan. Once the scan has completed click on Save Log, this will produce a text file log. Highlight all of the information from in that text box then right click and copy. Come back to this post you made and click on "add reply" at the bottom right and a new window will open. Paste the hijackthis log into the new window hit add reply in that new window.

HJT download >>> http://www.softpedia.com/public/cat/10/17/10-17-69.shtml

Please disable Spybot Teatimer tutorial here >>> http://russelltexas.com/malware/teatimer.htm

NEXT

First download ewido anti-spyware from HERE and save that file to your
desktop.
This is a 30 day trial of the program

• Once you have downloaded ewido anti-spyware, locate the icon on the desktop
  and double-click it to launch the set up program.
• Once the setup is complete you will need run ewido and update the definition
  files.
• On the main screen select the icon "Update" then select the "
  Update now" link.
  • Next select the "Start Update" button, the update will start and a
    progress bar will show the updates being installed.
• Once the update has completed select the "Scanner" icon at the top of
  the screen, then select the "Settings" tab.
• Once in the Settings screen click on "Recommended actions" and then
  select "Quarantine".
• Under "Reports"
  • Select "Automatically generate report after every scan"
  • Un-Select "Only if threats were found"

Close ewido anti-spyware, Do Not run a scan just yet, we will shortly.

• Reboot your computer into SafeMode. You can do this by restarting
  your computer and continually tapping the F8 key until a menu appears.
  
  Use your up arrow key to highlight SafeMode then hit enter.
  IMPORTANT: Do not open any other windows or
  programs while ewido is scanning, it may interfere with the scanning proccess:
• Lauch ewido-anti-spyware by double-clicking the icon on your desktop.
• Select the "Scanner" icon at the top and then the "Scan" tab
  then click on "Complete System Scan".
• ewido will now begin the scanning process, be patient this may take a little
  time.
  Once the scan is complete do the following:
• If you have any infections you will prompted, then select "Apply all
  actions"
• Next select the "Reports" icon at the top.
• Select the "Save report as" button in the lower left hand of the
  screen and save it to a text file on your system (make sure to remember where
  you saved that file, this is important).
• Close ewido and reboot your system back into Normal Mode and post the
  results of the ewido report scan and a new hijackthis log please.

Please do an online scan with Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then start to download the latest definition files.
• Once the scanner is installed and the definitions downloaded, click Next.
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
    • Extended (If available otherwise Standard)
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK
• Now under select a target to scan select My Computer
• The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
• Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post as well as a bew hijackthis log please.

