Spyware / Malware / Virus Removal

Hijack Log - Please Analyze

36 min read

Looking for the outcome? Ask AI

vtaylor100 Topic Starter

Post #1April 20, 2007, 7:28 PM UTC

My computer churns away when it first starts for quite a long time. I have 1 GB memory and a defragmented hard disk with lots of free memory. I can't figure out what process is causing this. I do have google desktop, but halting its indexing does not stop the hard disk churning.

Here is the log file:
Logfile of HijackThis v1.99.1
Scan saved at 11:28:32 AM, on 4/20/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\HP\KBD\KBD.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Network Magic\nmapp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Thumbs7\Thumbs.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us6.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us6.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://online.wsj.com/home/us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us6.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.searchv.com/w/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\PCHEALTH\HELPCTR\System\panels\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\PCHEALTH\HELPCTR\System\panels\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [SBAutoUpdate] "C:\Program Files\SpywareBlaster\sbautoupdate.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Network Magic\nmapp.exe" -autorun -nosplash
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Google\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Google\Hello\PicasaCapture.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://groups.msn.com
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {928626A3-6B98-11CF-90B4-00AA00A4011F} (SurroundVideoCtrl Object) - http://www.homesteadhotels.com/minisite/ac…nd/MSSurVid.cab
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_02) -
O18 - Protocol: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\puresp3.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: BounceStudio SMTP Service (bPOPSmt) - Unknown owner - C:\Program Files\BoogieTools\BoogiePop\bPOPSmtp.exe
O23 - Service: BounceStudio Bounce Service (bPOPSrv) - Unknown owner - C:\Program Files\BoogieTools\BoogiePop\bPOPServ.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Pure Networks Net2Go Service (nmraapache) - Unknown owner - C:\Program Files\Network Magic\WebServer\bin\nmraapache.exe" -k runservice (file missing)
O23 - Service: Pure Networks Network Magic Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Network Magic\nmsrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Appreciate any and all help.

Thanks,

Vince

Susan528

Post #2April 26, 2007, 12:59 PM UTC

Hello Vince and Welcome to TomCoyote,

Sorry that you have not had a response sooner. Please do the following:

STEP 1.
======
Close all programs leaving only HijackThis running. Place a check against each of the following, making sure you get them all and not any others by mistake:
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.searchv.com/w/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\PCHEALTH\HELPCTR\System\panels\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\PCHEALTH\HELPCTR\System\panels\blank.htm
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
Click on Fix Checked when finished and exit HijackThis.

STEP 2.
======
PCPitStop

Please register (it's free, don't worry) with PCPitStop and run the full tests here.
When the tests are complete, a results page will pop up. Click "Share these results with TechExpress" on the left-hand side. Then copy the URL provided and post (reply) with it here for me.

STEP 3.
======
Deckard’s System Scanner
Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.

Close all applications and windows.
Double-click on dss.exe to run it, and follow the prompts.
When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<-this one will be minimized
Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and the extra.txt to your post. in your reply

So please post the url from PCPitstop and the logs from the Deckard's System Scanner.

vtaylor100

Post #3April 28, 2007, 12:45 AM UTC

Dear Susan,

Here is the PCPitStop URL: http://www.pcpitstop.com/techexpress.asp?id=0FYHHWU8H9WS8F3W

I did do a few things to try to speed up the C: drive and then re-ran the pitstop tests, but the results were about the same.

The great initial churning of my computer seems to have ceased. I assume you identified the programs causing this. I had noted Windows Explorer asking to access the internet and had denied it within Zone Alarm, which I now believe was a good thing to do – but it didn't stop the churning.

I will post the report from Deckard's scanner separately.

Thanks,

Vince

vtaylor100

Post #4April 28, 2007, 1:05 AM UTC

Dear Susan,

As requested Decard logs.

Much thanks for you help. With respect to programs that show up as running, startup, or scheduled:
BoogiePop is a legitimate utility, but I will turn it off and only turn it on when needed.
Network Magic is legitimate.
Symantec should not be there, as it has been uninstalled.
iTunes should be run automatically.
Uniblue Speed Up My PC was a comeon I fell into and thought I had uninstalled – apparently stuff is left.

I very much appreciate your help!!!

Vince

Main.txt:
Deckard's System Scanner v20070426.43
Run by [removed] on 2007-04-27 at 17:48:08
Computer is in Normal Mode.
——————————————————————————–

– System Restore ————————————————————–

Successfully created a Deckard's System Scanner Restore Point.

– Last 5 Restore Point(s) –
9: 2007-04-28 00:48:16 UTC - RP682 - Deckard's System Scanner Restore Point
8: 2007-04-25 18:00:51 UTC - RP681 - Printer Driver Amyuni Document Converter 2.50 Installed
7: 2007-04-25 17:38:09 UTC - RP680 - Installed Windows Installer Clean Up
6: 2007-04-25 17:36:39 UTC - RP679 - Removed Windows Installer Clean Up
5: 2007-04-25 17:35:58 UTC - RP678 - Installed Windows Installer Clean Up

– First Restore Point –
1: 2007-04-16 19:06:44 UTC - RP674 - Software Distribution Service 2.0

Backed up registry hives.

Performed disk cleanup.

– HijackThis (run as Owner.exe) ———————————————–

Logfile of HijackThis v1.99.1
Scan saved at 5:50:22 PM, on 4/27/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\BoogieTools\BoogiePop\bPOPSmtp.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\BoogieTools\BoogiePop\bPOPServ.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Network Magic\nmsrvc.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Network Magic\nmapp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Documents and Settings\Owner\Desktop\dss.exe
C:\DOCUME~1\Owner\Desktop\Owner.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us6.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us6.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://online.wsj.com/home/us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us6.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [SBAutoUpdate] "C:\Program Files\SpywareBlaster\sbautoupdate.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Network Magic\nmapp.exe" -autorun -nosplash
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [checktime] c:\program files\HPSelect\Frontend\ct.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Google\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Google\Hello\PicasaCapture.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://groups.msn.com
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {928626A3-6B98-11CF-90B4-00AA00A4011F} (SurroundVideoCtrl Object) - http://www.homesteadhotels.com/minisite/ac…nd/MSSurVid.cab
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_02) -
O18 - Protocol: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\puresp3.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: BounceStudio SMTP Service (bPOPSmt) - Unknown owner - C:\Program Files\BoogieTools\BoogiePop\bPOPSmtp.exe
O23 - Service: BounceStudio Bounce Service (bPOPSrv) - Unknown owner - C:\Program Files\BoogieTools\BoogiePop\bPOPServ.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Pure Networks Net2Go Service (nmraapache) - Unknown owner - C:\Program Files\Network Magic\WebServer\bin\nmraapache.exe" -k runservice (file missing)
O23 - Service: Pure Networks Network Magic Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Network Magic\nmsrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

