Something has infiltrated My computer. Please help!

Glad you have seen a little improvement. I would like to obtain additional information before trying some fixes.

STEP 1.
======
Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

You may receive pop-up asking if you will allow script to run when you perform the following instructions. Please allow the script to run.

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

If you receive, while running option #1, an error similar like: ''C:\windows\system32\cmd.exe
C:\windows\system32\autoexec.nt the system file is not suitable for running ms-dos and microsoft windows applications. choose close to terminate the application.."…then please use option 5 or the web page link in the l2mfix folder to solve this error condition. do not run the fix portion without fixing this first.

Rootkit Revealer

Please download
Rootkit Revealer
to your desktop.

• Unzip the file.
• Turn off your real time antivirus for a moment.
• Then go to file->scan
• This will take some time.
• When it's done, go to file->save
• save the logfile to the desktop

Then past the contents here.
*Don't forget to turn your AV back on afterwards*

Please post (reply) with the reports from the l2mfix and the rootkit revealer log.

STEP 1.
======
WinsockXPfix
Let's do this- skip download if you still have it.
Download WinsockXPfix
Locate the Winsockxpfix.exe and double click and click Run.
The VB_WinFix Win 1.2 window will appear.
Click Fix

STEP 2.
======
Hoster

Please download hoster.

• Unzip Hoster.zip
• Open Hoster.exe.
• Then click on "Restore Original Hosts"
• Close program when complete.
• Empty Recycle Bin

Scan with HijackThis. Place a check against each of the following:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.4199.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.4199.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.4199.com
O2 - BHO: MyIEHelper Class - {16B770A0-0E87-4278-B748-2460D64A8386} - C:\Documents and Settings\All Users\Application Data\Microsoft\UserData\IEHelper_5059.dll
O2 - BHO: CdnForIE Class - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: ÐÅÏ¢¼ìË÷ - {CE7C3CF0-98A8-474D-B2B5-1ED7E2E3B004} - C:\WINDOWS\system32\IEHelper.dll
O4 - HKLM\..\Run: [zt] C:\WINDOWS\Intel\rundll32.exe
O4 - HKLM\..\Run: [Ljx] C:\WINDOWS\inf\rundll32.exe
O4 - HKLM\..\Run: [Update] C:\Program Files\Common Files\UPDATE2\Update.exe
O4 - HKLM\..\Run: [KUCO] D:\¿á¿ÍÓéÀÖƽ̨\KUCO.exe
O4 - HKLM\..\Run: [Torjan Program] C:\WINDOWS\WINLOGON.EXE
O4 - HKLM\..\Run: [CdnCtr] C:\Program Files\CNNIC\Cdn\cdnup.exe
O4 - HKLM\..\Run: [run] C:\WINDOWS\system32\rundll32.exe rsrc.dll s
O4 - HKLM\..\RunOnce: [InnoSetupRegFile.0000000001] "C:\WINDOWS\is-41U24.exe" /REG
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Syss] C:\DOCUME~1\KEVINR~1\LOCALS~1\Temp\setup.exe
O4 - HKCU\..\Run: [MyShares] c:\program Files\Òä¶à¶à\MyShares.exe /tray
O4 - HKCU\..\Run: [msnnt] C:\WINDOWS\winampb.exe
O9 - Extra button: Chinese Navigation - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll
O9 - Extra 'Tools' menuitem: Chinese Navigation - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll
Close all windows or browsers except for Hijackthis. Click on Fix Checked when finished and exit HijackThis.

STEP 3.
======
Delete Files with Killbox

Download Pocket Killbox from http://www.downloads.subratam.org/KillBox.zip and unzip it; save it to your Desktop. DO NOT RUN IT YET.
==========
Double-click on KillBox.exe to launch the program. It is the red circle with a large white X in it
- Highlight the files in bold RED below and press the Ctrl key and the C key at the same time to copy them to the clipboard
C:\WINDOWS\SYSTEM32\avibiosm.dll
C:\WINDOWS\SYSTEM32\cdnns.dll
C:\WINDOWS\SYSTEM32\cnscheck.dll
C:\WINDOWS\SYSTEM32\cnsche~1.dll
C:\WINDOWS\SYSTEM32\cnsche~2.dll
C:\WINDOWS\SYSTEM32\dllwm.dll
C:\WINDOWS\SYSTEM32\engt32c.dll
C:\WINDOWS\SYSTEM32\enup32.dll
C:\WINDOWS\SYSTEM32\iehelper.dll
C:\WINDOWS\SYSTEM32\msdll.dll
C:\WINDOWS\SYSTEM32\myrx.dll
C:\WINDOWS\SYSTEM32\nmhxy.dll
C:\WINDOWS\SYSTEM32\popwin.dll
C:\WINDOWS\SYSTEM32\provbm~1.dll
C:\WINDOWS\SYSTEM32\qq_mail.dll
C:\WINDOWS\SYSTEM32\quartz32.dll
C:\WINDOWS\SYSTEM32\ultra32.dll
C:\WINDOWS\SYSTEM32\wdata32.dll
C:\WINDOWS\SYSTEM32\winscok.dll
C:\WINDOWS\SYSTEM32\wshcon32.dll
C:\WINDOWS\SYSTEM32\xydll.dll
C:\WINDOWS\SYSTEM32\ztdll.dll
C:\WINDOWS\SYSTEM32\systmf.exe
C:\WINDOWS\SYSTEM32\Launcher.exe
C:\WINDOWS\SYSTEM32\ansi.dll
C:\WINDOWS\SYSTEM32\Winver.drv
C:\WINDOWS\SYSTEM32\Ravdm.exe
C:\WINDOWS\SYSTEM32\vpcrm.exe
C:\WINDOWS\SYSTEM32\haotian.dLL
C:\WINDOWS\SYSTEM32\mswdm.exe
C:\WINDOWS\Intel\rundll32.exe
C:\WINDOWS\inf\rundll32.exe
C:\Documents and Settings\All Users\Application Data\Microsoft\UserData\IEHelper_5059.dll
C:\Program Files\CNNIC\Cdn\cdnforie.dll
C:\WINDOWS\system32\IEHelper.dll
C:\Program Files\Common Files\UPDATE2\Update.exe
D:\¿á¿ÍÓéÀÖƽ̨\KUCO.exe
C:\WINDOWS\WINLOGON.EXE
C:\Program Files\CNNIC\Cdn\cdnup.exe
C:\WINDOWS\is-41U24.exe
C:\Documents and Settings\Kevin Roy\Local Settings\Temp\setup.exe
c:\program Files\Òä¶à¶à\MyShares.exe /tray
C:\WINDOWS\winampb.exe

