Trojan Horse Dropper.agent.7.s Msn Messenger Troubles

Hi and welcome to the forums. I'm Markka and I will be helping you with your malware issues. I'll check your HijackThis log. Right now I'm MRU Undergrad, everything that I post to you must be checked by teachers of Malware Removal University. Please be patient.

Thanks for the quick reply to let me know you are working on it Markka. I will check back again.

Hello


You don't have a firewall on your computer. Here are free and good firewalls: (Install only one)

Comodo
OutPost
Kerio
Sygate
ZoneAlarm

• 1. Download this file - combofix.exe
• 2. Double click combofix.exe & follow the prompts.
• 3. When finished, it shall produce a log for you. Post that log in your next reply
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Rename HijackThis.exe to Scanner.exe !


Post:* A fresh HijackThis log
* Contents of C:\ComboFix.txt

Hello

Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will reboot your computer, click OK.
• Please post the contents of C:\vundofix.txt and a new HiJackThis log.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.

VundoFix V6.3.21 Checking Java version… Java version is 1.4.2.6 Old versions of java are exploitable and should be removed. Java version is 1.5.0.5 Old versions of java are exploitable and should be removed. Java version is 1.5.0.7 Old versions of java are exploitable and should be removed. Scan started at 6:36:02 PM 03/05/2007 Listing files found while scanning…. C:\WINDOWS\SYSTEM32\bqnfbrcm.dll C:\WINDOWS\SYSTEM32\bvgeftoa.dll C:\WINDOWS\system32\ddcfe.bak1 C:\WINDOWS\system32\ddcfe.bak2 C:\WINDOWS\system32\ddcfe.ini C:\WINDOWS\system32\efcdd.dll C:\WINDOWS\SYSTEM32\mcrbfnqb.ini Beginning removal… Attempting to delete C:\WINDOWS\SYSTEM32\bqnfbrcm.dll C:\WINDOWS\SYSTEM32\bqnfbrcm.dll Has been deleted! Attempting to delete C:\WINDOWS\SYSTEM32\bvgeftoa.dll C:\WINDOWS\SYSTEM32\bvgeftoa.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\ddcfe.bak1 C:\WINDOWS\system32\ddcfe.bak1 Has been deleted! Attempting to delete C:\WINDOWS\system32\ddcfe.bak2 C:\WINDOWS\system32\ddcfe.bak2 Has been deleted! Attempting to delete C:\WINDOWS\system32\ddcfe.ini C:\WINDOWS\system32\ddcfe.ini Has been deleted! Attempting to delete C:\WINDOWS\system32\efcdd.dll C:\WINDOWS\system32\efcdd.dll Has been deleted! Attempting to delete C:\WINDOWS\SYSTEM32\mcrbfnqb.ini C:\WINDOWS\SYSTEM32\mcrbfnqb.ini Has been deleted! Performing Repairs to the registry. Done!

Hello

Before we'll continue I would like you to too upload few malware files for further inspection.

Make your hidden files visible:

• Go to My Computer
• Select the Tools menu and click Folder Options
• Click the View tab.
• Checkmark the "Display the contents of system folders"
• Under the Hidden files and folders select "Show hidden files and folders"
• Uncheck "Hide protected operating system files"
• Click Apply and then the OK and close My Computer.

Please go here to upload a suspicious file for analysis.

• Enter your username from this forum
• Copy and paste the link to this thread
  • Click "Browse" on the 1. field.
    Browse to the following file and click the file with your mouse, press "Open"
    C:\WINDOWS\system32\opnnn.dll
• In the comments, please mention that I asked you to upload this file
• Click on Send File

Thank you

You should send this file also to the Uploadmalware.com
C:\WINDOWS\system32\yayvuvs.dll

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to run it.
  
• Put a check next to Run VundoFix as a task.
  
• You will receive a message saying vundofix will close and re-open in a minute or less. Click OK
  
• When VundoFix re-opens,Click Scan for Vundo button.
  
• Once the scan is complete, Right Click inside the listbox (white box) and click add more files
  
• Copy&Paste the 2 entries below into the top 2 boxes
  
  
  • C:\WINDOWS\system32\opnnn.dll
  • C:\WINDOWS\system32\nnnpo.*
• Click Add Files and Click Close Window
  
• Click the Remove Vundo button.
  
• You will receive a prompt asking if you want to remove the files, click YES
  
• Once you click yes, your desktop will go blank as it starts removing Vundo.
  
• When completed, it will prompt that it will shutdown your computer, click OK.
  
• Turn your computer back on.

Re-run the vundofix: (note; now we are going to delete second vundo file!)

• Double-click VundoFix.exe to run it.
  
• Put a check next to Run VundoFix as a task.
  
• You will receive a message saying vundofix will close and re-open in a minute or less. Click OK
  
• When VundoFix re-opens,Click Scan for Vundo button.
  
• Once the scan is complete, Right Click inside the listbox (white box) and click add more files
  
• Copy&Paste the 2 entries below into the top 2 boxes
  
  
  • C:\WINDOWS\system32\yayvuvs.dll
  • C:\WINDOWS\system32\svuvyay.*
• Click Add Files and Click Close Window
  
• Click the Remove Vundo button.
  
• You will receive a prompt asking if you want to remove the files, click YES
  
• Once you click yes, your desktop will go blank as it starts removing Vundo.
  
• When completed, it will prompt that it will shutdown your computer, click OK.
  
• Turn your computer back on.
  
• Please post the contents of C:\vundofix.txt and a new HiJackThis log.