– HijackThis Fixed Entries (C:\DOCUME~1\Owner\Desktop\backups\) —————

backup-20070427-170045-118 O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
backup-20070427-170045-185 R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.searchv.com/w/search.html
backup-20070427-170045-214 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\PCHEALTH\HELPCTR\System\panels\blank.htm
backup-20070427-170045-819 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
backup-20070427-170045-851 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\PCHEALTH\HELPCTR\System\panels\blank.htm

– File Associations ———————————————————–

All associations okay.

– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————

R1 BANTExt (Belarc SMBios Access) - c:\windows\system32\drivers\bantext.sys
R1 Cdr4_2K - c:\windows\system32\drivers\cdr4_2k.sys

Susan528

Post #5April 28, 2007, 1:45 PM UTC

This concerns me! You do not have any firewall protection!

Windows Internal Firewall is disabled.

FW: ZoneAlarm Firewall v7.0.337.000 (Check Point, LTD.) Disabled
================

Please perform an online scan with Internet Explorer at
http://www.kaspersky.com/service?chapter=161739400

Answer Yes, when prompted to install an ActiveX component.

The program will then begin downloading the latest definition files.
Once the files have been downloaded click on NEXT
Locate the Scan Settings button & configure to:
- Scan using the following Anti-Virus database:
  Extended
- Scan Options:
  Scan Archives
  Scan Mail Bases
Click OK & have it scan My Computer
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

**Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the license, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

Please post (reply) with the results from Kapersky. I want to check for more malware before addressing security problems.

vtaylor100

Post #6April 28, 2007, 9:58 PM UTC

Dear Susan, The lack of firewall was very temporary. PitStop directed to disable the firewall while I was running its test. It was restored after running the test. I will, however, run the scan as you requested. Vince