In Killbox click on the File menu and then the Paste from Clipboard item
in the Full Path of File to Delete field drop down the arrow and make sure that all of the files are listed
(Please note that the tool checks your computer for the presence of the files pasted into the box so if files are not present, it is possible that you might not see all files you pasted into the box.)

• Click the option to Delete on Reboot
• Click End Explorer Shell while Killing File
• Click All Files right of the flashing green "Single files"
• Click Yes when it asks "Files will be Removed on Reboot, Do you want to reboot now?"

(Note: If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just reboot manually)

If you have any issues with this method you can copy and paste the lines one at a time into the killbox top box. Then click the "Single File" button. Then click the Red X …and for the confirmation message that will appear, you will need to click Yes. A second message will ask to Reboot now? you will need to click No until the last one at which time you click yes to allow the reboot.

Post (reply) with a fresh HijackThis log and we will take another look.

Hi Kevin, things are looking better!

STEP 1.
======
Scan with HijackThis. Place a check against each of the following:
F3 - REG:win.ini: load=C:\WINDOWS\rundl132.exe
O2 - BHO: MyIEHelper Class - {16B770A0-0E87-4278-B748-2460D64A8386} - C:\Documents and Settings\All Users\Application Data\Microsoft\UserData\IEHelper_5059.dll (file missing)
O2 - BHO: (no name) - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - (no file)
O2 - BHO: (no name) - {CE7C3CF0-98A8-474D-B2B5-1ED7E2E3B004} - (no file)
O4 - HKLM\..\Run: [Tray] C:\WINDOWS\command\rundll32.exe
O4 - HKCU\..\Run: [updatereal] C:\WINDOWS\realupdate.exe other
O11 - Options group: [CDNCLIENT] Chinese Navigation
Close all windows or browsers except for Hijackthis. Click on Fix Checked when finished and exit HijackThis.

STEP 2.
======
Delete Files with Killbox

Skip the download if you still have it.
Download Pocket Killbox from http://www.downloads.subratam.org/KillBox.zip and unzip it; save it to your Desktop. DO NOT RUN IT YET.
==========
Double-click on KillBox.exe to launch the program. It is the red circle with a large white X in it
- Highlight the files in bold RED below and press the Ctrl key and the C key at the same time to copy them to the clipboard
C:\WINDOWS\command\rundll32.exe
C:\WINDOWS\rundl132.exe
C:\WINDOWS\1Sy.exe
C:\WINDOWS\realupdate.exe

In Killbox click on the File menu and then the Paste from Clipboard item
in the Full Path of File to Delete field drop down the arrow and make sure that all of the files are listed
(Please note that the tool checks your computer for the presence of the files pasted into the box so if files are not present, it is possible that you might not see all files you pasted into the box.)

• Click the option to Delete on Reboot
• Click End Explorer Shell while Killing File
• Click All Files right of the flashing green "Single files"
• Click Yes when it asks "Files will be Removed on Reboot, Do you want to reboot now?"

(Note: If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just reboot manually)

If you have any issues with this method you can copy and paste the lines one at a time into the killbox top box. Then click the "Single File" button. Then click the Red X …and for the confirmation message that will appear, you will need to click Yes. A second message will ask to Reboot now? you will need to click No until the last one at which time you click yes to allow the reboot.

STEP 3.
Download SDFix and save it to your desktop.

Please then reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, a menu with options should appear;
• Select the first option, to run Windows in Safe Mode, then press "Enter".
• Choose your usual account.

• In Safe Mode, right click the SDFix.zip folder and choose Extract All,
• Open the extracted folder and double click RunThis.bat to start the script.
• Type Y to begin the script.
• It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• Your system will take longer that normal to restart as the fixtool will be running and removing files.
• When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons.
• Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt back onto the forum with a new HijackThis log

Hi Kevin,

There are a couple of entries that are being difficult to remove so I will consult with others about them. Meanwhile please do the following:

STEP 1.
======
Look2Me

You have the latest version of VX2. Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

You may receive pop-up asking if you will allow script to run when you perform the following instructions. Please allow the script to run.

