Awaiting Assistance

Hi YoungBruce, My name is silver and I'm currently looking over your log. Please hold on while I research a fix for you.

yezzir

Hi YoungBruce,

Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will reboot your computer, click OK.
• A log file will be created at C:\vundofix.txt, please post the contents of this in your next response.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.

Next, move HijackThis from the desktop to it's own folder:

• Open My Computer, navigate to C:\ and make a new folder named HJT
• Move the HijackThis.exe program file from your desktop to C:\HJT
• If you wish to place a shortcut to HijackThis on your desktop, then right-click hijackthis.exe, select Send To and choose Desktop (create shortcut)

Once complete, please post the VundoFix log along with a new HijackThis log.

Hi YoungBruce,

I note you now have a program called New.net in your HijackThis log. Did you know this was installed and did you do it purposefully? This program is not malware, but has been linked with instability and is considered very undesirable. Unless you are sure you want it, I recommend you remove it. To do so, please follow the instructions colored olive.

Please download LSPFix.exe from here:
http://www.cexx.org/lspfix.htm
Do NOT run this program. This is only to be used if you lose Internet Access after removing NewDotNet.

Next, press Start > Control Panel > Add or Remove Programs, and remove the following:

New.Net Applications, New.Net Domains or any entry with the word New.Net

If you don't see anything listed that says New.Net, then we have to use a different method of removal:
open the following link: http://www.newdotnet.com/removal.html, and follow Procedure 4: NewDotNet
Caution: If you removed New.Net in Add/Remove Programs then you do not need to use this link

Removal of ~New.Net by either method can in some cases cause a loss in internet access. In the event that this has now happened, please double-click LSPFix.exe that you downloaded earlier. You will see 2 panels. If there is any file listed in the Remove panel on the right-side, leave it as is and just click Finish>> then reboot your computer and you should now have access to the Internet.. If nothing is listed under the "Remove Panel", do NOT do anything - just close the program. You will need to use another computer to come back here for further instructions on what to do.

You also have Viewpoint Media Player installed on your system. This program is not malware but it is foistware in that it is usually installed without the user's knowledge or approval, and for this reason I recommend you remove it. If you actually use this program, I recommend you try using alternatives such as VLC Player or Media Player Classic.
To remove, open Start->Control Panel->Add/Remove Programs find Viewpoint Media Player and select Uninstall

Temporarily disable Windows Defender:

• Right-click on the Windows Defender icon in the system tray [it's the one with the red and yellow bulls-eye]
• Click on Security Agents Status
• Click on Disable real-time protection.
• Next right-click on the Windows Defender icon in the system tray again to open the program
• Click on the Options menu and choose Settings
• In the left pane column click on Real Time Protection
• Under Startup Options, uncheck Enable Security Agents on startup (recommended)
• Under Real-time spyware threat protection, uncheck Enable real-time spyware threat protection (recommended)
• Click the Save button and close Microsoft AntiSpyware
• Finally, right-click on the Windows Defender icon in the system tray and select Shutdown Windows Defender

Then, open HijackThis, choose Do a system scan only and place a checkmark next to the following lines (if present):
R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {1557B435-8242-4686-9AA3-9265BF7525A4} - C:\WINDOWS\system32\qlmodrfo.dll (file missing)
O2 - BHO: (no name) - {6DFEB79F-6BE4-48A2-B6F5-DF7FA605E46F} - C:\WINDOWS\system32\ssqpm.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

IP addresses for auto.search.msn.com and auto.search.msn.es have been manually added to your hosts file, unless you or the administrator of this machine knowingly made these changes, then also place checkmarks next to these lines:
O1 - Hosts: 66.98.148.65 auto.search.msn.com
O1 - Hosts: 66.98.148.65 auto.search.msn.es

You have a website called sxload.net in your Internet Explorer Trusted Zone. Websites in your Trusted Zone have much lower security settings than normal, so unless you are sure you completely trust this site, then also place a checkmark next to this line:
O15 - Trusted Zone: *.sxload.net (HKLM)

Then close all open windows apart from HijackThis, press Fix checked, OK the prompt and close HijackThis.