vtaylor100

Post #7April 29, 2007, 3:44 AM UTC last edited May 2, 2007, 10:04 PM UTC

Dear Susan, Here is the log file from Kapersky. WOW! Have all my other anti-virus programs really missed all of these? Thanks, Vince ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Saturday, April 28, 2007 8:32:34 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 29/04/2007 Kaspersky Anti-Virus database records: 307077 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ K:\ Scan Statistics: Total number of scanned objects: 171959 Number of viruses found: 10 Number of infected objects: 94 / 0 Number of suspicious objects: 6 Duration of the scan process: 03:57:44 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users\Application Data\Pure Networks\Network Magic\Log\logfile.nmapp_exe.txt Object is locked skipped C:\Documents and Settings\All Users\Application Data\Pure Networks\Network Magic\Log\logfile.nmsrvc_exe.txt Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2007-04-28_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped C:\Documents and Settings\All Users\Documents\ishareit.exe/data0008 Infected: not-a-virus:AdWare.Win32.Altnet.o skipped C:\Documents and Settings\All Users\Documents\ishareit.exe Inno: infected - 1 skipped C:\Documents and Settings\All Users\Documents\mail.mcn.org\Campaign for Jackson.sbd\Website/[From "][Date Sat, 15 Apr 2000 10:37:01 -0700]/html Infected: Email-Worm.VBS.KakWorm skipped C:\Documents and Settings\All Users\Documents\mail.mcn.org\Campaign for Jackson.sbd\Website Mail Berkeley mbox: infected - 1 skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\83baq1hn.default\cert8.db Object is locked skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\83baq1hn.default\formhistory.dat Object is locked skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\83baq1hn.default\history.dat Object is locked skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\83baq1hn.default\key3.db Object is locked skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\83baq1hn.default\parent.lock Object is locked skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Campaign for Jackson.sbd\Website/[From "][Date Sat, 15 Apr 2000 10:37:01 -0700]/html Infected: Email-Worm.VBS.KakWorm skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Campaign for Jackson.sbd\Website Mail Berkeley mbox: infected - 1 skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From "]/UNNAMED/[From "][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From " ]/UNNAMED/[From "]/UNNAMED/[From ][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From " … /[Fro … /[From … /[From "][Date Tue, 4 Jul 2006 16:57:26 -0060]/html Infected: Trojan-Spy.HTML.Bankfraud.pd skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From "]/UNNAMED/[From "][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From " ]/UNNAMED/[From "]/UNNAMED/[From ][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From " … /[Fro … /[From … /[ … /[From <[removed]>][Date 03 Jul 2006 19:50:28 -0400]/text Infected: Trojan-Spy.HTML.Bankfraud.pd skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From "]/UNNAMED/[From "][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From " ]/UNNAMED/[From "]/UNNAMED/[From ][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From " … /[Fro … /[From … /[From "Nichole Merritt" <[removed]>][Date Mon, 3 Jul 2006 00:43:03 -0060]/text Infected: Trojan-Spy.HTML.Bankfraud.pd skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From "]/UNNAMED/[From "][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From " ]/UNNAMED/[From "]/UNNAMED/[From ][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From " … /[Fro … /[From " >][Date Mon, 03 Jul 2006 10:02:42 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.pd skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From "]/UNNAMED/[From "][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From " ]/UNNAMED/[From "]/UNNAMED/[From ][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From " … /[Fro … /[From "][Date Sun, 02 Jul 2006 18:46:26 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.pd skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From "]/UNNAMED/[From "][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From " ]/UNNAMED/[From "]/UNNAMED/[From ][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From " … /[From " >][Date Mon, 03 Jul 2006 00:38:05 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.pd skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From "]/UNNAMED/[From "][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From " ]/UNNAMED/[From "]/UNNAMED/[From ][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From "ate … … /[From "Der … /[From "][Date Sun, 02 Jul 2006 13:33:34 +0000]/html Infected: Trojan-Spy.HTML.Bankfraud.pd skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From "]/UNNAMED/[From "][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From " ]/UNNAMED/[From "]/UNNAMED/[From ][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From "ate … … /[From ][Date Sun, 02 Jul 2006 20:49:30 +0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.pd skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From "]/UNNAMED/[From "][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From " ]/UNNAMED/[From "]/UNNAMED/[From ][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From "ate … /[From "][Date Sat, 1 Jul 2006 06:14:56 -0500]/html Infected: Trojan-Spy.HTML.Bankfraud.pd skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From "]/UNNAMED/[From "][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From " ]/UNNAMED/[From "]/UNNAMED/[From ][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From "ate … /[From =?iso-20 … /[From "Corie" <[removed]>][Date Sat, 01 Jul 2006 07:30:56 +0000]/html Infected: Trojan-Spy.HTML.Bankfraud.pd skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From "]/UNNAMED/[From "][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From " ]/UNNAMED/[From "]/UNNAMED/[From ][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From "ate … /[From =?iso-2022- … /[From Rhoda Teplow <[removed]>][Date Fri, 30 Jun 2006 21:48:42 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.pd skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From "]/UNNAMED/[From "][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From " ]/UNNAMED/[From "]/UNNAMED/[From ][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From "ate … /[From =?iso-2022-jp?B?bWl6dW5v?