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

If you receive, while running option #1, an error similar like: ''C:\windows\system32\cmd.exe
C:\windows\system32\autoexec.nt the system file is not suitable for running ms-dos and microsoft windows applications. choose close to terminate the application.."…then please use option 5 or the web page link in the l2mfix folder to solve this error condition. do not run the fix portion without fixing this first.
==========
Now run this online scan using Internet Explorer:
Kaspersky Online Scanner from http://www.kaspersky.com/virusscanner

Next Click on Launch Kaspersky Online Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
• Now click on Scan Settings
• In the scan settings make that the following are selected:
• Scan using the following Anti-Virus database:
• Standard
• Scan Options:
• Scan Archives
• Scan Mail Bases
• Click OK
• Now under select a target to scan:
• Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
• Now click on the Save as Text button:
• Save the file to your desktop.

Please post (reply) with the report from the l2mfix and the information from Kapersky.

Please do this also.

STEP 1.
======
WinPFind
Please Download the following tools to assist us in removing this infection! Download WinPFind from http://www.bleepingcomputer.com/files/winpfind.php

• Right Click the Zip Folder and Select Extract All
• Extract it somewhere you will remember like the Desktop
• Don’t do anything with it yet!

Reboot.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode

• Doubleclick WinPFind.exe
• Click on Configure Scan Options.
• Remove all the checkmarks under Folder Options on the left side by clicking the button Remove All, uncheck Run Addon's and click Apply.
• Click Start Scan
  It will scan the entire System, so please be patient! This scan may take awhile

Once the Scan is Complete

• Reboot your computer into normal mode.
• Go to the WinPFind folder
• Locate WinPFind.txt
• Copy the results from the WinPFind.txt file and post the results in your next reply.