Next, please upload some suspect files for testing:
Open http://virusscan.jotti.org/
Copy/paste this file and path into the white box at the top:
C:\Program Files\Messenger\qulazu.dll
Press Submit - this will submit the file for testing.
Please copy and paste the results in your next response.
Then repeat the process for:
C:\Program Files\Windows Media Player\mezo.dll

Next, please do an online scan with Kaspersky:

Open Kaspersky Online Scanner in Internet Explorer

You will be prompted to install an ActiveX component from Kaspersky,
Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT and then Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Extended (if available otherwise Standard)
  
  • Scan Options:
  Scan Archives Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• The program will start to scan your system.
• Once the scan is complete, click on the Save as Text button and save the file to your desktop

Now open HijackThis, select Open the Misc Tools section
Press the Open Uninstall Manager… button, then press Save list…
Save the Uninstall log to your deskop and include a copy in your next response.
Now press Back and Scan and then Save log to create and save a new HijackThis log.

Once complete, please post the Jotti results, the Kaspersky log and the uninstall log along with a new HijackThis log. Also, let me know if you had any difficulty with the uninstalls.

and the uninstalls didn't pose any problems whatsoever

i forgot to add the kaspersky results, here they go: ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Friday, April 27, 2007 5:10:59 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 27/04/2007 Kaspersky Anti-Virus database records: 304177 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ Scan Statistics: Total number of scanned objects: 78309 Number of viruses found: 22 Number of infected objects: 347 / 0 Number of suspicious objects: 0 Duration of the scan process: 02:45:12 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\Administrator\Application Data\Azureus\ipfilter.cache Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Azureus\tmp\AZU3433.tmp Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Azureus\tmp\AZU3434.tmp Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Azureus\tmp\AZU3435.tmp Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Azureus\tmp\AZU3436.tmp Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Azureus\tmp\AZU3437.tmp Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Azureus\tmp\AZU3438.tmp Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\81guvdl7.default\cert8.db Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\81guvdl7.default\history.dat Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\81guvdl7.default\key3.db Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\81guvdl7.default\parent.lock Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\81guvdl7.default\search.sqlite Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\81guvdl7.default\urlclassifier2.sqlite Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\version.jar-759bdc60-7bf372c2.zip/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\version.jar-759bdc60-7bf372c2.zip/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\version.jar-759bdc60-7bf372c2.zip/Baaaaa.class Infected: Trojan.Java.ClassLoader.ao skipped C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\version.jar-759bdc60-7bf372c2.zip ZIP: infected - 3 skipped C:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Desktop\NNuninstall.exe Infected: not-a-virus:AdWare.Win32.NewDotNet.e skipped C:\Documents and Settings\Administrator\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\Administrator\Desktop\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\Administrator\Desktop\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\Administrator\Desktop\SmitfraudFix.exe RarSFX: infected - 2 skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_360.wmdb Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\81guvdl7.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\81guvdl7.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\81guvdl7.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\81guvdl7.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012007042720070428\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temp\hsperfdata_Administrator\552 Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temp\NeroDemo12065\Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\Documents and Settings\Administrator\Local Settings\Temp\Perflib_Perfdata_6d0.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temp\USDR6_9999_N18M1603\installer.exe/Stream/data0005 Infected: not-a-virus:Downloader.Win32.WinFixer.t skipped C:\Documents and Settings\Administrator\Local Settings\Temp\USDR6_9999_N18M1603\installer.exe/Stream Infected: not-a-virus:Downloader.Win32.WinFixer.t skipped C:\Documents and Settings\Administrator\Local Settings\Temp\USDR6_9999_N18M1603\installer.exe Inno: infected - 2 skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Administrator\My Documents\Azureus Downloads\SuperFoot Bill Wallace Pro Stretching\Superfoot Bill Wallace Pro Stretching.avi Object is locked skipped C:\Documents and Settings\Administrator\My Documents\Azureus Downloads\Thundercats\Season 0147 - Good And Ugly.m4v Object is locked skipped C:\Documents and Settings\Administrator\My Documents\Azureus Downloads\Thundercats\Season 0279 - Mad Bubbler.m4v Object is locked skipped C:\Documents and Settings\Administrator\ntuser.dat Object is locked skipped C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-04222007-030817.log Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Messenger\qulazu.dll Infected: Trojan.Win32.BHO.ab skipped C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\debug.log Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\debug.log.idx Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\error.log Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\error.log.idx Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\hips.log Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\hips.log.idx Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\ids.log Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\ids.log.idx Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\network.log Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\network.log.idx Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\system.log Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\system.log.idx Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\warning.log Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\warning.log.idx Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\web.log Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\web.log.idx Object is locked skipped C:\Program Files\Windows Media Player\mezo.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\Program Files\Windows Media Player\TTC.