=<[removed]>][Date Thu, 29 Jun 2006 13:48:17 -0200]/text Infected: Trojan-Spy.HTML.Bankfraud.pd skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From "]/UNNAMED/[From "][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From " ]/UNNAMED/[From "]/UNNAMED/[From ][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From "][Date M … /[From Rixanne Wehren <[removed]>][Date Mon, 17 Jul 2006 10:46:44 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.pd skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From "]/UNNAMED/[From "][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From " ]/UNNAMED/[From "]/UNNAMED/[From ][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From "ateswhite.com>][Date Mon, 17 Jul 2006 20:40:50 -0200]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.pd skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From "]/UNNAMED/[From "][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From " ]/UNNAMED/[From "]/UNNAMED/[From ][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.pd skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From "]/UNNAMED/[From "][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From " ]/UNNAMED/[From "]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.pd skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From "]/UNNAMED/[From "][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From " ]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.pd skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From "]/UNNAMED/[From "][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.pd skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From "]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.pd skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash Mail Berkeley mbox: infected - 19 skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\vtaylor\lg9no7rc.slt\Mail\mail.mcn.org\Campaign for Jackson.sbd\Website/[From "][Date Sat, 15 Apr 2000 10:37:01 -0700]/html Infected: Email-Worm.VBS.KakWorm skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\vtaylor\lg9no7rc.slt\Mail\mail.mcn.org\Campaign for Jackson.sbd\Website Mail Berkeley mbox: infected - 1 skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\vtaylor\lg9no7rc.slt\Mail\[removed]\Campaign for Jackson.sbd\Website/[From "][Date Sat, 15 Apr 2000 10:37:01 -0700]/html Infected: Email-Worm.VBS.KakWorm skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\vtaylor\lg9no7rc.slt\Mail\[removed]\Campaign for Jackson.sbd\Website Mail Berkeley mbox: infected - 1 skipped C:\Documents and Settings\Owner\Application Data\Thunderbird\Profiles\9c12ywyh.default\Mail\mail.mcn.org\Campaign for Jackson.sbd\Website/[From "][Date Sat, 15 Apr 2000 10:37:01 -0700]/html Infected: Email-Worm.VBS.KakWorm skipped C:\Documents and Settings\Owner\Application Data\Thunderbird\Profiles\9c12ywyh.default\Mail\mail.mcn.org\Campaign for Jackson.sbd\Website Mail Berkeley mbox: infected - 1 skipped C:\Documents and Settings\Owner\Application Data\Thunderbird\Profiles\9c12ywyh.default\Mail\mail.mcn.org\Trash/[From "][Date Sat, 10 Mar 2007 15:02:50 -0500]/UNNAMED/[From "][Date Fri, 09 Mar 2007 07:24:20 -0800]/text/[From][Date Sun, 8 Apr 2007 16:59:50 -0400]/UNNAMED Infected: Email-Worm.Win32.Zhelatin.cq skipped C:\Documents and Settings\Owner\Application Data\Thunderbird\Profiles\9c12ywyh.default\Mail\mail.mcn.org\Trash/[From "][Date Sat, 10 Mar 2007 15:02:50 -0500]/UNNAMED/[From "][Date Fri, 09 Mar 2007 07:24:20 -0800]/text Infected: Email-Worm.Win32.Zhelatin.cq skipped C:\Documents and Settings\Owner\Application Data\Thunderbird\Profiles\9c12ywyh.default\Mail\mail.mcn.org\Trash/[From "][Date Sat, 10 Mar 2007 15:02:50 -0500]/UNNAMED Infected: Email-Worm.Win32.Zhelatin.cq skipped C:\Documents and Settings\Owner\Application Data\Thunderbird\Profiles\9c12ywyh.default\Mail\mail.mcn.org\Trash Mail Berkeley mbox: infected - 3 skipped C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Owner\Desktop\news_search.exe/stream/data0008 Infected: not-a-virus:AdWare.Win32.Comet.ay skipped C:\Documents and Settings\Owner\Desktop\news_search.exe/stream Infected: not-a-virus:AdWare.Win32.Comet.ay skipped C:\Documents and Settings\Owner\Desktop\news_search.exe NSIS: infected - 2 skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Google Desktop\b2f0ff693687\dbc2e.ht1 Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Google Desktop\b2f0ff693687\dbdam Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Google Desktop\b2f0ff693687\dbdao Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Google Desktop\b2f0ff693687\dbeam Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Google Desktop\b2f0ff693687\dbeao Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Google Desktop\b2f0ff693687\dbm Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Google Desktop\b2f0ff693687\dbu2d.ht1 Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Google Desktop\b2f0ff693687\dbvm.cf1 Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Google Desktop\b2f0ff693687\dbvmh.ht1 Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Google Desktop\b2f0ff693687\fii.cf1 Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Google Desktop\b2f0ff693687\fiih.ht1 Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Google Desktop\b2f0ff693687\hp Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Google Desktop\b2f0ff693687\hpt2i.ht1 Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Google Desktop\b2f0ff693687\rpm.cf1 Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Google Desktop\b2f0ff693687\rpm1m.cf1 Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Google Desktop\b2f0ff693687\rpm1mh.ht1 Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Google Desktop\b2f0ff693687\rpmh.ht1 Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\83baq1hn.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\83baq1hn.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\83baq1hn.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\83baq1hn.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012007042820070429\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temp\~DF6595.tmp Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped C:\hp\bin\KillWind.exe Infected: not-a-virus:RiskTool.Win32.PsKill.p skipped C:\Program Files\BoogieTools\BoogiePop\Message Archive\Campaign Bounce Box\Non Bounce\Non BounceMessages_20040831.txt/[From "E/The Environmental Magazine"<[removed]>][Date Tue, 15 Jun 2004 17:17:27 -0400]/UNNAMED/text/[From ][Date Thu, 26 Aug 2004 11:47:23 +0100]/text/[From Tiffany <[removed]>][Date Tue, 31 Aug 2004 03:47:58 -0700 (PDT)]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\Program Files\BoogieTools\BoogiePop\Message Archive\Campaign Bounce Box\Non Bounce\Non BounceMessages_20040831.txt/[From "E/The Environmental Magazine"<[removed]>][Date Tue, 15 Jun 2004 17:17:27 -0400]/UNNAMED/text/[From][Date Thu, 26 Aug 2004 11:47:23 +0100]/text/[From >][Date Tue, 31 Aug 2004 03:47:58 -0700 (PDT)]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\Program Files\BoogieTools\BoogiePop\Message Archive\Campaign Bounce Box\Non Bounce\Non BounceMessages_20040831.txt/[From "E/The Environmental Magazine"<[removed]>][Date Tue, 15 Jun 2004 17:17:27 -0400]/UNNAMED/text/[From ][Date Thu, 26 Aug 2004 11:47:23 +0100]/text Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\Program Files\BoogieTools\BoogiePop\Message Archive\Campaign Bounce Box\Non Bounce\Non BounceMessages_20040831.txt/[From "E/The Environmental Magazine"<[removed]>][Date Tue, 15 Jun 2004 17:17:27 -0400]/UNNAMED/text Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\Program Files\BoogieTools\BoogiePop\Message Archive\Campaign Bounce Box\Non Bounce\Non BounceMessages_20040831.txt/[From "E/The Environmental Magazine"<[removed]>][Date Tue, 15 Jun 2004 17:17:27 -0400]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\Program Files\BoogieTools\BoogiePop\Message Archive\Campaign Bounce Box\Non Bounce\Non BounceMessages_20040831.txt Mail: suspicious - 5 skipped C:\Program Files\BoogieTools\BoogiePop\POP3TEMP.TXT Object is locked skipped C:\Program Files\BoogieTools\BoogiePop\POPLog.txt Object is locked skipped C:\Program Files\BoogieTools\BoogiePop\SMTPLog.txt Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP682\change.log Object is locked skipped C:\WINDOWS\$NtUninstallQ811493$\ntkrnlmp.exe Object is locked skipped C:\WINDOWS\$NtUninstallQ811493$\ntkrpamp.exe Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped C:\WINDOWS\Internet Logs\VINCE.ldb Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\Perflib_Perfdata_1d8.dat Object is locked skipped C:\WINDOWS\Temp\ZLT02522.TMP Object is locked skipped C:\WINDOWS\Temp\ZLT02525.TMP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Campaign for Jackson.sbd\Website/[From "][Date Sat, 15 Apr 2000 10:37:01 -0700]/html Infected: Email-Worm.VBS.KakWorm skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Campaign for Jackson.sbd\Website Mail Berkeley mbox: infected - 1 skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date … /[From Submitted using SMTP AUTH at out004.verizon. … /[Fr … /[From ][Date Mon, 26 Jul 2004 04:20:41 +050 … /html Infected: Trojan-Spy.HTML.Usbankfraud.p skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date … /[From Submitted using SMTP AUTH at out004.verizon. … /[Fr … /[From ][Date Mon, 26 Jul 2004 04:20:41 +0500]/UNNAMED Infected: Trojan-Spy.HTML.Usbankfraud.p skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date … /[From Submitted using SMTP AUTH at out004.verizo … /[ … … /[From Grant Pro <[removed]>][Date Sat, 11 Sep 2004 19:59:37 -0800]/html Infected: Trojan-Spy.HTML.Citifraud.ai skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date … /[From Submitted using SMTP AUTH at out004.verizo … /[ … /[From "][Date Sun, 12 Sep 2004 00:08:53 +0200]/text Infected: Trojan-Spy.HTML.Citifraud.ai skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date … /[From Submitted using SMTP AUTH at out004.verizo … /[From "Brandie" <[removed]>][Date Sat, 11 Sep 2004 10:29:31 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date … /[From Submitted using SMTP AUTH at out004.verizon. … /[F . … /[ … /[From "][Date Sat, 11 Sep 2004 09:35:46 -0500]/text Infected: Trojan-Spy.HTML.Citifraud.ai skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date … /[From Submitted using SMTP AUTH at out004.verizon. … /[F . … /[From][Date Fri, 10 Sep 2004 23:17:53 -0700]/text Infected: Trojan-Spy.HTML.Citifraud.ai skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date … /[From Submitted using SMTP AUTH at out004.verizon. … /[F … /[From ][Date Tue, 07 Sep 2004 10:36:29 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date … /[From Submitted using SMTP AUTH at out004.verizon. … /[F … /[Fr … /[From][Date Tue, 07 Sep 2004 11:00:43 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date … /[From Submitted using SMTP AUTH at out004.verizon. … /[F … /[From ][Date Tue, 07 Sep 2004 10:21:56 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date … /[From Submitted using SMTP AUTH at out004.verizon. … /[F … /[From "Domain Name News" <[removed]>][Date Sat, 4 Sep 2004 02:46:03 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date … /[From Submitted using SMTP AUTH at out004.verizon. … /[Fr … /[Fro … /[From ][Date Fri, 06 Aug 2004 12:44:27 -0700]/html Infected: Trojan-Spy.HTML.Citifraud.ai skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date … /[From Submitted using SMTP AUTH at out004.verizon. … /[Fr … /[From "][Date Fri, 6 Aug 2004 13:59:50 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date … /[From Submitted using SMTP AUTH at out004.verizon. … /[Fr … /[From " >][Date Sun, 04 Jul 2004 03:29:06 +0300]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date … /[From Submitted using SMTP AUTH at out004.verizon. … /[From " >][Date Wed, 12 May 2004 16:41:46 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date … /[From Submitted using SMTP AUTH at out004.verizon.net from [138.88.172. … /[From][Date Wed, 12 May 2004 10:49:36 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date … /[From Submitted using SMTP AUTH at out004.verizon.net from [138.88.172.21 … /[From ][Date Tue, 11 May 2004 14:56:16 -0700]/text Infected: Trojan-Spy.HTML.Citifraud.ai skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date … /[From Submitted using SMTP AUTH at out004.verizon.net from [138.88.172.21 … /[From][Date Mon, 10 May 2004 11:32:40 -0800]/text Infected: Trojan-Spy.HTML.Citifraud.ai skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date … /[From Submitted using SMTP AUTH at out004.verizon.net from [138.88.172.211] at Sat, 8 May 2004 08:38:40 -0500][Date Sat, 8 May 2004 09:38:41 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From "Michelle … / … … /[ … /[From " >][Date Fri, 7 May 2004 10:31:11 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From "Michelle … / … … /[From De … /[From ][Date Thu, 06 May 2004 21:51:45 -0800]/text Infected: Trojan-Spy.HTML.Citifraud.ai skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From "Michelle … / … … /[From ][Date Thu, 06 May 2004 08:54:06 -0700]/text Infected: Trojan-Spy.HTML.Citifraud.ai skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From "Michelle … / … /[From -3.00, HTML_50_60 0.18, HTML_FONT_BIG 0.10,][Date Wed, 5 May 2004 15:30:57 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From "Michelle … /[From ][Date Tue, 4 May 2004 21:06:28 UT]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From "Michelle Pa … /[From "Ni … /[From][Date Tue, 04 May 2004 11:41:59 -0700]/text Infected: Trojan-Spy.HTML.Citifraud.ai skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From "Michelle Pa … /[From "][Date Fri, 30 Apr 2004 13:12:08 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From "Michelle Palmer" ][Date Thu, 01 Apr 2004 15:14:08 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[From ][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From "Michelle Palmer"