Here is the first 2 logs you asked for, the third one will follow in the next thread. Thanks. Kevin L2MFIX find log 032106 These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] @="" "DLLName"="igfxsrvc.dll" "Asynchronous"=dword:00000001 "Impersonate"=dword:00000001 "Unlock"="WinlogonUnlockEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"="C:\\WINDOWS\\system32\\klogon.dll" "Logon"="WLEventStop" "Startup"="WLEventStart" "Lock"="WLEventStart" "Unlock"="WLEventStop" "Logoff"="WLEventStart" @="" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\VESWinlogon] "Asynchronous"=dword:00000001 "Impersonate"=dword:00000000 "Startup"="EventStartup" "DllName"=hex(2):56,00,45,00,53,00,57,00,69,00,6e,00,6c,00,6f,00,67,00,6f,00,\ 6e,00,2e,00,64,00,6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "SV1"="" ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet" "{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management" "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page" "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page" "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing" "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension" "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension" "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension" "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension" "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page" "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page" "{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler" "{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension" "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects" "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management" "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management" "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression" "{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension" "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI" "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu" "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase" "{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext" "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts" "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile" "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page" "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing" "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension" "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension" "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension" "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections" "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections" "{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class" "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras" "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras" "{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras" "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras" "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras" "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension" "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host" "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link" "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler" "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension" "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks" "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults" "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension" "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu" "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search" "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support" "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support" "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run…" "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet" "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail" "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts" "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools" "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page" "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions" "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler" "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler" "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler" "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler" "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler" "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor" "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar" "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status" "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder" "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2" "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy" "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand" "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band" "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search" "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search" "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility" "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address" "{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox" "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete" "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor" "{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List" "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List" "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible" "{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar" "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List" "{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List" "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container" "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu" "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp" "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar" "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite" "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist" "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings" "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band" "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service" "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer" "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture" "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut" "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service" "{FF393560-C2A7-11CF-BFF4-444553540000}"="History" "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook" "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen" "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook" "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC" "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC" "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet" "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space" "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band" "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder" "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck" "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr" "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder" "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler" "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent" "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent" "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent" "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent" "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent" "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler" "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager" "{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator" "{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher" "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs" "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory" "{00E7B358-F65B-4dcf-83DF-CD026B94BFD4}"="Autoplay for