——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Monday, August 21, 2006 2:29:07 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 21/08/2006 Kaspersky Anti-Virus database records: 216713 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ E:\ Scan Statistics: Total number of scanned objects: 135082 Number of viruses found: 19 Number of infected objects: 136 / 0 Number of suspicious objects: 0 Duration of the scan process: 02:54:39 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\WDLog-05062006-144850.log Object is locked skipped C:\Documents and Settings\All Users\DRM\drmstore.hds Object is locked skipped C:\Documents and Settings\All Users\DRM\migration.log Object is locked skipped C:\Documents and Settings\All Users\DRM\v2ks.bla Object is locked skipped C:\Documents and Settings\All Users\DRM\v2ks.sec Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Microsoft\Outlook\Outlook.srs Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Microsoft\Templates\Normal.dot Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Mozilla\Firefox\Profiles\66sb2lio.default\cert8.db Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Mozilla\Firefox\Profiles\66sb2lio.default\flashgot.log Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Mozilla\Firefox\Profiles\66sb2lio.default\key3.db Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Mozilla\Firefox\Profiles\66sb2lio.default\parent.lock Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\abook.mab Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\cert8.db Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\key3.db Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\Local Folders\Drafts.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\Local Folders\Inbox.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\Local Folders\Inbox.sbd\DrWeil.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\Local Folders\Inbox.sbd\NewHymns.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\Local Folders\Inbox.sbd\Oremus.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\Local Folders\Inbox.sbd\Reflections of the Spirit.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\Local Folders\Inbox.sbd\sidesplitters.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\Local Folders\Inbox.sbd\YouthMultimedia.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\Local Folders\Junk.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\Local Folders\Sent.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\Local Folders\Templates.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\Local Folders\Trash.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\Local Folders\Unsent Messages.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.googlemail.com\Drafts.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.googlemail.com\Inbox.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.googlemail.com\Junk.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.googlemail.com\Sent.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.googlemail.com\Templates.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Drafts.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\filterlog.html Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Alibris.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Amazon.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Beliefnet.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Beliefnet.sbd\Angel Wisdom.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Beliefnet.sbd\Buddhist Wisdom.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Beliefnet.sbd\Inspiration.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Beliefnet.sbd\Relgious Jokes.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Bob's Junk Mail.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Building Church Leaders.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Cape Town News.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\CCS.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Chabad.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Church.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\confraternity.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Crosswalk.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Crosswalk.sbd\Every Day Light.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Crosswalk.sbd\Finance.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Crosswalk.sbd\Health.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Crosswalk.sbd\Humour.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Crosswalk.sbd\Loving Actions.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\CyberChurch.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Daily Zen.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Damaris.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Dark Tower.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Family.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\FOF.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Friday Nasiha.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Friends.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Graeme Codrington.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Higher Awareness.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Hollywood Jesus.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\IBS.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Jericho Walls.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\John Stott.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\John Stott.sbd\Bible Study.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\John Stott.sbd\Daily Thought.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Kalahari.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Leadership Weekly.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Manuka.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Max Lucado.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\mcsa_gayfriendly.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda/[From "Guadalupe Hoffman" <[removed]>][Date Thu, 27 May 2004 16:39:44 +0000]/UNNAMED/[From "Kathie Holley" <[removed]>][Date Sat, 29 May 2004 11:13:53 +0300]/UNNAMED/[From "mirella fernandez" <[removed]>][Date Tue, 01 Jun 2004 21:38:27 -1000]/html/[From "Imelda Irland" <[removed]>][Date Wed, 14 Jul 2004 17:31:11 -0500]/UN … /[From "M … /[From U.S.Bank <[removed]>][Date Sat, 24 Jul 2004 19:17:21 -0700]/html Infected: Trojan-Spy.HTML.Usbankfraud.p skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda/[From "Guadalupe Hoffman" <[removed]>][Date Thu, 27 May 2004 16:39:44 +0000]/UNNAMED/[From "Kathie Holley" <[removed]>][Date Sat, 29 May 2004 11:13:53 +0300]/UNNAMED/[From "mirella fernandez" <[removed]>][Date Tue, 01 Jun 2004 21:38:27 -1000]/html/[From "Imelda Irland" <[removed]>][Date Wed, 14 Jul 2004 17:31:11 -0500]/UN … /[From "Miriam Chaney" <[removed]>][Date Sat, 24 Jul 2004 01:29:08 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Usbankfraud.p skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda/[From "Guadalupe Hoffman" <[removed]>][Date Thu, 27 May 2004 16:39:44 +0000]/UNNAMED/[From "Kathie Holley" <[removed]>][Date Sat, 29 May 2004 11:13:53 +0300]/UNNAMED/[From "mirella fernandez" <[removed]>][Date Tue, 01 Jun 2004 21:38:27 -1000]/html/[From "Imelda Irland" <[removed]>][Date Wed, 14 Jul 2004 17:31:11 -0500]/UNNAMED … /[From "loyd menino" <[removed]>][Date Fri, 23 Jul 2004 19:39:19 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Usbankfraud.p skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda/[From "Guadalupe Hoffman" <[removed]>][Date Thu, 27 May 2004 16:39:44 +0000]/UNNAMED/[From "Kathie Holley" <[removed]>][Date Sat, 29 May 2004 11:13:53 +0300]/UNNAMED/[From "mirella fernandez" <[removed]>][Date Tue, 01 Jun 2004 21:38:27 -1000]/html/[From "Imelda Irland" <[removed]>][Date Wed, 14 Jul 2004 17:31:11 -0500]/UNNAMED/[From Golunga.com <[removed]>][Date Fri, 23 Jul 2004 08:17:36 -0700]/text Infected: Trojan-Spy.HTML.Usbankfraud.p skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda/[From "Guadalupe Hoffman" <[removed]>][Date Thu, 27 May 2004 16:39:44 +0000]/UNNAMED/[From "Kathie Holley" <[removed]>][Date Sat, 29 May 2004 11:13:53 +0300]/UNNAMED/[From "mirella fernandez" <[removed]>][Date Tue, 01 Jun 2004 21:38:27 -1000]/html/[From "Imelda Irland" <[removed]>][Date Wed, 14 Jul 2004 17:31:11 -0500]/UNNA … /[From "Leland Rucker" <[removed]>][Date Thu, 26 Aug 2004 19:22:04 +0000]/html Infected: Trojan-Dropper.VBS.Zerolin skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda/[From "Guadalupe Hoffman" <[removed]>][Date Thu, 27 May 2004 16:39:44 +0000]/UNNAMED/[From "Kathie Holley" <[removed]>][Date Sat, 29 May 2004 11:13:53 +0300]/UNNAMED/[From "mirella fernandez" <[removed]>][Date Tue, 01 Jun 2004 21:38:27 -1000]/html/[From "Imelda Irland" <[removed]>][Date Wed, 14 Jul 2004 17:31:11 -0500]/UNNAMED/[ … /[From Shopping Mania <[removed]>][Date Sun, 24 Oct 2004 19:10:10 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Sunfraud.k skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda/[From "Guadalupe Hoffman" <[removed]>][Date Thu, 27 May 2004 16:39:44 +0000]/UNNAMED/[From "Kathie Holley" <[removed]>][Date Sat, 29 May 2004 11:13:53 +0300]/UNNAMED/[From "mirella fernandez" <[removed]>][Date Tue, 01 Jun 2004 21:38:27 -1000]/html/[From "Imelda Irland" <[removed]>][Date Wed, 14 Jul 2004 17:31:11 -0500]/UNNAMED/[Fr … /[From "Juliana Myrta" <[removed]>][Date Wed, 25 Aug 2004 16:22:51 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Sunfraud.k skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda/[From "Guadalupe Hoffman" <[removed]>][Date Thu, 27 May 2004 16:39:44 +0000]/UNNAMED/[From "Kathie Holley" <[removed]>][Date Sat, 29 May 2004 11:13:53 +0300]/UNNAMED/[From "mirella fernandez" <[removed]>][Date Tue, 01 Jun 2004 21:38:27 -1000]/html/[From "Imelda Irland" <[removed]>][Date Wed, 14 Jul 2004 17:31:11 -0500]/UNNAMED/[From <[removed]>][Date Tue, 24 Aug 2004 07:45:26 -0500]/html Infected: Trojan-Spy.HTML.Sunfraud.k skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda/[From "Guadalupe Hoffman" <[removed]>][Date Thu, 27 May 2004 16:39:44 +0000]/UNNAMED/[From "Kathie Holley" <[removed]>][Date Sat, 29 May 2004 11:13:53 +0300]/UNNAMED/[From "mirella fernandez" <[removed]>][Date Tue, 01 Jun 2004 21:38:27 -1000]/html/[From "Imelda Irland" <[removed]>][Date Wed, 14 Jul 2004 17:31:11 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Sunfraud.k skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda/[From "Guadalupe Hoffman" <[removed]>][Date Thu, 27 May 2004 16:39:44 +0000]/UNNAMED/[From "Kathie Holley" <[removed]>][Date Sat, 29 May 2004 11:13:53 +0300]/UNNAMED/[From "mirella fernandez" <[removed]>][Date Tue, 01 Jun 2004 21:38:27 -1000]/html Infected: Trojan-Spy.HTML.Sunfraud.k skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda/[From "Guadalupe Hoffman" <[removed]>][Date Thu, 27 May 2004 16:39:44 +0000]/UNNAMED/[From "Kathie Holley" <[removed]>][Date Sat, 29 May 2004 11:13:53 +0300]/UNNAMED Infected: Trojan-Spy.HTML.Sunfraud.k skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda/[From "Guadalupe Hoffman" <[removed]>][Date Thu, 27 May 2004 16:39:44 +0000]/UNNAMED Infected: Trojan-Spy.HTML.Sunfraud.k skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda Mail Berkeley mbox: infected - 12 skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Mikey's Funnies.