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP194\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP194\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP194\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP194\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP194\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP195\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP195\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP195\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP195\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP195\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP196\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP196\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP196\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP196\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP196\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP197\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP197\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP197\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP197\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP197\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP198\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP198\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP198\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP198\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP198\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP199\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP199\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP199\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP199\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP199\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP200\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP200\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP200\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP200\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP200\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP201\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP201\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP201\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP201\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP201\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP202\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP202\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP202\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP202\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP202\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP203\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP203\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP203\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP203\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP203\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP204\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP204\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP204\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP204\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP204\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP205\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP205\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP205\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP205\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP205\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP206\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP206\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP206\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP206\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP206\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP207\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP207\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP207\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP207\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP207\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP208\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP208\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP208\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP208\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP208\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP209\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP209\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP209\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP209\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP209\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP210\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP210\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP210\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP210\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP210\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP211\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP211\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP211\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP211\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP211\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP212\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP212\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP212\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP212\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP212\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP213\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP213\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP213\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP213\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP213\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP214\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP214\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP214\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP214\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP214\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP215\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP215\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP215\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP215\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP215\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP216\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP216\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP216\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP216\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP216\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP217\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP217\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP217\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP217\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP217\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP218\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP218\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP218\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP218\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP218\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP219\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP219\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP219\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP219\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP219\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP220\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP220\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP220\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP220\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP220\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP221\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP221\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP221\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP221\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP221\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP222\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP222\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP222\