SlideShow" "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor" "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)" "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor" "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler" "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard" "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web" "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object" "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard" "{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts" "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler" "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target" "{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder" "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview" "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext" "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control" "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control" "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control" "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control" "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control" "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI" "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object" "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find" "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find" "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI" "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs" "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook" "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target" "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties" "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu" "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options" "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder" "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler" "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell" "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%" "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler" "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer" "{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People…" "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler" "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler" "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler" "{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices" "{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu" "{ED58A35B-B554-42AF-A26C-6F3D424200D3}"="Sony Power Management Extensiond" "{F6A51CCC-6AA6-46ad-B726-97466F0A38BF}"="SafeGuardr PrivateDisk extension" "{C6643EC0-49AC-4c15-A455-04104DB900A9}"="Image Converter context menu extension" "{DEE12703-6333-4D4E-8F34-738C4DCC2E04}"="RecordNow! SendToExt" "{E91B2703-013E-4A99-AD33-2B6FB00AA356}"="RecordNow! ContextMenuExt" "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"="Adobe.Acrobat.ContextMenu" "{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders" "{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler" "{0006F045-0000-0000-C000-000000000046}"="Microsoft Office Outlook Custom Icon Handler" "{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler" "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player" "{21569614-B795-46b1-85F4-E737A8DC09AD}"="Shell Search Band" "{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}"="iTunes" "{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper" "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File" "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut" "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object" "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu" "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties" "{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache" "{85E0B171-04FA-11D1-B7DA-00A0C90348D6}"="Web Anti-Virus" "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension" ********************************************************************************** HKEY ROOT CLASSIDS: ********************************************************************************** Files Found are not all bad files: C:\WINDOWS\SYSTEM32\ myrx.dll Sat 7 Oct 2006 12:53:50 A…. 55,808 54.50 K myztr.dll Sat 7 Oct 2006 12:53:50 A…. 53,248 52.00 K packet.dll Thu 31 Aug 2006 23:01:26 A…. 81,920 80.00 K quartz32.dll Thu 5 Oct 2006 22:33:30 A…. 114,688 112.00 K rsrc.dll Thu 5 Oct 2006 22:55:46 A…. 41,501 40.53 K tdll.dll Fri 6 Oct 2006 23:55:22 A…. 39,936 39.00 K wanpac~1.dll Thu 31 Aug 2006 23:01:26 A…. 61,440 60.00 K wshcon32.dll Thu 5 Oct 2006 22:52:32 A…. 114,688 112.00 K 8 items found: 8 files, 0 directories. Total of file sizes: 563,229 bytes 550.03 K Locate .tmp files: No matches found. ********************************************************************************** Directory Listing of system files: Volume in drive C is VAIO Volume Serial Number is 54A5-8EF0 Directory of C:\WINDOWS\System32 23/09/2006 20:46 dllcache 30/08/2006 16:30 51,623 dxdiag.com 30/08/2006 16:30 51,623 finder.com 30/08/2006 16:30 51,623 MSCONFIG.COM 30/08/2006 16:30 51,623 command.pif 30/08/2006 16:13 GroupPolicy 27/08/2006 11:03 26,112 netcfgw.exe 03/03/2005 18:41 Microsoft 04/08/2004 13:00 21,553 Ravdm.exe 04/08/2004 13:00 22,528 mswdm.exe 07/10/2002 04:59 24,064 ineptpui.dll 8 File(s) 300,749 bytes 3 Dir(s) 2,708,193,280 bytes free Kaspersky: ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Saturday, October 07, 2006 8:41:52 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 7/10/2006 Kaspersky Anti-Virus database records: 216562 ——————————————————————————- Scan Settings: Scan using the following antivirus database: standard Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ F:\ G:\ I:\ Scan Statistics: Total number of scanned objects: 126920 Number of viruses found: 55 Number of infected objects: 178 / 0 Number of suspicious objects: 0 Duration of the scan process: 01:25:17 Infected Object Name / Virus Name / Last Action C:\!KillBox\1Sy.exe Infected: Trojan-PSW.Win32.Lineage.amd skipped C:\!KillBox\cnscheck.dll Infected: Trojan-PSW.Win32.Agent.hk skipped C:\!KillBox\cnsche~2.dll Infected: Trojan-PSW.Win32.Agent.im skipped C:\!KillBox\Launcher.exe Infected: Worm.Win32.Viking.ao skipped C:\!KillBox\msdll.dll Infected: Trojan-PSW.Win32.Lineage.ahw skipped C:\!KillBox\mswdm.exe Infected: Trojan-Downloader.Win32.Small.czl skipped C:\!KillBox\myrx.dll Infected: Trojan-PSW.Win32.Agent.ia skipped C:\!KillBox\nmhxy.dll Infected: Trojan-PSW.Win32.Agent.iu skipped C:\!KillBox\Ravdm.exe Infected: Trojan-PSW.Win32.Lmir.bbv skipped C:\!KillBox\rundl132.exe Infected: Worm.Win32.Viking.ao skipped C:\!KillBox\rundll32.exe Infected: Trojan-PSW.Win32.Lineage.amd skipped C:\!KillBox\systmf.exe Infected: Trojan-PSW.Win32.Lineage.aip skipped C:\!KillBox\Update.exe Infected: Trojan-Downloader.Win32.QQHelper.ap skipped C:\!KillBox\vpcrm.exe Infected: Trojan-Downloader.Win32.Small.czl skipped C:\!KillBox\winampb.exe Infected: Trojan.Win32.Agent.tl skipped C:\!KillBox\winscok.dll Infected: Trojan-PSW.Win32.Delf.nx skipped C:\!KillBox\xydll.dll Infected: Trojan-PSW.Win32.Lineage.abd skipped C:\cmd.exe Infected: Worm.Win32.Viking.ao skipped C:\Documents and Settings\All Users\Application Data\Sony Corporation\SonicStage\Packages\MtData.ldb Object is locked skipped C:\Documents and Settings\All Users\Application Data\Sony Corporation\SonicStage\Packages\MtData.mdb Object is locked skipped C:\Documents and Settings\All Users\Application Data\Sony Corporation\VAIO Entertainment Platform\1.0\VzCdb\VzCdb_Mgr.ldf Object is locked skipped C:\Documents and Settings\All Users\Application Data\Sony Corporation\VAIO Entertainment Platform\1.0\VzCdb\VzCdb_Mgr.mdf Object is locked skipped C:\Documents and Settings\Kevin Roy\Application Data\Azureus\ipfilter.cache Object is locked skipped C:\Documents and Settings\Kevin Roy\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Kevin Roy\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Kevin Roy\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Kevin Roy\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Kevin Roy\Local Settings\History\History.IE5\MSHist012006100720061008\index.dat Object is locked skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temp\1860826583721 Infected: Trojan-PSW.Win32.WOW.jv skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temp\2092629894185 Infected: Trojan-PSW.Win32.WOW.jv skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temp\2241732024483 Infected: Trojan-PSW.Win32.WOW.jv skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temp\2673438195346 Infected: Trojan-PSW.Win32.WOW.jv skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temp\2704538635409 Infected: Trojan-PSW.Win32.WOW.jv skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temp\33371.exe Infected: Trojan-PSW.Win32.QQPass.ni skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temp\5.exe Infected: Trojan-PSW.Win32.Agent.im skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temp\55.exe Infected: Trojan-PSW.Win32.WOW.hx skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temp\7.exe Infected: Trojan-PSW.Win32.WOW.da skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temp\78mzsz.dll Infected: Rootkit.Win32.Vanti.df skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temp\ck3.exe.exe Infected: Trojan-PSW.Win32.Delf.pj skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temp\d5s.dll Infected: Rootkit.Win32.Vanti.df skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temp\hsperfdata_Kevin Roy\236 Object is locked skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temp\JETB70B.tmp Object is locked skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temp\moi.com Infected: Trojan-PSW.Win32.QQPass.nj skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temp\oprar.exe Infected: Trojan-PSW.Win32.WOW.ec skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temp\RarSFX0\setup.exe Infected: Trojan.Win32.Agent.ut skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temp\RarSFX10\setup.exe Infected: Trojan.Win32.Agent.ut skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temp\tyDns.Exe Infected: Trojan.Win32.Qhost.he skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temp\uprar.exe Infected: Trojan-PSW.Win32.WOW.ec skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temp\__19.tmp Infected: Trojan-PSW.Win32.Lmir.bbb skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\4XINGXUZ\2[1].exe Infected: Trojan-PSW.Win32.Lineage.amd skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\4XINGXUZ\admin[1].exe Infected: Trojan-PSW.Win32.QQPass.nj skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\4XINGXUZ\tj[1].htm Infected: Trojan-Downloader.VBS.Psyme.cr skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\4XINGXUZ\x[1].exe Infected: Trojan-Downloader.Win32.Small.czl skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\2[1].exe Infected: Trojan-PSW.Win32.Lineage.amd skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\govip1[1].exe/data.rar/vipdown.exe/data.rar/server.exe Infected: Trojan-Downloader.Win32.Delf.atb skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\govip1[1].exe/data.rar/vipdown.exe/data.rar Infected: Trojan-Downloader.Win32.Delf.atb skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\govip1[1].exe/data.rar/vipdown.exe Infected: Trojan-Downloader.Win32.Delf.atb skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\govip1[1].exe/data.rar/1753.exe/data.rar/setup.exe Infected: Trojan.Win32.Agent.ut skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\govip1[1].exe/data.rar/1753.exe/data.rar Infected: Trojan.Win32.Agent.ut skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\govip1[1].exe/data.rar/1753.exe Infected: Trojan.Win32.Agent.ut skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\govip1[1].exe/data.rar/bind_40004.exe/data0001 Infected: Trojan-Downloader.NSIS.QQHelper.k skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\govip1[1].exe/data.rar/bind_40004.exe Infected: Trojan-Downloader.NSIS.QQHelper.k skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\govip1[1].exe/data.rar/198994004.exe Infected: Trojan-Downloader.Win32.Agent.ayn skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\govip1[1].exe/data.rar/4126ther.exe Infected: Trojan-Dropper.Win32.Agent.awb skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\govip1[1].exe/data.rar Infected: Trojan-Dropper.Win32.Agent.awb skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\govip1[1].exe RarSFX: infected - 11 skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\govip1[2].exe/data.rar/vipdown.exe/data.rar/server.exe Infected: Trojan-Downloader.Win32.Delf.atb skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\govip1[2].exe/data.rar/vipdown.exe/data.rar Infected: Trojan-Downloader.Win32.Delf.atb skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\govip1[2].exe/data.rar/vipdown.exe Infected: Trojan-Downloader.Win32.Delf.atb skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\govip1[2].exe/data.rar/1753.exe/data.rar/setup.exe Infected: Trojan.Win32.Agent.ut skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\govip1[2].exe/data.rar/1753.exe/data.rar Infected: Trojan.Win32.Agent.ut skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\govip1[2].exe/data.rar/1753.exe Infected: Trojan.Win32.Agent.ut skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\govip1[2].exe/data.rar/bind_40004.exe/data0001 Infected: Trojan-Downloader.NSIS.QQHelper.k skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\govip1[2].exe/data.rar/bind_40004.exe Infected: Trojan-Downloader.NSIS.QQHelper.k skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\govip1[2].exe/data.rar/198994004.exe Infected: Trojan-Downloader.Win32.Agent.ayn skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\govip1[2].exe/data.rar/4126ther.exe Infected: Trojan-Dropper.Win32.Agent.awb skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\govip1[2].exe/data.rar Infected: Trojan-Dropper.Win32.Agent.awb skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\govip1[2].exe RarSFX: infected - 11 skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\OXQZKXIZ\x[1].exe Infected: Trojan-Downloader.Win32.Small.czl skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\WP270P6B\1[1].exe Infected: Trojan-PSW.Win32.QQPass.ni skipped C:\Documents and Settings\Kevin Roy\Local Settings\Temporary Internet Files\Content.IE5\WP270P6B\bang[1].js Infected: Trojan-Downloader.JS.IstBar.ai skipped C:\Documents and Settings\Kevin Roy\ntuser.dat Object is locked skipped C:\Documents and Settings\Kevin Roy\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\DONGDONG\DONGDONG.DLL Infected: Trojan-PSW.Win32.WOW.id skipped C:\Drivers\Audio\Setup.exe Infected: Worm.Win32.Viking.ao skipped C:\Drivers\ChipSet\Setup.exe Infected: Worm.Win32.Viking.ao skipped C:\Drivers\USBMouse\Setup.exe Infected: Worm.Win32.Viking.ao skipped C:\Program Files\Agnitum\Outpost Firewall\install.exe Infected: Worm.Win32.Viking.ao skipped C:\Program Files\Agnitum\Outpost Firewall\op_data.ldb Object is locked skipped C:\Program Files\Agnitum\Outpost Firewall\op_data.mdb Object is locked skipped C:\Program Files\Common Files\iexplore.pif Infected: Trojan-PSW.Win32.Lmir.bbb skipped C:\Program Files\Common Files\inexplore.pif Infected: Trojan-PSW.Win32.WOW.gy skipped C:\Program Files\Common Files\INTEXPLORE.pif Infected: Trojan-PSW.Win32.WOW.cu skipped C:\Program Files\Common Files\Microsoft Shared\MSInfo\NewInfo.rxk Infected: Trojan-PSW.Win32.Delf.qc skipped C:\Program Files\Common Files\Microsoft Shared\MSInfo\WinInfo.bak Infected: Trojan-PSW.Win32.Lineage.akh skipped C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\dqygbjuv.dll Infected: Backdoor.Win32.Agobot.fb skipped C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\ojmwcnkn.dll Infected: Backdoor.Win32.Agobot.fb skipped C:\Program Files\Common Files\UPDATE2\Update.exe.1 Infected: Trojan-Downloader.Win32.QQHelper.ap skipped C:\Program Files\coolsign\coolsign.dll Infected: Trojan-Downloader.Win32.QQHelper.ap skipped C:\Program Files\coolsign\coolsign.dll.bak Infected: Trojan-Downloader.Win32.QQHelper.ap skipped C:\Program Files\DAEMON Tools\plrnndgh.dll Infected: Backdoor.Win32.Agobot.fb skipped C:\Program Files\Internet Explorer\0Sy.exe Infected: Trojan-PSW.Win32.Lineage.ach skipped C:\Program Files\Internet Explorer\3Sy.exe Infected: Trojan-PSW.Win32.Delf.nx skipped C:\Program Files\Internet Explorer\iexplore.com Infected: Trojan-PSW.Win32.Lmir.bbb skipped C:\Program Files\Internet Explorer\IEXPLORE.jmp Infected: Trojan-PSW.Win32.Delf.pj skipped C:\Program Files\Internet Explorer\inexplore.com Infected: Trojan-PSW.Win32.WOW.gy skipped C:\Program Files\Internet Explorer\INTEXPLORE.com Infected: Trojan-PSW.Win32.WOW.cu skipped C:\Program Files\Internet Explorer\PLUGINS\system.jmp Infected: Trojan-PSW.Win32.QQPass.nj skipped C:\Program Files\Internet Explorer\PLUGINS\system.sys Infected: Trojan-PSW.Win32.QQPass.ls skipped C:\Program Files\Internet Explorer\PLUGINS\Windows.jmp Infected: Trojan-PSW.Win32.QQPass.ni skipped C:\Program Files\Internet Explorer\PLUGINS\Windows.sys Infected: Trojan-PSW.Win32.QQPass.ni skipped C:\Program Files\iTunes\ayielncj.dll Infected: Backdoor.Win32.Agobot.fb skipped C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE Infected: Worm.Win32.Viking.ao skipped C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Infected: Worm.Win32.Viking.ao skipped C:\Program Files\Microsoft SQL Server\80\Tools\Binn\scynkcks.dll Infected: Backdoor.Win32.Agobot.fb skipped C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Data\master.