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Minister_MCSA.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\MountainWings.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Penny.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Preaching Today.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Quotes.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Quotes.sbd\Motivational.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Reflections of the Spirit.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Registrations/[From [removed] <[removed]>][Date Fri, 25 Jun 2004 07:54:16 +0300]/html Infected: Trojan-Spy.HTML.Paylap.by skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Registrations Mail Berkeley mbox: infected - 1 skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Registrations.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Reports.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Responses.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Screenit.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Sermon Illustrations.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\SermonWriter.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Small Groups.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Sojourners.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Textweek.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Tiscali.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\TruthSearch.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Virus Reports.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\w-rcl.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\WCC.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Web Evangelism.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Youth Ministry.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Youth Ministry.sbd\Group Publishing.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Youth Ministry.sbd\MCSA CYP.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Youth Ministry.sbd\MCSA Pastor.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Youth Ministry.sbd\YM_SA.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Youth Ministry.sbd\YouthPastor MCSA.msf Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Joan Hawk" <[removed]>][Date Thu, 26 Aug 2004 19:17:52 +0200 (SAST)]/UNNAMED/[From Alba Crowley <[removed]>][Date Fri, 27 Aug 2004 22:34:04 +0400 (PDT)]/UNNAMED Infected: Trojan-Dropper.VBS.Zerolin skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Joan Hawk" <[removed]>][Date Thu, 26 Aug 2004 19:17:52 +0200 (SAST)]/UNNAMED Infected: Trojan-Dropper.VBS.Zerolin skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Great Freebies" <[removed]>][Date Fri, 08 Oct 2004 09:25:45 -0800]/html/[From "edwardo ellifritz" <[removed]>][Date Fri, 08 Oct 2004 17:25:02 -0800]/text/[From Customer Support <[removed]>][Date Fri, 08 Oct 2004 14:32:20 -0700]/UNNAMED/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Great Freebies" <[removed]>][Date Fri, 08 Oct 2004 09:25:45 -0800]/html/[From "edwardo ellifritz" <[removed]>][Date Fri, 08 Oct 2004 17:25:02 -0800]/text/[From Cus … /[From Customer Support <[removed]>][Date Fri, 08 Oct 2004 16:19:12 -0400]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Great Freebies" <[removed]>][Date Fri, 08 Oct 2004 09:25:45 -0800]/html/[From "edwardo ellifritz" <[removed]>][Date Fri, 08 Oct 2004 17:25:02 -0800]/text/[From Customer Support <[removed]>][Date Fri, 08 Oct 2004 14:32:20 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Great Freebies" <[removed]>][Date Fri, 08 Oct 2004 09:25:45 -0800]/html/[From "edwardo ellifritz" <[removed]>][Date Fri, 08 Oct 2004 17:25:02 -0800]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Great Freebies" <[removed]>][Date Fri, 08 Oct 2004 09:25:45 -0800]/html Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Authentic Daily Savings" <[removed]>][Date Sun, 10 Oct 2004 13:33:29 -0800]/html/[From "Macy’s Gift Card Giveway" <[removed]>][Date Sun, 10 Oct 2004 18:58:50 -0 … /[Fr … /[From Suntrust <[removed]>][Date Sun, 10 Oct 2004 14:43:18 -0400]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Authentic Daily Savings" <[removed]>][Date Sun, 10 Oct 2004 13:33:29 -0800]/html/[From "Macy’s Gift Card Giveway" <[removed]>][Date Sun, 10 Oct 2004 18:58:50 -0 … /[From … /[From "Kathy Browne" <[removed]>][Date Sun, 10 Oct 2004 12:46:48 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Authentic Daily Savings" <[removed]>][Date Sun, 10 Oct 2004 13:33:29 -0800]/html/[From "Macy’s Gift Card Giveway" <[removed]>][Date Sun, 10 Oct 2004 18:58:50 -0 … /[From "Good News" <[removed]>][Date Mon, 11 Oct 2004 00:28:59 -0800]/html Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Authentic Daily Savings" <[removed]>][Date Sun, 10 Oct 2004 13:33:29 -0800]/html/[From "Macy’s Gift Card Giveway" <[removed]>][Date Sun, 10 Oct 2004 18:58:50 -0800]/html Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Authentic Daily Savings" <[removed]>][Date Sun, 10 Oct 2004 13:33:29 -0800]/html Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From "Online Gift Cards for you" <[removed]>][Date Mon, 11 Oct 2004 16:23:27 -0 … /[From Citibank Group <[removed]>][Date Mon, 11 Oct 2004 19:42:44 -0600]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From "Online Gift Cards for you" <[removed]>][Date Mon, 11 Oct 2004 16:23:27 -0800]/html/[From Customer Support <[removed]>][Date Mon, 11 Oct 2004 23:47:08 -0600]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From "Online Gift Cards for you" <[removed]>][Date Mon, 11 Oct 2004 16:23:27 -0800]/html Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From "Family Memories" <[removed]>][Date Wed, 13 Oct 2004 07:02:06 -0800]/html/[From "Freida Rojas" ][Date Wed, 13 Oct 2004 21:37:19 +0200]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From "Family Memories" <[removed]>][Date Wed, 13 Oct 2004 07:02:06 -0800]/html/[From "Freida Rojas" <[removed]>][Date Wed, 13 Oct 2004 19:16:45 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From "Family Memories" <[removed]>][Date Wed, 13 Oct 2004 07:02:06 -0800]/html Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From NELSON WHITE <[removed]>][Date Sun, 17 Oct 2004 20:46:30 +0200]/UNNAMED/[From GOLDEN STRIKE LOTTERY AUSTRIA <[removed]>][Date Mon, 18 Oct 2004 13:48:17 +0200]/UNNAMED Infected: Trojan-Dropper.VBS.Zerolin skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From NELSON WHITE <[removed]>][Date Sun, 17 Oct 2004 20:46:30 +0200]/UNNAMED/[Fro … /[Fro … /[From Customer Support <[removed]>][Date Thu, 21 Oct 2004 02:03:10 -0400]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From NELSON WHITE <[removed]>][Date Sun, 17 Oct 2004 20:46:30 +0200]/UNNAMED/[Fro … /[Fro … /[From Customer Support <[removed]>][Date Thu, 21 Oct 2004 10:49:19 +0200]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From NELSON WHITE <[removed]>][Date Sun, 17 Oct 2004 20:46:30 +0200]/UNNAMED/[Fro … /[Fro … /[From Customer Support <[removed]>][Date Thu, 21 Oct 2004 19:08:56 -0100]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From NELSON WHITE <[removed]>][Date Sun, 17 Oct 2004 20:46:30 +0200]/UNNAMED/[Fro … /[Fro … /[From "erma Asing" <[removed]>][Date Wed, 20 Oct 2004 21:38:02 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From NELSON WHITE <[removed]>][Date Sun, 17 Oct 2004 20:46:30 +0200]/UNNAMED/[Fro … /[From "Nadine Rivas" <[removed]>][Date Wed, 20 Oct 2004 07:39:03 +0200 (SAST)]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From NELSON WHITE <[removed]>][Date Sun, 17 Oct 2004 20:46:30 +0200]/UNNAMED/[From "Ama … /[From "Richard Grove" <[removed]>][Date Tue, 19 Oct 2004 23:43:27 -0300]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From NELSON WHITE <[removed]>][Date Sun, 17 Oct 2004 20:46:30 +0200]/UNNAMED/[From "Amazing GiveAways" <[removed]>][Date Tue, 19 Oct 2004 14:00:37 -0800]/html Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From NELSON WHITE <[removed]>][Date Sun, 17 Oct 2004 20:46:30 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From Bobbie Arroyo <[removed]>][Date Tue, 26 Oct 2004 03:48:00 -0600 EST]/UNNAMED/[From "Efren Olson" <[removed]>][Date Thu, 14 Oct 2004 15:23:38 -0400 (EDT)]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From Bobbie Arroyo <[removed]>][Date Tue, 26 Oct 2004 03:48:00 -0600 EST]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Heather Van Vorous" <[removed]>][Date Wed, 27 Oct 2004 08:38:51 -0700 (PDT)]/UNNAMED/[From "Jose Jacobsonl" <[removed]>][Date Fri, 29 Oct 2004 23:51:43 -0600]/UNNAMED/[From [removed] <"Melton Matilda">][Date Thu, 28 Oct 2004 19:40:19 -0800]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Heather Van Vorous" <[removed]>][Date Wed, 27 Oct 2004 08:38:51 -0700 (PDT)]/UNNAMED/[From "Jose Jacobsonl" <[removed]>][Date Fri, 29 Oct 2004 23:51:43 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Heather Van Vorous" <[removed]>][Date Wed, 27 Oct 2004 08:38:51 -0700 (PDT)]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Autumn Ortega" <[removed]>][Date Mon, 20 Oct 2003 00:44:44 -0600]/UNNAMED/[From "Rachel Larkin" <[removed]>][Date Sun, 31 Oct 2004 14:09:38 +0100]/html/[From "BRUCE" ][Date Sun, 31 Oct 2004 19:22:55 -0700]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Autumn Ortega" <[removed]>][Date Mon, 20 Oct 2003 00:44:44 -0600]/UNNAMED/[From "Rachel Larkin" <[removed]>][Date Sun, 31 Oct 2004 14:09:38 +0100]/html/[From "BRUCE" ][Date Sun, 31 Oct 2004 22:34:32 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Autumn Ortega" <[removed]>][Date Mon, 20 Oct 2003 00:44:44 -0600]/UNNAMED/[From "Rachel Larkin" <[removed]>][Date Sun, 31 Oct 2004 14:09:38 +0100]/html/[From "BRUCE" <[removed]>][Da … /[From Sophia Thomas <[removed]>][Date Sun, 31 Oct 2004 20:00:06 +0600]/html Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Autumn Ortega" <[removed]>][Date Mon, 20 Oct 2003 00:44:44 -0600]/UNNAMED/[From "Rachel Larkin" <[removed]>][Date Sun, 31 Oct 2004 14:09:38 +0100]/html/[From "BRUCE" <[removed]>][Date Sat, 30 Oct 2004 21:05:54 -0400]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Autumn Ortega" <[removed]>][Date Mon, 20 Oct 2003 00:44:44 -0600]/UNNAMED/[From "Rachel Larkin" <[removed]>][Date Sun, 31 Oct 2004 14:09:38 +0100]/html/[From "Meds 80% Off" ][Date Wed, 03 Nov 2004 17:30:38 -0600]/text Infected: Trojan-Spy.HTML.Citifraud.av skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Autumn Ortega" <[removed]>][Date Mon, 20 Oct 2003 00:44:44 -0600]/UNNAMED/[From "Rachel Larkin" <[removed]>][Date Sun, 31 Oct 2004 14:09:38 +0100]/html/[From "Meds 80% … /[From "Co … /[From Myron Barrow <[removed]>][Date Thu, 04 Nov 2004 19:22:12 -0200]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Pro