Susan528

Post #8May 1, 2007, 2:35 AM UTC last edited May 2, 2007, 9:36 PM UTC

Hi vtaylor100,

It appears that you have a few infected files but a lot of old emails that are infected and still present. It looks like a lot but those emails take up many lines in this log. You can look at the Dates and the From and try to locate the emails to delete.

Use Windows Explorer and navigate to these files and delete them.
K:\Documents and Settings\Owner\Desktop\ishareit.exe<=file
K:\X-old computer files\Old Desktop\C - old\Thinkpad copy\mIRC\mirc32.exe<=file
C:\Documents and Settings\All Users\Documents\ishareit.exe<=file
C:\Documents and Settings\Owner\Desktop\news_search.exe<=file

Now can you delete the old infected emails.
C:\Documents and Settings\All Users\Documents\mail.mcn.org\Campaign for Jackson.sbd\Website/[From][Date Sat, 15 Apr 2000 10:37:01 -0700]/html Infected: Email-Worm.VBS.KakWorm skipped
C:\Documents and Settings\All Users\Documents\mail.mcn.org\Campaign for Jackson.sbd\Website Mail Berkeley mbox: Infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Campaign for Jackson.sbd\Website/[From][Date Sat, 15 Apr 2000 10:37:01 -0700]/html Infected: Email-Worm.VBS.KakWorm skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Campaign for Jackson.sbd\Website Mail Berkeley mbox: Infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From]/UNNAMED/[From][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From ]/UNNAMED/[From]/UNNAMED/[From][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From /[Fro … /[From … /[From][Date Tue, 4 Jul 2006 16:57:26 -0060]/html Infected: Trojan-Spy.HTML.Bankfraud.pd skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From]/UNNAMED/[From ">][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From]/UNNAMED/[From]/UNNAMED/[From ][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From [Fro … /[From … /[ … /[From][Date 03 Jul 2006 19:50:28 -0400]/text Infected: Trojan-Spy.HTML.Bankfraud.pd skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From]/UNNAMED/[From][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From]/UNNAMED/[From "]/UNNAMED/[From][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From "/[Fro … /[From … /[From][Date Mon, 3 Jul 2006 00:43:03 -0060]/text Infected: Trojan-Spy.HTML.Bankfraud.pd skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From]/UNNAMED/[From ">][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From]/UNNAMED/[From "]/UNNAMED/[From][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From " /[Fro … /[From][Date Mon, 03 Jul 2006 10:02:42 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.pd skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From]/UNNAMED/[From][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From ]/UNNAMED/[From]/UNNAMED/[From ][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From /[Fro … /[From][Date Sun, 02 Jul 2006 18:46:26 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.pd skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From]/UNNAMED/[From ">][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From ]/UNNAMED/[From]/UNNAMED/[From][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From /[From][Date Mon, 03 Jul 2006 00:38:05 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.pd skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From]/UNNAMED/[From ">][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From]/UNNAMED/[From "]/UNNAMED/[From][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From /[From "Der … /[From "][Date Sun, 02 Jul 2006 13:33:34 +0000]/html Infected: Trojan-Spy.HTML.Bankfraud.pd skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From]/UNNAMED/[From ">][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From]/UNNAMED/[From "]/UNNAMED/[From][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From " /[From "][Date Sun, 02 Jul 2006 20:49:30 +0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.pd skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From]/UNNAMED/[From ">][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From ]/UNNAMED/[From "]/UNNAMED/[From ][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From "… /[From "We got dirt on you!" <[removed]>][Date Sat, 1 Jul 2006 06:14:56 -0500]/html Infected: Trojan-Spy.HTML.Bankfraud.pd skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From ">]/UNNAMED/[From ">][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From ]/UNNAMED/[From "]/UNNAMED/[From ][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From "… /[From =?iso-20 … /[From "][Date Sat, 01 Jul 2006 07:30:56 +0000]/html Infected: Trojan-Spy.HTML.Bankfraud.pd skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From ">]/UNNAMED/[From ">][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From ]/UNNAMED/[From "]/UNNAMED/[From ][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From " /[From =?iso-2022- … /[From ][Date Fri, 30 Jun 2006 21:48:42 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.pd skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From ">]/UNNAMED/[From ">][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From ]/UNNAMED/[From "]/UNNAMED/[From ][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From "… /[From =?iso-2022-jp?B?bWl6dW5v?=<[removed]>][Date Thu, 29 Jun 2006 13:48:17 -0200]/text Infected: Trojan-Spy.HTML.Bankfraud.pd skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From ">]/UNNAMED/[From ">][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From ]/UNNAMED/[From "]/UNNAMED/[From ][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From "][Date M … /[From Date Mon, 17 Jul 2006 10:46:44 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.pd skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From ">]/UNNAMED/[From ">][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From ]/UNNAMED/[From "]/UNNAMED/[From ][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED/[From "][Date Mon, 17 Jul 2006 20:40:50 -0200]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.pd skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From ">]/UNNAMED/[From ">][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From ]/UNNAMED/[From "]/UNNAMED/[From ][Date Tue, 18 Jul 2006 01:34:32 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.pd skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From ">]/UNNAMED/[From ">][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From ]/UNNAMED/[From "]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.pd skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From ">]/UNNAMED/[From ">][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED/[From ]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.pd skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From ">]/UNNAMED/[From ">][Date Mon, 17 Jul 2006 20:28:59 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.pd skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash/[From ">]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.pd skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Trash Mail Berkeley mbox: Infected - 19 skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\vtaylor\lg9no7rc.slt\Mail\mail.mcn.org\Campaign for Jackson.sbd\Website/[From "][Date Sat, 15 Apr 2000 10:37:01 -0700]/html Infected: Email-Worm.VBS.KakWorm skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\vtaylor\lg9no7rc.slt\Mail\mail.mcn.org\Campaign for Jackson.sbd\Website Mail Berkeley mbox: Infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\vtaylor\lg9no7rc.slt\Mail\[removed]\Campaign for Jackson.sbd\Website/[From "][Date Sat, 15 Apr 2000 10:37:01 -0700]/html Infected: Email-Worm.VBS.KakWorm skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\vtaylor\lg9no7rc.slt\Mail\[removed]\Campaign for Jackson.sbd\Website Mail Berkeley mbox: Infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\Thunderbird\Profiles\9c12ywyh.default\Mail\mail.mcn.org\Campaign for Jackson.sbd\Website/[From "][Date Sat, 15 Apr 2000 10:37:01 -0700]/html Infected: Email-Worm.VBS.KakWorm skipped