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Data\mastlog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Data\model.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Data\modellog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Data\tempdb.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Data\templog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\LOG\ERRORLOG Object is locked skipped C:\Program Files\Microsoft Works\Setup\SETUP.EXE Infected: Worm.Win32.Viking.ao skipped C:\Program Files\PeerGuardian2\history.db Object is locked skipped C:\Program Files\PeerGuardian2\usskjyiq.dll Infected: Backdoor.Win32.Agobot.fb skipped C:\Program Files\Real\RealPlayer\Setup\setup.exe Infected: Worm.Win32.Viking.ao skipped C:\Program Files\Sony\VAIO Event Service\bgtcxacl.dll Infected: Backdoor.Win32.Agobot.fb skipped C:\Program Files\Sony\VAIO Event Service\mwnqxaql.dll Infected: Backdoor.Win32.Agobot.fb skipped C:\Program Files\Sony\VAIO Event Service\nzjptsdw.dll Infected: Backdoor.Win32.Agobot.fb skipped C:\Program Files\Sony\VAIO Launcher\Launcher.exe Infected: Worm.Win32.Viking.ao skipped C:\Program Files\WinRAR\internat2.exe Infected: Trojan-PSW.Win32.Agent.ia skipped C:\Program Files\WinRAR\internat5.exe Infected: Trojan-Clicker.Win32.Delf.gy skipped C:\Program Files\WinRAR\msn.dll Infected: Trojan-Downloader.Win32.Delf.avy skipped C:\RECYCLER\S-1-5-21-142974145-3799977956-3259918395-500\Dc3.exe Infected: Trojan-Downloader.Win32.VB.akv skipped C:\RECYCLER\S-1-5-21-142974145-3799977956-3259918395-500\Dc5.dll Infected: Trojan-PSW.Win32.QQPass.na skipped C:\RECYCLER\S-1-5-21-142974145-3799977956-3259918395-500\Dc6.exe Infected: Trojan-Downloader.Win32.Agent.aqr skipped C:\RECYCLER\S-1-5-21-142974145-3799977956-3259918395-500\Dc7.EXE Infected: Backdoor.Win32.Hupigon.gz skipped C:\RECYCLER\S-1-5-21-142974145-3799977956-3259918395-500\Dc8.exe Infected: Trojan-Spy.Win32.Delf.st skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\VAIO Entertainment\database\VzCdbDat.ldf Object is locked skipped C:\VAIO Entertainment\database\VzCdbDat.mdf Object is locked skipped C:\WINDOWS\0Sy.exe Infected: Trojan-PSW.Win32.QQPass.ni skipped C:\WINDOWS\1.com Infected: Trojan-PSW.Win32.Lmir.bbb skipped C:\WINDOWS\Debug\DebugProgram.exe Infected: Trojan-PSW.Win32.Lmir.bbb skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\Dll.dll Infected: Worm.Win32.Viking.ao skipped C:\WINDOWS\exeroute.exe Infected: Trojan-PSW.Win32.Lmir.bbb skipped C:\WINDOWS\explorer.com Infected: Trojan-PSW.Win32.Lmir.bbb skipped C:\WINDOWS\finder.com Infected: Trojan-PSW.Win32.Lmir.bbb skipped C:\WINDOWS\Fonts\svch0st.exe Infected: Trojan-Clicker.Win32.Delf.gy skipped C:\WINDOWS\Logo1_.exe Infected: Worm.Win32.Viking.ao skipped C:\WINDOWS\LSASS.exe Infected: Trojan-PSW.Win32.WOW.cu skipped C:\WINDOWS\rundl132.exe Infected: Worm.Win32.Viking.ao skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\svchost32.exe Infected: Trojan-Clicker.Win32.Delf.gy skipped C:\WINDOWS\system32\0.exe/data.rar/vipdown.exe/data.rar/server.exe Infected: Trojan-Downloader.Win32.Delf.atb skipped C:\WINDOWS\system32\0.exe/data.rar/vipdown.exe/data.rar Infected: Trojan-Downloader.Win32.Delf.atb skipped C:\WINDOWS\system32\0.exe/data.rar/vipdown.exe Infected: Trojan-Downloader.Win32.Delf.atb skipped C:\WINDOWS\system32\0.exe/data.rar/1753.exe/data.rar/setup.exe Infected: Trojan.Win32.Agent.ut skipped C:\WINDOWS\system32\0.exe/data.rar/1753.exe/data.rar Infected: Trojan.Win32.Agent.ut skipped C:\WINDOWS\system32\0.exe/data.rar/1753.exe Infected: Trojan.Win32.Agent.ut skipped C:\WINDOWS\system32\0.exe/data.rar/bind_40004.exe/data0001 Infected: Trojan-Downloader.NSIS.QQHelper.k skipped C:\WINDOWS\system32\0.exe/data.rar/bind_40004.exe Infected: Trojan-Downloader.NSIS.QQHelper.k skipped C:\WINDOWS\system32\0.exe/data.rar/198994004.exe Infected: Trojan-Downloader.Win32.Agent.ayn skipped C:\WINDOWS\system32\0.exe/data.rar/4126ther.exe Infected: Trojan-Dropper.Win32.Agent.awb skipped C:\WINDOWS\system32\0.exe/data.rar Infected: Trojan-Dropper.Win32.Agent.awb skipped C:\WINDOWS\system32\0.exe RarSFX: infected - 11 skipped C:\WINDOWS\system32\11.exe Infected: Worm.Win32.Viking.aj skipped C:\WINDOWS\system32\A4\baisob\avpb.exe Infected: Trojan-Dropper.Win32.Agent.awb skipped C:\WINDOWS\system32\A4\baisob\realupdate.exe Infected: Trojan.Win32.Agent.tl skipped C:\WINDOWS\system32\A4SOFT\baisoc\avpc.exe Infected: Trojan-Dropper.Win32.Agent.awb skipped C:\WINDOWS\system32\asrp1.exe Infected: Trojan-Downloader.Win32.Delf.ays skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\command.pif Infected: Trojan-PSW.Win32.Lmir.bbb skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\cs.exe Infected: Trojan-PSW.Win32.WOW.da skipped C:\WINDOWS\system32\drivers\dtscsi.sys Object is locked skipped C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped C:\WINDOWS\system32\drivers\fidbox2.dat Object is locked skipped C:\WINDOWS\system32\drivers\fidbox2.idx Object is locked skipped C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped C:\WINDOWS\system32\drivers\sptd1405.sys Object is locked skipped C:\WINDOWS\system32\dxdiag.com Infected: Trojan-PSW.Win32.Lmir.bbb skipped C:\WINDOWS\system32\finder.com Infected: Trojan-PSW.Win32.Lmir.bbb skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\hx.exe Infected: Trojan-PSW.Win32.WOW.kd skipped C:\WINDOWS\system32\ineptpui.dll Infected: Trojan-Downloader.Win32.Small.drm skipped C:\WINDOWS\system32\intenet.exe Infected: Trojan-PSW.Win32.Agent.ia skipped C:\WINDOWS\system32\internst.exe Infected: Trojan-PSW.Win32.WOW.iz skipped C:\WINDOWS\system32\masprpva.drv Infected: Trojan-Downloader.Win32.Delf.ays skipped C:\WINDOWS\system32\MSCONFIG.COM Infected: Trojan-PSW.Win32.Lmir.bbb skipped C:\WINDOWS\system32\mssapi.dll Infected: Trojan-Downloader.Win32.QQHelper.lb skipped C:\WINDOWS\system32\myrx.dll Infected: Trojan-PSW.Win32.Agent.ia skipped C:\WINDOWS\system32\netcfgw.exe Infected: Trojan-PSW.Win32.QQPass.na skipped C:\WINDOWS\system32\Ravdm.exe Infected: Trojan-PSW.Win32.Lmir.bbv skipped C:\WINDOWS\system32\start.exe Infected: Trojan-Spy.Win32.Delf.st skipped C:\WINDOWS\system32\tdll.dll Infected: Trojan-PSW.Win32.Lineage.amg skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\system32\wbem\smtpconfs.dll Infected: Trojan-Downloader.Win32.QQHelper.ap skipped C:\WINDOWS\system32\wbem\smtpconfs.dll.1 Infected: Trojan-Downloader.Win32.QQHelper.ap skipped C:\WINDOWS\Temp\JETEA40.tmp Object is locked skipped C:\WINDOWS\Temp\Perflib_Perfdata_79c.dat Object is locked skipped C:\WINDOWS\Temp\~DFF755.tmp Object is locked skipped C:\WINDOWS\v20060910.rar Infected: Trojan-Downloader.Win32.Agent.aqr skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\win1\1753.exe/data.rar/setup.exe Infected: Trojan.Win32.Agent.ut skipped C:\WINDOWS\win1\1753.exe/data.rar Infected: Trojan.Win32.Agent.ut skipped C:\WINDOWS\win1\1753.exe RarSFX: infected - 2 skipped C:\WINDOWS\win1\4126ther.exe Infected: Trojan-Dropper.Win32.Agent.awb skipped C:\WINDOWS\win1\bind_40004.exe/data0001 Infected: Trojan-Downloader.NSIS.QQHelper.k skipped C:\WINDOWS\win1\bind_40004.exe NSIS: infected - 1 skipped C:\WINDOWS\win1\vipdown.exe/data.rar/server.exe Infected: Trojan-Downloader.Win32.Delf.atb skipped C:\WINDOWS\win1\vipdown.exe/data.rar Infected: Trojan-Downloader.Win32.Delf.atb skipped C:\WINDOWS\win1\vipdown.exe RarSFX: infected - 2 skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped C:\WINDOWS\~tmp2020.exe Infected: Worm.Win32.Detnat.e skipped C:\WINDOWS\~tmp4831.exe Infected: Worm.Win32.Detnat.e skipped C:\WINDOWS\~tmp5812.exe Infected: Worm.Win32.Detnat.e skipped C:\WINDOWS\~tmp725.exe Infected: Worm.Win32.Detnat.e skipped C:\WINDOWS\~tmp840.exe Infected: Worm.Win32.Detnat.e skipped D:\command.com Infected: Trojan-PSW.Win32.Lmir.bao skipped D:\pagefile.pif Infected: Trojan-PSW.Win32.Lmir.bbb skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped D:\VAIO Entertainment\database\VzCdbDat.ldf Object is locked skipped D:\VAIO Entertainment\database\VzCdbDat.mdf Object is locked skipped Scan process completed.