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP222\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP222\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP223\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP223\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP223\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP223\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP223\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP224\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP224\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP224\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP224\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP224\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP225\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP225\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP225\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP225\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP225\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP226\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP226\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP226\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP226\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP226\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP227\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP227\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP227\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP227\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP227\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP228\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP228\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP228\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP228\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP228\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP229\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP229\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP229\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP229\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP229\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP230\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP230\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP230\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP230\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP230\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP231\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP231\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP231\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP231\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP231\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP232\A0063523.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP232\A0063525.dll Object is locked skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP232\A0063724.exe/data0004 Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP232\A0063724.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP232\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP232\snapshot\MFEX-4.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP232\snapshot\MFEX-5.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP232\snapshot\MFEX-6.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP232\snapshot\MFEX-7.DAT Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP233\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP234\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP235\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP236\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP237\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP238\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP239\A0064027.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP239\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP244\A0064222.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP244\A0064242.exe/data0004 Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP244\A0064242.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP244\A0064255.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP244\A0064282.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP244\A0064297.exe/data0004 Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP244\A0064297.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP244\A0064309.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP244\A0064348.exe/data0004 Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP244\A0064348.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP244\A0064358.exe Object is locked skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP244\A0064384.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP244\A0064398.exe/data0004 Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP244\A0064398.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP244\A0064399.exe Object is locked skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP244\A0064401.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP244\A0064416.exe/data0004 Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP244\A0064416.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP245\A0064430.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.il skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP245\A0064431.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP245\A0064444.exe/data0004 Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP245\A0064444.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP245\A0064445.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP245\A0064452.exe Object is locked skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP245\A0064453.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.il skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP245\A0064455.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.hb skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP245\A0064456.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.il skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP245\A0064457.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.il skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP245\A0064458.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.il skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP245\A0064459.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.hb skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP245\A0064460.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.il skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP245\A0064461.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP245\A0064462.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.il skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP245\A0064464.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.il skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP245\A0064465.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP245\A0064488.exe/data0004 Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP245\A0064488.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP245\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP246\A0064568.exe/data0004 Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP246\A0064568.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP247\A0064588.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP247\A0064603.exe/data0004 Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP247\A0064603.