Clear out your junk folder in Thunderbird as it seems that is where they are all sitting. Then scan again and a new log please.

——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Tuesday, August 22, 2006 8:02:27 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 21/08/2006 Kaspersky Anti-Virus database records: 216927 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ E:\ Scan Statistics: Total number of scanned objects: 135168 Number of viruses found: 17 Number of infected objects: 112 / 0 Number of suspicious objects: 0 Duration of the scan process: 02:16:30 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\WDLog-05062006-144850.log Object is locked skipped C:\Documents and Settings\All Users\DRM\drmstore.hds Object is locked skipped C:\Documents and Settings\All Users\DRM\migration.log Object is locked skipped C:\Documents and Settings\All Users\DRM\v2ks.bla Object is locked skipped C:\Documents and Settings\All Users\DRM\v2ks.sec Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda/[From "Guadalupe Hoffman" <[removed]>][Date Thu, 27 May 2004 16:39:44 +0000]/UNNAMED/[From "Kathie Holley" <[removed]>][Date Sat, 29 May 2004 11:13:53 +0300]/UNNAMED/[From "mirella fernandez" <[removed]>][Date Tue, 01 Jun 2004 21:38:27 -1000]/html/[From "Imelda Irland" <[removed]>][Date Wed, 14 Jul 2004 17:31:11 -0500]/UN … /[From "M … /[From U.S.Bank <[removed]>][Date Sat, 24 Jul 2004 19:17:21 -0700]/html Infected: Trojan-Spy.HTML.Usbankfraud.p skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda/[From "Guadalupe Hoffman" <[removed]>][Date Thu, 27 May 2004 16:39:44 +0000]/UNNAMED/[From "Kathie Holley" <[removed]>][Date Sat, 29 May 2004 11:13:53 +0300]/UNNAMED/[From "mirella fernandez" <[removed]>][Date Tue, 01 Jun 2004 21:38:27 -1000]/html/[From "Imelda Irland" <[removed]>][Date Wed, 14 Jul 2004 17:31:11 -0500]/UN … /[From "Miriam Chaney" <[removed]>][Date Sat, 24 Jul 2004 01:29:08 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Usbankfraud.p skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda/[From "Guadalupe Hoffman" <[removed]>][Date Thu, 27 May 2004 16:39:44 +0000]/UNNAMED/[From "Kathie Holley" <[removed]>][Date Sat, 29 May 2004 11:13:53 +0300]/UNNAMED/[From "mirella fernandez" <[removed]>][Date Tue, 01 Jun 2004 21:38:27 -1000]/html/[From "Imelda Irland" <[removed]>][Date Wed, 14 Jul 2004 17:31:11 -0500]/UNNAMED … /[From "loyd menino" <[removed]>][Date Fri, 23 Jul 2004 19:39:19 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Usbankfraud.p skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda/[From "Guadalupe Hoffman" <[removed]>][Date Thu, 27 May 2004 16:39:44 +0000]/UNNAMED/[From "Kathie Holley" <[removed]>][Date Sat, 29 May 2004 11:13:53 +0300]/UNNAMED/[From "mirella fernandez" <[removed]>][Date Tue, 01 Jun 2004 21:38:27 -1000]/html/[From "Imelda Irland" <[removed]>][Date Wed, 14 Jul 2004 17:31:11 -0500]/UNNAMED/[From Golunga.com <[removed]>][Date Fri, 23 Jul 2004 08:17:36 -0700]/text Infected: Trojan-Spy.HTML.Usbankfraud.p skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda/[From "Guadalupe Hoffman" <[removed]>][Date Thu, 27 May 2004 16:39:44 +0000]/UNNAMED/[From "Kathie Holley" <[removed]>][Date Sat, 29 May 2004 11:13:53 +0300]/UNNAMED/[From "mirella fernandez" <[removed]>][Date Tue, 01 Jun 2004 21:38:27 -1000]/html/[From "Imelda Irland" <[removed]>][Date Wed, 14 Jul 2004 17:31:11 -0500]/UNNA … /[From "Leland Rucker" <[removed]>][Date Thu, 26 Aug 2004 19:22:04 +0000]/html Infected: Trojan-Dropper.VBS.Zerolin skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda/[From "Guadalupe Hoffman" <[removed]>][Date Thu, 27 May 2004 16:39:44 +0000]/UNNAMED/[From "Kathie Holley" <[removed]>][Date Sat, 29 May 2004 11:13:53 +0300]/UNNAMED/[From "mirella fernandez" <[removed]>][Date Tue, 01 Jun 2004 21:38:27 -1000]/html/[From "Imelda Irland" <[removed]>][Date Wed, 14 Jul 2004 17:31:11 -0500]/UNNAMED/[ … /[From Shopping Mania <[removed]>][Date Sun, 24 Oct 2004 19:10:10 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Sunfraud.k skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda/[From "Guadalupe Hoffman" <[removed]>][Date Thu, 27 May 2004 16:39:44 +0000]/UNNAMED/[From "Kathie Holley" <[removed]>][Date Sat, 29 May 2004 11:13:53 +0300]/UNNAMED/[From "mirella fernandez" <[removed]>][Date Tue, 01 Jun 2004 21:38:27 -1000]/html/[From "Imelda Irland" <[removed]>][Date Wed, 14 Jul 2004 17:31:11 -0500]/UNNAMED/[Fr … /[From "Juliana Myrta" <[removed]>][Date Wed, 25 Aug 2004 16:22:51 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Sunfraud.k skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda/[From "Guadalupe Hoffman" <[removed]>][Date Thu, 27 May 2004 16:39:44 +0000]/UNNAMED/[From "Kathie Holley" <[removed]>][Date Sat, 29 May 2004 11:13:53 +0300]/UNNAMED/[From "mirella fernandez" <[removed]>][Date Tue, 01 Jun 2004 21:38:27 -1000]/html/[From "Imelda Irland" <[removed]>][Date Wed, 14 Jul 2004 17:31:11 -0500]/UNNAMED/[From <[removed]>][Date Tue, 24 Aug 2004 07:45:26 -0500]/html Infected: Trojan-Spy.HTML.Sunfraud.k skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda/[From "Guadalupe Hoffman" <[removed]>][Date Thu, 27 May 2004 16:39:44 +0000]/UNNAMED/[From "Kathie Holley" <[removed]>][Date Sat, 29 May 2004 11:13:53 +0300]/UNNAMED/[From "mirella fernandez" <[removed]>][Date Tue, 01 Jun 2004 21:38:27 -1000]/html/[From "Imelda Irland" <[removed]>][Date Wed, 14 Jul 2004 17:31:11 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Sunfraud.k skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda/[From "Guadalupe Hoffman" <[removed]>][Date Thu, 27 May 2004 16:39:44 +0000]/UNNAMED/[From "Kathie Holley" <[removed]>][Date Sat, 29 May 2004 11:13:53 +0300]/UNNAMED/[From "mirella fernandez" <[removed]>][Date Tue, 01 Jun 2004 21:38:27 -1000]/html Infected: Trojan-Spy.HTML.Sunfraud.k skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda/[From "Guadalupe Hoffman" <[removed]>][Date Thu, 27 May 2004 16:39:44 +0000]/UNNAMED/[From "Kathie Holley" <[removed]>][Date Sat, 29 May 2004 11:13:53 +0300]/UNNAMED Infected: Trojan-Spy.HTML.Sunfraud.k skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda/[From "Guadalupe Hoffman" <[removed]>][Date Thu, 27 May 2004 16:39:44 +0000]/UNNAMED Infected: Trojan-Spy.HTML.Sunfraud.k skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Melinda Mail Berkeley mbox: infected - 12 skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Registrations/[From [removed] <[removed]>][Date Fri, 25 Jun 2004 07:54:16 +0300]/html Infected: Trojan-Spy.HTML.Paylap.by skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Inbox.sbd\Registrations Mail Berkeley mbox: infected - 1 skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Joan Hawk" <[removed]>][Date Thu, 26 Aug 2004 19:17:52 +0200 (SAST)]/UNNAMED/[From Alba Crowley <[removed]>][Date Fri, 27 Aug 2004 22:34:04 +0400 (PDT)]/UNNAMED Infected: Trojan-Dropper.VBS.Zerolin skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Joan Hawk" <[removed]>][Date Thu, 26 Aug 2004 19:17:52 +0200 (SAST)]/UNNAMED Infected: Trojan-Dropper.VBS.Zerolin skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Great Freebies" <[removed]>][Date Fri, 08 Oct 2004 09:25:45 -0800]/html/[From "edwardo ellifritz" <[removed]>][Date Fri, 08 Oct 2004 17:25:02 -0800]/text/[From Customer Support <[removed]>][Date Fri, 08 Oct 2004 14:32:20 -0700]/UNNAMED/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Great Freebies" <[removed]>][Date Fri, 08 Oct 2004 09:25:45 -0800]/html/[From "edwardo ellifritz" <[removed]>][Date Fri, 08 Oct 2004 17:25:02 -0800]/text/[From Cus … /[From Customer Support <[removed]>][Date Fri, 08 Oct 2004 16:19:12 -0400]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Great Freebies" <[removed]>][Date Fri, 08 Oct 2004 09:25:45 -0800]/html/[From "edwardo ellifritz" <[removed]>][Date Fri, 08 Oct 2004 17:25:02 -0800]/text/[From Customer Support <[removed]>][Date Fri, 08 Oct 2004 14:32:20 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Great Freebies" <[removed]>][Date Fri, 08 Oct 2004 09:25:45 -0800]/html/[From "edwardo ellifritz" <[removed]>][Date Fri, 08 Oct 2004 17:25:02 -0800]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Great Freebies" <[removed]>][Date Fri, 08 Oct 2004 09:25:45 -0800]/html Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Authentic Daily Savings" <[removed]>][Date Sun, 10 Oct 2004 13:33:29 -0800]/html/[From "Macy’s Gift Card Giveway" <[removed]>][Date Sun, 10 Oct 2004 18:58:50 -0 … /[Fr … /[From Suntrust <[removed]>][Date Sun, 10 Oct 2004 14:43:18 -0400]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Authentic Daily Savings" <[removed]>][Date Sun, 10 Oct 2004 13:33:29 -0800]/html/[From "Macy’s Gift Card Giveway" <[removed]>][Date Sun, 10 Oct 2004 18:58:50 -0 … /[From … /[From "Kathy Browne" <[removed]>][Date Sun, 10 Oct 2004 12:46:48 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Authentic Daily Savings" <[removed]>][Date Sun, 10 Oct 2004 13:33:29 -0800]/html/[From "Macy’s Gift Card Giveway" <[removed]>][Date Sun, 10 Oct 2004 18:58:50 -0 … /[From "Good News" <[removed]>][Date Mon, 11 Oct 2004 00:28:59 -0800]/html Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Authentic Daily Savings" <[removed]>][Date Sun, 10 Oct 2004 13:33:29 -0800]/html/[From "Macy’s Gift Card Giveway" <[removed]>][Date Sun, 10 Oct 2004 18:58:50 -0800]/html Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Authentic Daily Savings" <[removed]>][Date Sun, 10 Oct 2004 13:33:29 -0800]/html Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From "Online Gift Cards for you" <[removed]>][Date Mon, 11 Oct 2004 16:23:27 -0 … /[From Citibank Group <[removed]>][Date Mon, 11 Oct 2004 19:42:44 -0600]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From "Online Gift Cards for you" <[removed]>][Date Mon, 11 Oct 2004 16:23:27 -0800]/html/[From Customer Support <[removed]>][Date Mon, 11 Oct 2004 23:47:08 -0600]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From "Online Gift Cards for you" <[removed]>][Date Mon, 11 Oct 2004 16:23:27 -0800]/html Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From "Family Memories" <[removed]>][Date Wed, 13 Oct 2004 07:02:06 -0800]/html/[From "Freida Rojas" ][Date Wed, 13 Oct 2004 21:37:19 +0200]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From "Family Memories" <[removed]>][Date Wed, 13 Oct 2004 07:02:06 -0800]/html/[From "Freida Rojas" <[removed]>][Date Wed, 13 Oct 2004 19:16:45 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From "Family Memories" <[removed]>][Date Wed, 13 Oct 2004 07:02:06 -0800]/html Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From NELSON WHITE <[removed]>][Date Sun, 17 Oct 2004 20:46:30 +0200]/UNNAMED/[From GOLDEN STRIKE LOTTERY AUSTRIA <[removed]>][Date Mon, 18 Oct 2004 13:48:17 +0200]/UNNAMED Infected: Trojan-Dropper.VBS.Zerolin skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From NELSON WHITE <[removed]>][Date Sun, 17 Oct 2004 20:46:30 +0200]/UNNAMED/[Fro … /[Fro … /[From Customer Support <[removed]>][Date Thu, 21 Oct 2004 02:03:10 -0400]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From NELSON WHITE <[removed]>][Date Sun, 17 Oct 2004 20:46:30 +0200]/UNNAMED/[Fro … /[Fro … /[From Customer Support <[removed]>][Date Thu, 21 Oct 2004 10:49:19 +0200]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From NELSON WHITE <[removed]>][Date Sun, 17 Oct 2004 20:46:30 +0200]/UNNAMED/[Fro … /[Fro … /[From Customer Support <[removed]>][Date Thu, 21 Oct 2004 19:08:56 -0100]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From NELSON WHITE <[removed]>][Date Sun, 17 Oct 2004 20:46:30 +0200]/UNNAMED/[Fro … /[Fro … /[From "erma Asing" <[removed]>][Date Wed, 20 Oct 2004 21:38:02 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From NELSON WHITE <[removed]>][Date Sun, 17 Oct 2004 20:46:30 +0200]/UNNAMED/[Fro … /[From "Nadine Rivas" <[removed]>][Date Wed, 20 Oct 2004 07:39:03 +0200 (SAST)]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From NELSON WHITE <[removed]>][Date Sun, 17 Oct 2004 20:46:30 +0200]/UNNAMED/[From "Ama … /[From "Richard Grove" <[removed]>][Date Tue, 19 Oct 2004 23:43:27 -0300]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From NELSON WHITE <[removed]>][Date Sun, 17 Oct 2004 20:46:30 +0200]/UNNAMED/[From "Amazing GiveAways" <[removed]>][Date Tue, 19 Oct 2004 14:00:37 -0800]/html Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From NELSON WHITE <[removed]>][Date Sun, 17 Oct 2004 20:46:30 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From Bobbie Arroyo <[removed]>][Date Tue, 26 Oct 2004 03:48:00 -0600 EST]/UNNAMED/[From "Efren Olson" <[removed]>][Date Thu, 14 Oct 2004 15:23:38 -0400 (EDT)]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html/[From Bobbie Arroyo <[removed]>][Date Tue, 26 Oct 2004 03:48:00 -0600 EST]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Large Screen TV Now" <[removed]>][Date Sun, 10 Oct 2004 18:30:42 -0800]/html Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Heather Van Vorous" <[removed]>][Date Wed, 