C:\Documents and Settings\Owner\Application Data\Thunderbird\Profiles\9c12ywyh.default\Mail\mail.mcn.org\Campaign for Jackson.sbd\Website Mail Berkeley mbox: Infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\Thunderbird\Profiles\9c12ywyh.default\Mail\mail.mcn.org\Trash/[From][Date Sat, 10 Mar 2007 15:02:50 -0500]/UNNAMED/[From "][Date Fri, 09 Mar 2007 07:24:20 -0800]/text/[From][Date Sun, 8 Apr 2007 16:59:50 -0400]/UNNAMED Infected: Email-Worm.Win32.Zhelatin.cq skipped
C:\Documents and Settings\Owner\Application Data\Thunderbird\Profiles\9c12ywyh.default\Mail\mail.mcn.org\Trash/[From "][Date Sat, 10 Mar 2007 15:02:50 -0500]/UNNAMED/[From "][Date Fri, 09 Mar 2007 07:24:20 -0800]/text Infected: Email-Worm.Win32.Zhelatin.cq skipped
C:\Documents and Settings\Owner\Application Data\Thunderbird\Profiles\9c12ywyh.default\Mail\mail.mcn.org\Trash/[From "][Date Sat, 10 Mar 2007 15:02:50 -0500]/UNNAMED Infected: Email-Worm.Win32.Zhelatin.cq skipped
C:\Documents and Settings\Owner\Application Data\Thunderbird\Profiles\9c12ywyh.default\Mail\mail.mcn.org\Trash Mail Berkeley mbox: Infected - 3 skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Campaign for Jackson.sbd\Website/[From "][Date Sat, 15 Apr 2000 10:37:01 -0700]/html Infected: Email-Worm.VBS.KakWorm skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Campaign for Jackson.sbd\Website Mail Berkeley mbox: Infected - 1 skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date … /[From Submitted using SMTP AUTH at out004.verizon. … /[Fr … /[From][Date Mon, 26 Jul 2004 04:20:41 +050 … /html Infected: Trojan-Spy.HTML.Usbankfraud.p skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date … /[From Submitted using SMTP AUTH at out004.verizon. … /[Fr … /[From ][Date Mon, 26 Jul 2004 04:20:41 +0500]/UNNAMED Infected: Trojan-Spy.HTML.Usbankfraud.p skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date … /[From Submitted using SMTP AUTH at out004.verizo … /[ … … /[From ][Date Sat, 11 Sep 2004 19:59:37 -0800]/html Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date … /[From Submitted using SMTP AUTH at out004.verizo … /[ … /[From "][Date Sun, 12 Sep 2004 00:08:53 +0200]/text Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date … /[From Submitted using SMTP AUTH at out004.verizo … /[From "][Date Sat, 11 Sep 2004 10:29:31 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date … /[From Submitted using SMTP AUTH at out004.verizon. … /[F . … /[ … /[From "][Date Sat, 11 Sep 2004 09:35:46 -0500]/text Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date … /[From Submitted using SMTP AUTH at out004.verizon. … /[F . … /[From][Date Fri, 10 Sep 2004 23:17:53 -0700]/text Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date … /[From Submitted using SMTP AUTH at out004.verizon. … /[F … /[From ][Date Tue, 07 Sep 2004 10:36:29 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date … /[From Submitted using SMTP AUTH at out004.verizon. … /[F … /[Fr … /[From][Date Tue, 07 Sep 2004 11:00:43 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date … /[From Submitted using SMTP AUTH at out004.verizon. … /[F … /[From ][Date Tue, 07 Sep 2004 10:21:56 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date … /[From Submitted using SMTP AUTH at out004.verizon. … /[F … /[From "Domain Name News" <[removed]>][Date Sat, 4 Sep 2004 02:46:03 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date … /[From Submitted using SMTP AUTH at out004.verizon. … /[Fr … /[Fro … /[From Vince Taylor <[removed]>][Date Fri, 06 Aug 2004 12:44:27 -0700]/html Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date … /[From Submitted using SMTP AUTH at out004.verizon. … /[Fr … /[From "][Date Fri, 6 Aug 2004 13:59:50 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date … /[From Submitted using SMTP AUTH at out004.verizon. … /[Fr … /[From "][Date Sun, 04 Jul 2004 03:29:06 +0300]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date … /[From Submitted using SMTP AUTH at out004.verizon. … /[From "][Date Wed, 12 May 2004 16:41:46 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date … /[From Submitted using SMTP AUTH at out004.verizon.net from [138.88.172. … /[From ][Date Wed, 12 May 2004 10:49:36 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date … /[From Submitted using SMTP AUTH at out004.verizon.net from [138.88.172.21 … /[From ][Date Tue, 11 May 2004 14:56:16 -0700]/text Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date … /[From Submitted using SMTP AUTH at out004.verizon.net from [138.88.172.21 … /[From][Date Mon, 10 May 2004 11:32:40 -0800]/text Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date … /[From Submitted using SMTP AUTH at out004.verizon.net from [138.88.172.211] at Sat, 8 May 2004 08:38:40 -0500][Date Sat, 8 May 2004 09:38:41 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From "Michelle … / … … /[ … /[From][Date Fri, 7 May 2004 10:31:11 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From "Michelle … / … … /[From De … /[From][Date Thu, 06 May 2004 21:51:45 -0800]/text Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From… … /[][Date Thu, 06 May 2004 08:54:06 -0700]/text Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From "… /[From -3.00, HTML_50_60 0.18, HTML_FONT_BIG 0.10,][Date Wed, 5 May 2004 15:30:57 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From " /[From][Date Tue, 4 May 2004 21:06:28 UT]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From "Michelle Pa … /[From "Ni … /[From][Date Tue, 04 May 2004 11:41:59 -0700]/text Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From][Date Fri, 30 Apr 2004 13:12:08 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From ". /[From][Date Wed, 21 Apr 2004 21:00:07 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From " /[From Date Tue, 20 Apr 2004 09:51:50 -0700]/text Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From "… /[From][Date Tue, 20 Apr 2004 07:58:16 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From "Michelle Palmer" Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From /[Fro … /[From "][Date Mon, 5 Apr 2004 16:30:31 -0700]/text Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From /[From Dennis … /[From][Date 05 Apr 2004 09:52:38 -0600]/text Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From " /[][Date Sun, 04 Apr 2004 18:13:48 -0700]/text Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From / … /[From ][Date Fri, 2 Apr 2004 12:17:11 -0800]/text Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From … /[From Jan … /[From Re: From our supporters][Date Thu, 1 Apr 2004 18:55:09 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From /[From][Date Thu, 01 Apr 2004 15:14:08 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From … /[From Alis Valencia <[removed]>][Date Wed, 31 Mar 2004 11:14:19 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From … … /[From ][Date Thu, 18 Mar 2004 20:55:54 -0800]/text Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From … /[From][Date Wed, 17 Mar 2004 10:19:12 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date Wed, 10 Mar 2004 22:14:20 -0800]/text/[From [removed]>][Date Thu, 11 Mar 2004 02:19:56 -0800]/text Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED/[][Date Wed, 10 Mar 2004 22:14:20 -0800]/text Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 19:42:38 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED/[From "][Date Wed, 10 Mar 2004 13:59:39 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox/[From "][Date Wed, 10 Mar 2004 11:59:08 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jt7s407z.slt\Mail\mail.mcn.org\Inbox Mail Berkeley mbox: Infected - 44 skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\vtaylor\lg9no7rc.slt\Mail\mail.mcn.org\Campaign for Jackson.sbd\Website/[From "][Date Sat, 15 Apr 2000 10:37:01 -0700]/html Infected: Email-Worm.VBS.KakWorm skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\vtaylor\lg9no7rc.slt\Mail\mail.mcn.org\Campaign for Jackson.sbd\Website Mail Berkeley mbox: Infected - 1 skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\vtaylor\lg9no7rc.slt\Mail\[removed]\Campaign for Jackson.sbd\Website/[From "][Date Sat, 15 Apr 2000 10:37:01 -0700]/html Infected: Email-Worm.VBS.KakWorm skipped
K:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\vtaylor\lg9no7rc.slt\Mail\[removed]\Campaign for Jackson.sbd\Website Mail Berkeley mbox: Infected - 1 skipped