Hi, No infections were found with the malicious software removal tool.Also when I run the Housecall program and follow the instructions it closes itself down after about halfway. Here is the rest of the logs you asked for Thanks. Found Sandbox: W32/P2PWorm; [ General information ] * Decompressing UPX. * **Locates window "RavMon.exe [class RavMonClass]" on desktop. * Accesses executable file from resource section. * File length: 155648 bytes. [ Changes to filesystem ] * Creates file C:\WINDOWS\rundl132.exe. * Deletes file c:\sample.exe.exe. * Creates file C:\sample.exe.exe. * Creates file C:\WINDOWS\Logo1_.exe. * Deletes file C:\WINDOWS\TEMP\$$ab9191.bat. * Creates file C:\WINDOWS\TEMP\$$ab9191.bat. * Creates file C:\WINDOWS\Dll.dll. * Creates file C:\_desktop.ini. * Creates file C:\TEMP\_desktop.ini. * Creates file C:\MIRC\_desktop.ini. [ Changes to registry ] * Creates key "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows". * Sets value "load"="C:\WINDOWS\rundl132.exe" in key "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows". [ Network services ] * Sends a ping request (ICMP.DLL) to 192.168.0.1. * Sends a ping request (ICMP.DLL) to 192.168.0.2. * Sends a ping request (ICMP.DLL) to 192.168.0.3. * Sends a ping request (ICMP.DLL) to 192.168.0.4. * Sends a ping request (ICMP.DLL) to 192.168.0.5. * Sends a ping request (ICMP.DLL) to 192.168.0.6. * Sends a ping request (ICMP.DLL) to 192.168.0.7. * Sends a ping request (ICMP.DLL) to 192.168.0.8. * Sends a ping request (ICMP.DLL) to 192.168.0.9. * Sends a ping request (ICMP.DLL) to 192.168.0.10. * Sends a ping request (ICMP.DLL) to 192.168.0.11. * Sends a ping request (ICMP.DLL) to 192.168.0.12. * Sends a ping request (ICMP.DLL) to 192.168.0.13. * Sends a ping request (ICMP.DLL) to 192.168.0.14. * Sends a ping request (ICMP.DLL) to 192.168.0.15. * Sends a ping request (ICMP.DLL) to 192.168.0.16. * Sends a ping request (ICMP.DLL) to 192.168.0.17. * Sends a ping request (ICMP.DLL) to 192.168.0.18.