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP247\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP248\change.log Object is locked skipped C:\System Volume Information\_restore{CE4B8214-1212-46E6-B242-43DBF9DD6465}\RP248\snapshot\MFEX-1.DAT Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\VundoFix Backups\awttsss.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.il skipped C:\VundoFix Backups\criwflux.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.hb skipped C:\VundoFix Backups\ddcabxw.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.il skipped C:\VundoFix Backups\jkkjiih.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.il skipped C:\VundoFix Backups\khfddef.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.il skipped C:\VundoFix Backups\mkvkndgj.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.hb skipped C:\VundoFix Backups\nnnklkk.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.il skipped C:\VundoFix Backups\pgsnbvej.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.hb skipped C:\VundoFix Backups\ssqpm.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\VundoFix Backups\tuvvttr.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.il skipped C:\VundoFix Backups\yayabay.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.il skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{573D79BC-B145-4C9C-8B33-2A39FFE59C97}.crmlog Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\system32\awtqo.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\awtsp.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\WINDOWS\system32\awtsr.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\awvtt.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\awvtu.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fl skipped C:\WINDOWS\system32\awvvt.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ig skipped C:\WINDOWS\system32\bund1\ClientBundle1.exe/data0002 Infected: not-a-virus:AdWare.Win32.NewDotNet skipped C:\WINDOWS\system32\bund1\ClientBundle1.exe/data0003 Infected: Trojan.Win32.BHO.ab skipped C:\WINDOWS\system32\bund1\ClientBundle1.exe/data0004 Infected: not-a-virus:AdWare.Win32.SurfSide.ax skipped C:\WINDOWS\system32\bund1\ClientBundle1.exe/data0005 Infected: Trojan-Dropper.Win32.Agent.bfr skipped C:\WINDOWS\system32\bund1\ClientBundle1.exe NSIS: infected - 4 skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\config\WindowsPowerShell.evt Object is locked skipped C:\WINDOWS\system32\ddaba.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\ddabb.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\ddabc.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\ddayw.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\ddccd.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\ddcya.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\gebcc.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\gebcy.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\gebyw.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\gebyx.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\WINDOWS\system32\geeba.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ig skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\jkhfd.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\jkhhh.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\WINDOWS\system32\jkkjk.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\jkkll.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\micro1\f4.exe Infected: not-a-virus:AdWare.Win32.SurfSide.ax skipped C:\WINDOWS\system32\mljgg.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\mljjh.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\mljjj.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\mllmm.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\MsDtc\MSDTC.LOG Object is locked skipped C:\WINDOWS\system32\MsDtc\Trace\dtctrace.log Object is locked skipped C:\WINDOWS\system32\pmkhg.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\pmkjg.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\pmkji.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\pmnlm.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ig skipped C:\WINDOWS\system32\pmnnl.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\pmnnm.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\ssqpq.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\ssqro.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\ssqrq.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\sstqo.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\sstqp.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\ssttt.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\vtstq.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ig skipped C:\WINDOWS\system32\vtutq.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\vtutr.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.iu skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\system32\xlibgfl254.dll Infected: Trojan-Downloader.Win32.Agent.bfj skipped C:\WINDOWS\VTTC.exe/data0004 Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\WINDOWS\VTTC.exe NSIS: infected - 1 skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped F:\urcrazyclone\Programs & Apps\Scripts\DS\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped F:\urcrazyclone\Programs & Apps\Scripts\DS.zip/DS/mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped F:\urcrazyclone\Programs & Apps\Scripts\DS.zip ZIP: infected - 1 skipped F:\urcrazyclone\Programs & Apps\Scripts\GuarDDog\mirc_GuarDDogv.4.4.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped F:\urcrazyclone\Programs & Apps\Scripts\GuarDDog4-1.4LITE.zip/GuarDDog/mirc_GuarDDogv.4.4.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped F:\urcrazyclone\Programs & Apps\Scripts\GuarDDog4-1.4LITE.zip ZIP: infected - 1 skipped F:\urcrazyclone\Programs & Apps\Scripts\setup.exe/ci-temp0.cab/PCStats/DLL/Procs.dll Infected: not-a-virus:RiskTool.Win32.PsKill.b skipped F:\urcrazyclone\Programs & Apps\Scripts\setup.exe/ci-temp0.cab/mIRC.EXE Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped F:\urcrazyclone\Programs & Apps\Scripts\setup.exe/ci-temp0.cab Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped F:\urcrazyclone\Programs & Apps\Scripts\setup.exe CreateInstall: infected - 3 skipped F:\urcrazyclone\Programs & Apps\Scripts\tormentev_2b.zip/setup.exe/ci-temp0.cab/PCStats/DLL/Procs.dll Infected: not-a-virus:RiskTool.Win32.PsKill.b skipped F:\urcrazyclone\Programs & Apps\Scripts\tormentev_2b.zip/setup.exe/ci-temp0.cab/mIRC.EXE Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped F:\urcrazyclone\Programs & Apps\Scripts\tormentev_2b.zip/setup.exe/ci-temp0.cab Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped F:\urcrazyclone\Programs & Apps\Scripts\tormentev_2b.zip/setup.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped F:\urcrazyclone\Programs & Apps\Scripts\tormentev_2b.zip ZIP: infected - 4 skipped F:\urcrazyclone\Programs & Apps\Scripts\xtreme_s[07-05].zip/sys/idents.ini Infected: Flooder.IRC.Extreme.821 skipped F:\urcrazyclone\Programs & Apps\Scripts\xtreme_s[07-05].zip/sys/channel.ini Infected: Flooder.IRC.Extreme.821 skipped F:\urcrazyclone\Programs & Apps\Scripts\xtreme_s[07-05].zip/sys/events.ini Infected: Flooder.IRC.Extreme.821 skipped F:\urcrazyclone\Programs & Apps\Scripts\xtreme_s[07-05].zip/sys/dialog1.ini Infected: Flooder.IRC.Extreme.821 skipped F:\urcrazyclone\Programs & Apps\Scripts\xtreme_s[07-05].zip/sys/dialog3.ini Infected: Flooder.IRC.Extreme.821 skipped F:\urcrazyclone\Programs & Apps\Scripts\xtreme_s[07-05].zip/sys/events2.ini Infected: Flooder.IRC.Extreme.821 skipped F:\urcrazyclone\Programs & Apps\Scripts\xtreme_s[07-05].zip ZIP: infected - 6 skipped Scan process completed.