27 Oct 2004 08:38:51 -0700 (PDT)]/UNNAMED/[From "Jose Jacobsonl" <[removed]>][Date Fri, 29 Oct 2004 23:51:43 -0600]/UNNAMED/[From [removed] <"Melton Matilda">][Date Thu, 28 Oct 2004 19:40:19 -0800]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Heather Van Vorous" <[removed]>][Date Wed, 27 Oct 2004 08:38:51 -0700 (PDT)]/UNNAMED/[From "Jose Jacobsonl" <[removed]>][Date Fri, 29 Oct 2004 23:51:43 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Heather Van Vorous" <[removed]>][Date Wed, 27 Oct 2004 08:38:51 -0700 (PDT)]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Autumn Ortega" <[removed]>][Date Mon, 20 Oct 2003 00:44:44 -0600]/UNNAMED/[From "Rachel Larkin" <[removed]>][Date Sun, 31 Oct 2004 14:09:38 +0100]/html/[From "BRUCE" ][Date Sun, 31 Oct 2004 19:22:55 -0700]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Autumn Ortega" <[removed]>][Date Mon, 20 Oct 2003 00:44:44 -0600]/UNNAMED/[From "Rachel Larkin" <[removed]>][Date Sun, 31 Oct 2004 14:09:38 +0100]/html/[From "BRUCE" ][Date Sun, 31 Oct 2004 22:34:32 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Autumn Ortega" <[removed]>][Date Mon, 20 Oct 2003 00:44:44 -0600]/UNNAMED/[From "Rachel Larkin" <[removed]>][Date Sun, 31 Oct 2004 14:09:38 +0100]/html/[From "BRUCE" <[removed]>][Da … /[From Sophia Thomas <[removed]>][Date Sun, 31 Oct 2004 20:00:06 +0600]/html Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Autumn Ortega" <[removed]>][Date Mon, 20 Oct 2003 00:44:44 -0600]/UNNAMED/[From "Rachel Larkin" <[removed]>][Date Sun, 31 Oct 2004 14:09:38 +0100]/html/[From "BRUCE" <[removed]>][Date Sat, 30 Oct 2004 21:05:54 -0400]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Autumn Ortega" <[removed]>][Date Mon, 20 Oct 2003 00:44:44 -0600]/UNNAMED/[From "Rachel Larkin" <[removed]>][Date Sun, 31 Oct 2004 14:09:38 +0100]/html/[From "Meds 80% Off" ][Date Wed, 03 Nov 2004 17:30:38 -0600]/text Infected: Trojan-Spy.HTML.Citifraud.av skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Autumn Ortega" <[removed]>][Date Mon, 20 Oct 2003 00:44:44 -0600]/UNNAMED/[From "Rachel Larkin" <[removed]>][Date Sun, 31 Oct 2004 14:09:38 +0100]/html/[From "Meds 80% … /[From "Co … /[From Myron Barrow <[removed]>][Date Thu, 04 Nov 2004 19:22:12 -0200]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Autumn Ortega" <[removed]>][Date Mon, 20 Oct 2003 00:44:44 -0600]/UNNAMED/[From "Rachel Larkin" <[removed]>][Date Sun, 31 Oct 2004 14:09:38 +0100]/html/[From "Meds 80% … /[From "Con … /[From Customer Support <[removed]>][Date Sat, 06 Nov 2004 03:23:35 +0500]/text Infected: Trojan-Spy.HTML.Citifraud.ax skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Autumn Ortega" <[removed]>][Date Mon, 20 Oct 2003 00:44:44 -0600]/UNNAMED/[From "Rachel Larkin" <[removed]>][Date Sun, 31 Oct 2004 14:09:38 +0100]/html/[From "Meds 80% … /[ … /[From "Customer Support" <[removed]>][Date Sat, 6 Nov 2004 05:11:51 +0200 (SAST)]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Autumn Ortega" <[removed]>][Date Mon, 20 Oct 2003 00:44:44 -0600]/UNNAMED/[From "Rachel Larkin" <[removed]>][Date Sun, 31 Oct 2004 14:09:38 +0100]/html/[From "Meds 80% … /[From "Congratulations" <[removed]>][Date Fri, 05 Nov 2004 07:56:28 -0800]/html Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Autumn Ortega" <[removed]>][Date Mon, 20 Oct 2003 00:44:44 -0600]/UNNAMED/[From "Rachel Larkin" <[removed]>][Date Sun, 31 Oct 2004 14:09:38 +0100]/html/[From "Meds 80% Off" … /[From "New Car News" <[removed]>][Date Wed, 03 Nov 2004 17:56:20 -0800]/html Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Autumn Ortega" <[removed]>][Date Mon, 20 Oct 2003 00:44:44 -0600]/UNNAMED/[From "Rachel Larkin" <[removed]>][Date Sun, 31 Oct 2004 14:09:38 +0100]/html/[From "Meds 80% Off" ][Date Wed, 03 Nov 2004 18:07:58 -0100]/html Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Autumn Ortega" <[removed]>][Date Mon, 20 Oct 2003 00:44:44 -0600]/UNNAMED/[From "Rachel Larkin" <[removed]>][Date Sun, 31 Oct 2004 14:09:38 +0100]/html/[From "Meds 80% Off" ][Date Wed, 03 Nov 2004 22:36:21 +0500]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Autumn Ortega" <[removed]>][Date Mon, 20 Oct 2003 00:44:44 -0600]/UNNAMED/[From "Rachel Larkin" <[removed]>][Date Sun, 31 Oct 2004 14:09:38 +0100]/html/[From "Meds 80% Off" <[removed]>][Date Wed, 03 Nov 2004 13:56:41 -0600 (MSD)]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Autumn Ortega" <[removed]>][Date Mon, 20 Oct 2003 00:44:44 -0600]/UNNAMED/[From "Rachel Larkin" <[removed]>][Date Sun, 31 Oct 2004 14:09:38 +0100]/html Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Autumn Ortega" <[removed]>][Date Mon, 20 Oct 2003 00:44:44 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Jamie Cobb" <[removed]>][Date Mon, 08 Nov 2004 02:49:25 +0000]/html/[From Customer Support <[removed]>][Date Sun, 07 Nov 2004 20:05:21 +0200]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Jamie Cobb" <[removed]>][Date Mon, 08 Nov 2004 02:49:25 +0000]/html/[From [removed]][Date Sun, 07 Nov 2004 13:32:11 -0500]/text/[From "Canadian Pharm … /[From "Mat … /[From "Dollie C … /[From "Don" <[removed]>][Date Mon, 8 Nov 2004 04:04:51 -0500]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Jamie Cobb" <[removed]>][Date Mon, 08 Nov 2004 02:49:25 +0000]/html/[From [removed]][Date Sun, 07 Nov 2004 13:32:11 -0500]/text/[From "Canadian Pharm … /[From "Mat … /[From "Dollie Chatman" <[removed]>][Date Mon, 08 Nov 2004 10:36:30 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Jamie Cobb" <[removed]>][Date Mon, 08 Nov 2004 02:49:25 +0000]/html/[From [removed]][Date Sun, 07 Nov 2004 13:32:11 -0500]/text/[From "Canadian Pharm … /[From "Matthew C. Wilkinson" <[removed]>][Date Mon, 08 Nov 2004 19:20:46 +0000]/html Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Jamie Cobb" <[removed]>][Date Mon, 08 Nov 2004 02:49:25 +0000]/html/[From [removed]][Date Sun, 07 Nov 2004 13:32:11 -0500]/text/[From "Canadian Pharmacy 13" <[removed]>][Date Mon, 08 Nov 2004 09:44:46 -0500 (MSD)]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Jamie Cobb" <[removed]>][Date Mon, 08 Nov 2004 02:49:25 +0000]/html/[From [removed]][Date Sun, 07 Nov 2004 13:32:11 -0500]/text Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Jamie Cobb" <[removed]>][Date Mon, 08 Nov 2004 02:49:25 +0000]/html Infected: Trojan-Spy.HTML.Citifraud.ay skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Sensational Daily Savings" <[removed]>][Date Sun, 21 Nov 2004 18:34:06 -0800]/html/[From "Harold David" <[removed]>][Date Sat, 