Please run Kapersky again and see if we got them all.

vtaylor100

Post #9May 2, 2007, 3:12 PM UTC last edited May 2, 2007, 9:39 PM UTC

Dear Susan, I have removed most of the infected emails, but I could not locate the following ones either within Thunderbird or through searching with Windows Explorer: C:\Documents and Settings\Owner\Application Data\Thunderbird\Profiles\9c12ywyh.default\Mail\mail.mcn.org\Campaign for Jackson.sbd\Website/[From][Date Sat, 15 Apr 2000 10:37:01 -0700]/html Infected: Email-Worm.VBS.KakWorm skipped C:\Documents and Settings\Owner\Application Data\Thunderbird\Profiles\9c12ywyh.default\Mail\mail.mcn.org\Campaign for Jackson.sbd\Website Mail Berkeley mbox: infected - 1 skipped C:\Documents and Settings\Owner\Application Data\Thunderbird\Profiles\9c12ywyh.default\Mail\mail.mcn.org\Trash/[From "][Date Sat, 10 Mar 2007 15:02:50 -0500]/UNNAMED/[From][Date Fri, 09 Mar 2007 07:24:20 -0800]/text/[From][Date Sun, 8 Apr 2007 16:59:50 -0400]/UNNAMED Infected: Email-Worm.Win32.Zhelatin.cq skipped C:\Documents and Settings\Owner\Application Data\Thunderbird\Profiles\9c12ywyh.default\Mail\mail.mcn.org\Trash/[From " >][Date Sat, 10 Mar 2007 15:02:50 -0500]/UNNAMED/[From][Date Fri, 09 Mar 2007 07:24:20 -0800]/text Infected: Email-Worm.Win32.Zhelatin.cq skipped C:\Documents and Settings\Owner\Application Data\Thunderbird\Profiles\9c12ywyh.default\Mail\mail.mcn.org\Trash/[From][Date Sat, 10 Mar 2007 15:02:50 -0500]/UNNAMED Infected: Email-Worm.Win32.Zhelatin.cq skipped C:\Documents and Settings\Owner\Application Data\Thunderbird\Profiles\9c12ywyh.default\Mail\mail.mcn.org\Trash Mail Berkeley mbox: infected - 3 skipped All but the first two are in the "Trash" subfolder, but this folder doesn't show up in Windows Explorer, and the entries aren't in the trash folder in Thunderbird. Suggestions? Also, I tried to delete everything on K:, which is just by backup drive, but the following two entries persist: K:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP685\A0112581.exe/data0008 Infected: not-a-virus:AdWare.Win32.Altnet.o skipped K:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP685\A0112581.exe Inno: infected - 1 skipped Properties show 0 folders and 0 files, but access to "System Volume Information" is denied. Suggestions? Note, I have options set to display all hidden and system folders. Thanks, Vince

Susan528

Post #10May 2, 2007, 4:52 PM UTC

http://kb.mozillazine.org/Thunderbird_:_Ti…pacting_Folders

Don't know if this will help or not. Please let me know.

We will take care of the _restore files later. That is why I did not include them in prior post.

vtaylor100

Post #11May 2, 2007, 6:59 PM UTC

Dear Susan, Compacting removed the infected files. Thanks. I had been putting off compacting, though it was on my near-term to do list. Now it is done, and I will be more on top of it in the future. Next steps? Vince

Susan528

Post #12May 2, 2007, 7:29 PM UTC

Glad compacting worked! Don't know what I would have suggested next! Please post (reply) with another hijackthis log. Also is everything running alright now?

vtaylor100

Post #13May 2, 2007, 8:29 PM UTC

Dear Susan,

As far as I can tell, the computer is operating normally, which includes quite a bit of slow operation upon boot, but I believe this is because a lot of update/downloads occur upon first boot in the morning.

You might be interested to know of a "Catch-22" I ran into in following Tom Coyote advice to update my office programs via MS update. They required a "genuine MS software" validation, which I did reluctantly, although I have only legitimate software. Sure enough, the validation said my FrontPage was not activated and that I needed to activate it. Of course, when I went to activate it, it was already activated! There was no information about what to do in this case. Eventually, 2 hours of phone calls and cross referals later, I finally got to a knowledgeable support person who edited the registry so that I could reactivate. Frustrating, to put it mildly.

By the way, I'm a little concerned (should I be?) about posting all of the email addresses that were in the Kapersky log file. Can these be removed from the post now that they are not needed?

Thanks so much for all of your help – a very educational experience.

Thank you, Angel,

Vince

Here is the hijack log:

Logfile of HijackThis v1.99.1
Scan saved at 1:00:59 PM, on 5/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Network Magic\nmsrvc.exe
C:\WINDOWS\Explorer.EXE
C:\HP\KBD\KBD.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us6.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us6.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://online.wsj.com/home/us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us6.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [SBAutoUpdate] "C:\Program Files\SpywareBlaster\sbautoupdate.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Network Magic\nmapp.exe" -autorun -nosplash
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Google\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Google\Hello\PicasaCapture.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://groups.msn.com
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {928626A3-6B98-11CF-90B4-00AA00A4011F} (SurroundVideoCtrl Object) - http://www.homesteadhotels.com/minisite/ac…nd/MSSurVid.cab
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_02) -
O18 - Protocol: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\puresp3.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: BounceStudio SMTP Service (bPOPSmt) - Unknown owner - C:\Program Files\BoogieTools\BoogiePop\bPOPSmtp.exe
O23 - Service: BounceStudio Bounce Service (bPOPSrv) - Unknown owner - C:\Program Files\BoogieTools\BoogiePop\bPOPServ.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Pure Networks Net2Go Service (nmraapache) - Unknown owner - C:\Program Files\Network Magic\WebServer\bin\nmraapache.exe" -k runservice (file missing)
O23 - Service: Pure Networks Network Magic Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Network Magic\nmsrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Susan528

Post #14May 2, 2007, 8:56 PM UTC

Good work Vince! Your logs appear to be clean.

Please do the following:

Step 2 will take care of the infected _restore files.

STEP 1.
Reset hidden/system files and folders

Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View tab.
Deselect the Show hidden files and folders option.
Select the Hide file extensions for known types option.
Select the Hide protected operating system files option.
Click Yes to confirm.
Click OK.

STEP 2.
System Restore for Windows XP
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected)

Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Reboot.

Turn ON System Restore.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.

STEP 3.
======
DON’T BECOME OVERCONFIDENT WITH ANTIVIRUS APPLICATIONS INSTALLED!!!

http://forum.malwareremoval.com/viewtopic….39eba6ea0b5e8ee

Stay up to date on security patches and be extremely wary of clicking on links and attachments that arrive unbidden in instant messages and e-mail.

"The number one thing the majority of the malicious code we're seeing now does is disable or delete anti-virus and other security software," Dunham said. "In a lot of cases, once the user clicks on that attachment, it's already too late."

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Visit Microsoft's Update Site Frequently - It is important that you visit Windows Updates regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
A tutorial on installing & using this product can be found here:
Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
More info on how to prevent malware you can also find here (By Tony Klein)

Follow this list and your potential for being infected again will reduce dramatically.

Thank you for allowing me to assist you.

Susan

Susan528

Post #15May 2, 2007, 9:41 PM UTC

Hi Vince, I went back and did my best to edit out the email addresses in the Kapersky log. You are the first one to ask me to do that but I really do not blame you.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Hijack Log - Please Analyze

✨ Ask AI

Ask AI