Hi YoungBruce,

There's quite a lot in this post, so I recommend you have a read through before starting and if anything is unclear or you have any trouble with the instructions, please stop and let me know.

First please open Start->Control Panel->Add/Remove Programs once more, we have some more uninstalls to consider:

Please remove BSPlayer because this program comes bundled with adware. If you use it, I recommend you try the safe alternatives to Viewpoint player which were VLC Player and Media Player Classic.

There are a couple of programs I couldn't find out anything much about - DV Ts and Ultra soft. Do you know what these programs are and did you willingly install them?

You have several peer-to-peer programs installed on your computer. The programs you have do not come bundled with malware as some similar programs do, but P2P file sharing networks are one of the biggest sources of malware we see. Anything downloaded from them cannot be trusted to be clean, because even if the file appears to be what it claims to be, it can have malware embedded in it.
I recommend you remove it, but of course the choice is yours. You can remove Azureus, Limewire and SoulSeek via Add/Remove Programs.

Then, open HijackThis, choose Do a system scan only and place a checkmark next to the following lines (if present):
O2 - BHO: 0 - {03CAEAA9-1EF9-49F9-D488-A405D751EDF3} - C:\Program Files\Messenger\qulazu.dll
O2 - BHO: (no name) - {48D4E1E3-9FD7-4653-B757-CC33078E3D14} - C:\Program Files\Windows Media Player\mezo.dll

Then close all open windows apart from HijackThis, press Fix checked, OK the prompt and close HijackThis.

Download OTMoveIt to your desktop. and double-click the program to start it.
Select the contents of the below file list, then press Ctrl+C to copy it to the clipboard
In OTMoveIt, click in the left-hand pane and press Ctrl+V to paste the file-list into the program
Then, press MoveIt!
Copy the Results output and paste it into a new notepad file so you can post it in your next response. Do this by clicking in the right-hand pane, press Ctrl-A then Ctrl-C to select all and copy. Then open Notepad, press Ctrl-V to paste in the text, and save this text file to your desktop.

OTMoveIt file list:

C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\version.jar-759bdc60-7bf372c2.zip
C:\Documents and Settings\Administrator\Desktop\NNuninstall.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\NeroDemo12065\Toolbar.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\USDR6_9999_N18M1603\installer.exe
C:\Program Files\Messenger\qulazu.dll
C:\Program Files\Windows Media Player\mezo.dll
C:\Program Files\Windows Media Player\TTC.dll
C:\WINDOWS\system32\awtqo.dll 
C:\WINDOWS\system32\awtsp.dll 
C:\WINDOWS\system32\awtsr.dll
C:\WINDOWS\system32\awvtt.dll
C:\WINDOWS\system32\awvtu.dll 
C:\WINDOWS\system32\awvvt.dll
C:\WINDOWS\system32\bund1\ClientBundle1.exe
C:\WINDOWS\system32\ddaba.dll 
C:\WINDOWS\system32\ddabb.dll 
C:\WINDOWS\system32\ddabc.dll 
C:\WINDOWS\system32\ddayw.dll 
C:\WINDOWS\system32\ddccd.dll 
C:\WINDOWS\system32\ddcya.dll 
C:\WINDOWS\system32\gebcc.dll 
C:\WINDOWS\system32\gebcy.dll 
C:\WINDOWS\system32\gebyw.dll 
C:\WINDOWS\system32\gebyx.dll 
C:\WINDOWS\system32\geeba.dll
C:\WINDOWS\system32\jkhfd.dll 
C:\WINDOWS\system32\jkhhh.dll 
C:\WINDOWS\system32\jkkjk.dll 
C:\WINDOWS\system32\jkkll.dll 
C:\WINDOWS\system32\micro1\f4.exe 
C:\WINDOWS\system32\mljgg.dll
C:\WINDOWS\system32\mljjh.dll
C:\WINDOWS\system32\mljjj.dll 
C:\WINDOWS\system32\mllmm.dll
C:\WINDOWS\system32\pmkhg.dll 
C:\WINDOWS\system32\pmkjg.dll 
C:\WINDOWS\system32\pmkji.dll 
C:\WINDOWS\system32\pmnlm.dll 
C:\WINDOWS\system32\pmnnl.dll 
C:\WINDOWS\system32\pmnnm.dll 
C:\WINDOWS\system32\qlmodrfo.dll
C:\WINDOWS\system32\ssqpm.dll
C:\WINDOWS\system32\ssqpq.dll 
C:\WINDOWS\system32\ssqro.dll 
C:\WINDOWS\system32\ssqrq.dll 
C:\WINDOWS\system32\sstqo.dll 
C:\WINDOWS\system32\sstqp.dll
C:\WINDOWS\system32\ssttt.dll 
C:\WINDOWS\system32\vtstq.dll 
C:\WINDOWS\system32\vtutq.dll 
C:\WINDOWS\system32\vtutr.dll
C:\WINDOWS\system32\xlibgfl254.dll
C:\WINDOWS\system32\yayabay.dll
C:\WINDOWS\VTTC.exe
F:\urcrazyclone\Programs & Apps\Scripts\xtreme_s[07-05].zip
C:\Program Files\newdotnet
C:\Program Files\Viewpoint