20 Nov 2004 06:36:10 -0700]/html/[From "A … /[From "Charter One Bank" <[removed]>][Date Wed, 24 Nov 2004 03:12:33 -0300]/html Infected: Trojan-Spy.HTML.Bankfraud.am skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Sensational Daily Savings" <[removed]>][Date Sun, 21 Nov 2004 18:34:06 -0800]/html/[From "Harold David" <[removed]>][Date Sat, 20 Nov 2004 06:36:10 -0700]/html/[From "Award Dept." <[removed]>][Date Tue, 23 Nov 2004 17:19:01 -0800]/html Infected: Trojan-Spy.HTML.Bankfraud.am skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Sensational Daily Savings" <[removed]>][Date Sun, 21 Nov 2004 18:34:06 -0800]/html/[From "Harold David" <[removed]>][Date Sat, 20 Nov 2004 06:36:10 -0700]/html Infected: Trojan-Spy.HTML.Bankfraud.am skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text/[From "Sensational Daily Savings" <[removed]>][Date Sun, 21 Nov 2004 18:34:06 -0800]/html Infected: Trojan-Spy.HTML.Bankfraud.am skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text/[From Diane Whalen <[removed]>][Date Tue, 10 Aug 2004 04:54:17 +0300 (CST)]/text Infected: Trojan-Spy.HTML.Bankfraud.am skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk/[From "lavern nunev" <[removed]>][Date Mon, 09 Aug 2004 12:30:24 +0100]/text Infected: Trojan-Spy.HTML.Bankfraud.am skipped C:\Documents and Settings\Steven Lottering\Application Data\Thunderbird\Profiles\default\t5otuy4d.slt\Mail\pop.tiscali.co.za\Junk Mail Berkeley mbox: infected - 61 skipped C:\Documents and Settings\Steven Lottering\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Google\Google Desktop Search\dbc2em.cf1 Object is locked skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Google\Google Desktop Search\dbc2emh.ht1 Object is locked skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Google\Google Desktop Search\dbdam Object is locked skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Google\Google Desktop Search\dbdao Object is locked skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Google\Google Desktop Search\dbeam Object is locked skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Google\Google Desktop Search\dbeao Object is locked skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Google\Google Desktop Search\dbm Object is locked skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Google\Google Desktop Search\dbu2dm.cf1 Object is locked skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Google\Google Desktop Search\dbu2dmh.ht1 Object is locked skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Google\Google Desktop Search\dbvm.cf1 Object is locked skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Google\Google Desktop Search\dbvmh.ht1 Object is locked skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Google\Google Desktop Search\fii.cf1 Object is locked skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Google\Google Desktop Search\fiih.ht1 Object is locked skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Google\Google Desktop Search\rpm.cf1 Object is locked skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Google\Google Desktop Search\rpmh.ht1 Object is locked skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Identities\{00968ACA-7840-4C62-9FFD-F7E5E0C226C4}\Microsoft\Outlook Express\Melinda.dbx/[From "Ingrid Davey" <[removed]>][Date Wed, 23 Aug 2000 12:35:14 +0200]/UNNAMED/UNNAMED/html Infected: Email-Worm.VBS.KakWorm skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Identities\{00968ACA-7840-4C62-9FFD-F7E5E0C226C4}\Microsoft\Outlook Express\Melinda.dbx/[From "Ingrid Davey" <[removed]>][Date Wed, 23 Aug 2000 12:35:14 +0200]/UNNAMED/UNNAMED Infected: Email-Worm.VBS.KakWorm skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Identities\{00968ACA-7840-4C62-9FFD-F7E5E0C226C4}\Microsoft\Outlook Express\Melinda.dbx/[From "Ingrid Davey" <[removed]>][Date Wed, 23 Aug 2000 12:35:14 +0200]/UNNAMED Infected: Email-Worm.VBS.KakWorm skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Identities\{00968ACA-7840-4C62-9FFD-F7E5E0C226C4}\Microsoft\Outlook Express\Melinda.dbx Mail MS Outlook 5: infected - 3 skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Identities\{00968ACA-7840-4C62-9FFD-F7E5E0C226C4}\Microsoft\Outlook Express\Personal.dbx/[From "James Glanville" <[removed]>][Date Tue, 20 Feb 2001 19:38:36 +0200]/html Infected: Email-Worm.VBS.KakWorm skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Identities\{00968ACA-7840-4C62-9FFD-F7E5E0C226C4}\Microsoft\Outlook Express\Personal.dbx/[From "James Glanville" <[removed]>][Date Tue, 20 Feb 2001 19:38:36 +0200]/UNNAMED/html Infected: Email-Worm.VBS.KakWorm skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Identities\{00968ACA-7840-4C62-9FFD-F7E5E0C226C4}\Microsoft\Outlook Express\Personal.dbx/[From "James Glanville" <[removed]>][Date Tue, 20 Feb 2001 19:38:36 +0200]/UNNAMED Infected: Email-Worm.VBS.KakWorm skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Identities\{00968ACA-7840-4C62-9FFD-F7E5E0C226C4}\Microsoft\Outlook Express\Personal.dbx Mail MS Outlook 5: infected - 3 skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Steven Lottering\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{2D22D8E5-1F37-45CE-9564-6E264EE8366C} Object is locked skipped C:\Documents and Settings\Steven Lottering\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Steven Lottering\Local Settings\History\History.IE5\MSHist012006082120060822\index.dat Object is locked skipped C:\Documents and Settings\Steven Lottering\Local Settings\Temp\~DFCFDE.tmp Object is locked skipped C:\Documents and Settings\Steven Lottering\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Steven Lottering\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Steven Lottering\NTUSER.DAT.LOG Object is locked skipped C:\Program Files\UPSMON\8\37.pal Object is locked skipped C:\Program Files\UPSMON\DATABuff.REC Object is locked skipped C:\Program Files\Veoh\client.log Object is locked skipped C:\Program Files\Veoh\upload.log Object is locked skipped C:\Program Files\Veoh\veoh.db Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{3874CF21-57E4-4655-B74B-59EE5A615432}\RP11\change.log Object is locked skipped C:\System Volume Information\_restore{3874CF21-57E4-4655-B74B-59EE5A615432}\RP8\A0002077.exe/WISE0017.BIN Infected: not-a-virus:AdWare.Win32.180Solutions.d skipped C:\System Volume Information\_restore{3874CF21-57E4-4655-B74B-59EE5A615432}\RP8\A0002077.exe/WISE0037.BIN Infected: not-a-virus:AdWare.Win32.NewDotNe