Kaspersky also identified these files as being suspicious because they contain the MIRC executable which is sometimes used by malware:
F:\urcrazyclone\Programs & Apps\Scripts\DS\mirc.exe
F:\urcrazyclone\Programs & Apps\Scripts\DS.zip
F:\urcrazyclone\Programs & Apps\Scripts\GuarDDog\mirc_GuarDDogv.4.4.exe
F:\urcrazyclone\Programs & Apps\Scripts\GuarDDog4-1.4LITE.zip
F:\urcrazyclone\Programs & Apps\Scripts\setup.exe
F:\urcrazyclone\Programs & Apps\Scripts\tormentev_2b.zip
Do you know what these programs are for, and are you sure you want to keep them?
If not, use Windows Explorer to locate and delete them.

Next, please reboot your computer and do a couple further scans:

Please download F-Secure Blacklight (blbeta.exe):
https://europe.f-secure.com/blacklight/try.shtml

• Click I ACCEPT and download the graphical user interface version to your Desktop
• Double click the file to run it, choose I accept the agreement then press Scan
• It will create the "fsbl-xxxxxxx.log" on your desktop.
• The log will have a list of all items found.
• Do not choose to rename any yet! I want to see the log first because legitimate items can also be present.
• Exit Blacklight and post the contents of the log in your next reply.

Download Dr.WEB CureIt to your desktop from here:
ftp://ftp.drweb.com/pub/drweb/cureit/cureit.exe

• Double-click cureit.exe to start the program.
• Press Start and then OK to start the Express scan
• The Express scan takes just a few moments to finish, if something is found, click Yes to cure it
• Once the short scan has finished, Click Options->Change settings
• Choose the Scan tab and remove the check mark from Heuristic analysis
• Then choose the Actions tab and next to Infected objects select Move, then press OK to close the settings box.
• Then select all hard drives to be scanned by clicking on them - choose all drives - a red dot confirms they will be scanned
• Then click the green arrow on the right to start the scan
• Click Yes to all if it asks if you want to move a file
• Then click File-> Save report list and save the report to your desktop
• Close Dr.Web Cureit and reboot your computer (this is important as files may be moved/deleted during reboot)

Once complete, please post the OTMoveIt output, the Blacklight log, the Dr Web log and a new HijackThis log.

Hi YoungBruce,

Wikipedia's article on BSPlayer says that it is bundled with adware since version 1.38, if you are using an older one then maybe it is clean. I would however reiterate that the players I linked to above are extremely popular and very fully featured as well as completely safe and free, so for those reasons I recommend them instead of this program.

Next please open OTMoveIt again by double-clicking the program to start it.
Select the contents of the below file list, then press Ctrl+C to copy it to the clipboard
In OTMoveIt, click in the left-hand pane and press Ctrl+V to paste the file-list into the program
Then, press MoveIt!
Copy the Results output and paste it into a new notepad file so you can post it in your next response. Do this by clicking in the right-hand pane, press Ctrl-A then Ctrl-C to select all and copy. Then open Notepad, press Ctrl-V to paste in the text, and save this text file to your desktop.

OTMoveIt file list:

C:\Program Files\Ipwindows
C:\Documents and Settings\Administrator\DoctorWeb\Quarantine

Once you have saved the log information in a text file, use the CleanUp function:

• Close all programs apart from OTMoveIt as this step will require a reboot
• On the OTMoveIt main screen, press the CleanUp! button
• Say Yes to the prompt and then allow the program to reboot your computer.

Re-enable Windows Defender real-time protection:

• Right-click on the Windows Defender icon in the system tray [it's the one with the red and yellow bulls-eye].
• Click on Security Agents Status
• Click on Enable real-time protection
• Next right-click on the Windows Defender icon in the system tray again to open the program
• Click on the Options menu and choose Settings
• In the left pane column click on Real Time Protection
• Under Startup Options, check Enable Security Agents on startup (recommended)
• Under Real-time spyware threat protection, check Enable real-time spyware threat protection (recommended)
• Click the Save button and close Windows Defender

Once complete, please post the OTMoveIt log along with a new HijackThis log and let me know how your computer is running.

Hi YoungBruce,

I'm glad to hear your machine is running better, your log looks good and I think your machine is now clean! If you still have cureit.exe or LSPFix.exe on your desktop they are no longer required and can be removed, as can any log files you have saved.

Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs from changing those files. You will lose all previous restore points which are likely to be infected.
Right-click My Computer (from the desktop or Start Menu)
Click Properties and choose the System Restore tab
Check Turn off System Restore
Click Apply, and then Yes to confirm, you may need to wait a moment while Windows deletes old System Restore Points
Then, UN-Check Turn off System Restore
Click OK

Your Java is outdated and is now a security risk
Go to Start » Control Panel » Add/Remove Programs
Search for all previous installed versions of Java. (J2SE Runtime Environment…. )
(It should have this icon next to it: [external image: Posted Image])
Click that entry and then click on the Change/Remove button and follow the instructions to remove Java.
Repeat to remove all versions of Java.
Download and install the newest version of Java Runtime Environment (JRE), from here:
http://java.sun.com/javase/downloads/index.jsp

You should have one antivirus and one antispyware program with real-time or active protection installed and running all the time. You should ideally have a two-way firewall installed also. Your log shows you have AVG antivirus, Windows Defender and Kerio firewall installed which gives you a good level of protection.

One antivirus program is sufficient. Installing multiple programs can cause system problems as they may conflict with one another, and it won't improve your security. Instead, I recommend you regularly scan using an online service, like Kaspersky's which we used in this thread. This will give you all the benefits of a '2nd opinion' without any system problems, and it's free too!

Antispyware/anti-adware programs cover a wide range of threats, and the key thing is to not double-up your protection. Windows Defender covers most bases, and if you are regularly scanning with it, your antivirus program and an online scanner then I'd say that's probably sufficient. If you wish to install another program, then I'd recommend the real-time protection is turned off and you use it only as an on-demand scanner.

IESPYADS helps protect you from malicious websites by placing a list of known bad websites in Internet Explorer's Restricted Zone. This Zone limits the capabilities of these websites including preventing them from installing software. This will compliment your security software and I recommend you install it:
http://www.spywarewarrior.com/uiuc/resource.htm

Please take care when downloading programs. One of the easiest ways to be infected is to download freeware/shareware programs which come laden with malware. Before downloading, it is crucial to check whether the source is reputable.
One way to check is to use McAfee SiteAdvisor. Copy the domain name into the space provided and SiteAdvisor will give you a report on the website which can help you decide if it is safe. They also have a toolbar for IE and Firefox which adds this functionality to your browser.

Find out how to prevent infection in the future
http://forum.malwareremoval.com/viewtopic.php?p=33687

Please post back to let me know how you got on, and if there are any further issues.

um there arent any other issues as far as my computer being infected, but maybe i can ask you this. my system doesnt seem to have usb support. there is no usb tree in the device manager. there isnt an option to enable it in the bios either. i tried updating my bios and it didnt help. i was able to use usb in the past, but when i had to format my computer and start fresh. there was no usb. maybe yo can help. other than that everything is fine. Thanks for the help