Scan here >>>> http://support.f-secure.com/enu/home/ols.shtml and post the log please.

Scanning Report Saturday, August 26, 2006 11:01:03 - 10:16:23 Computer name: STEVEN Scanning type: Scan system for viruses, rootkits, spyware Target: C:\ Result: 2 malware found JS/Istbar.A (virus) * C:\DOWNLOADS\ICUIISERIALCODE.HTM (Submitted) Tracking Cookie (spyware) * System (Disinfected) Statistics Scanned: * Files: 49975 * System: 5931 * Not scanned: 4 Actions: * Disinfected: 1 * Renamed: 0 * Deleted: 0 * None: 1 * Submitted: 1 Files not scanned: * C:\PAGEFILE.SYS * C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT * C:\DOCUMENTS AND SETTINGS\STEVEN LOTTERING\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\FILETRACKER\{E561371D-9B55-447E-8B20-5E99307AF07D} * C:\DOCUMENTS AND SETTINGS\STEVEN LOTTERING\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\GOOGLE DESKTOP SEARCH\DBDAM Options Scanning engines: * F-Secure AVP: 6.0.171, 2006-08-26 * F-Secure Libra: 2.4.1, 2006-08-24 * F-Secure Orion: 1.2.37, 2006-08-25 * F-Secure Blacklight: 1.0.31, 0000-00-00 * F-Secure Draco: 1.0.35, 0259-24-212 * F-Secure Pegasus: 1.19.0, 2006-07-18 Scanning options: * Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ZIP XXX * Use Advanced heuristics Copyright © 1998-2006 Product support |Send virus sample to F-Secure F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name.This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.

Sorry, on the road again for a few days. A new hijackthis log please and let me know how things are running.

Download the trial version of trojan hunter from the link below. Update it scan your system and allow it to clean what it finds.

http://www.trojanhunter.com/

Let me know if it finds something it can not remove.

Thanks for all the help. I had to format my HD and reinstall everything last week - pc froze totally - there are no trojans picked up now and hopefully I'll be able to keep it that way. Till l8r Steven