VundoFix V6.3.21 Checking Java version… Java version is 1.4.2.6 Old versions of java are exploitable and should be removed. Java version is 1.5.0.5 Old versions of java are exploitable and should be removed. Java version is 1.5.0.7 Old versions of java are exploitable and should be removed. Scan started at 6:36:02 PM 03/05/2007 Listing files found while scanning…. C:\WINDOWS\SYSTEM32\bqnfbrcm.dll C:\WINDOWS\SYSTEM32\bvgeftoa.dll C:\WINDOWS\system32\ddcfe.bak1 C:\WINDOWS\system32\ddcfe.bak2 C:\WINDOWS\system32\ddcfe.ini C:\WINDOWS\system32\efcdd.dll C:\WINDOWS\SYSTEM32\mcrbfnqb.ini Beginning removal… Attempting to delete C:\WINDOWS\SYSTEM32\bqnfbrcm.dll C:\WINDOWS\SYSTEM32\bqnfbrcm.dll Has been deleted! Attempting to delete C:\WINDOWS\SYSTEM32\bvgeftoa.dll C:\WINDOWS\SYSTEM32\bvgeftoa.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\ddcfe.bak1 C:\WINDOWS\system32\ddcfe.bak1 Has been deleted! Attempting to delete C:\WINDOWS\system32\ddcfe.bak2 C:\WINDOWS\system32\ddcfe.bak2 Has been deleted! Attempting to delete C:\WINDOWS\system32\ddcfe.ini C:\WINDOWS\system32\ddcfe.ini Has been deleted! Attempting to delete C:\WINDOWS\system32\efcdd.dll C:\WINDOWS\system32\efcdd.dll Has been deleted! Attempting to delete C:\WINDOWS\SYSTEM32\mcrbfnqb.ini C:\WINDOWS\SYSTEM32\mcrbfnqb.ini Has been deleted! Performing Repairs to the registry. Done! Beginning removal… VundoFix V6.3.21 Checking Java version… Java version is 1.4.2.6 Old versions of java are exploitable and should be removed. Java version is 1.5.0.5 Old versions of java are exploitable and should be removed. Java version is 1.5.0.7 Old versions of java are exploitable and should be removed. Scan started at 10:30:45 AM 04/05/2007 Listing files found while scanning…. C:\WINDOWS\system32\nnnpo.bak1 C:\WINDOWS\system32\nnnpo.ini C:\WINDOWS\SYSTEM32\oejtqnmr.dll C:\WINDOWS\system32\opnnn.dll Beginning removal… Attempting to delete C:\WINDOWS\system32\nnnpo.bak1 C:\WINDOWS\system32\nnnpo.bak1 Has been deleted! Attempting to delete C:\WINDOWS\system32\nnnpo.ini C:\WINDOWS\system32\nnnpo.ini Has been deleted! Attempting to delete C:\WINDOWS\SYSTEM32\oejtqnmr.dll C:\WINDOWS\SYSTEM32\oejtqnmr.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\opnnn.dll C:\WINDOWS\system32\opnnn.dll Has been deleted! Performing Repairs to the registry. Done! VundoFix V6.3.21 Checking Java version… Java version is 1.4.2.6 Old versions of java are exploitable and should be removed. Java version is 1.5.0.5 Old versions of java are exploitable and should be removed. Java version is 1.5.0.7 Old versions of java are exploitable and should be removed. Scan started at 11:36:40 AM 04/05/2007 Listing files found while scanning…. C:\WINDOWS\system32\rqqru.bak1 C:\WINDOWS\system32\rqqru.ini C:\WINDOWS\system32\urqqr.dll Beginning removal… Attempting to delete C:\WINDOWS\system32\rqqru.bak1 C:\WINDOWS\system32\rqqru.bak1 Has been deleted! Attempting to delete C:\WINDOWS\system32\rqqru.ini C:\WINDOWS\system32\rqqru.ini Has been deleted! Attempting to delete C:\WINDOWS\system32\urqqr.dll C:\WINDOWS\system32\urqqr.dll Could not be deleted. Attempting to delete C:\WINDOWS\system32\yayvuvs.dll C:\WINDOWS\system32\yayvuvs.dll Has been deleted! Performing Repairs to the registry. Done! VundoFix V6.3.21 Checking Java version… Java version is 1.4.2.6 Old versions of java are exploitable and should be removed. Java version is 1.5.0.5 Old versions of java are exploitable and should be removed. Java version is 1.5.0.7 Old versions of java are exploitable and should be removed. Scan started at 12:35:36 PM 04/05/2007 Listing files found while scanning…. No infected files were found. Beginning removal… VundoFix V6.3.21 Checking Java version… Java version is 1.4.2.6 Old versions of java are exploitable and should be removed. Java version is 1.5.0.5 Old versions of java are exploitable and should be removed. Java version is 1.5.0.7 Old versions of java are exploitable and should be removed. Scan started at 1:29:45 PM 04/05/2007 Listing files found while scanning…. C:\WINDOWS\system32\rqqru.bak1 C:\WINDOWS\system32\rqqru.ini C:\WINDOWS\system32\urqqr.dll Beginning removal… Attempting to delete C:\WINDOWS\system32\rqqru.bak1 C:\WINDOWS\system32\rqqru.bak1 Has been deleted! Attempting to delete C:\WINDOWS\system32\rqqru.ini C:\WINDOWS\system32\rqqru.ini Has been deleted! Attempting to delete C:\WINDOWS\system32\urqqr.dll C:\WINDOWS\system32\urqqr.dll Has been deleted! Performing Repairs to the registry. Done!

Hello

Disable SpywareGuard:

Right click the running icon of Spywareguard, it will open the program.
Then go to Menu, file, exit.
Then confirm the program is closed.
*******************************************************************************************

Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/

• Install AVG Anti-Spyware by double clicking the installer.
• Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
• On the main screen under Your Computer's security.
  • Click on Change state next to Resident shield. It should now change to inactive.
  • Click on Change state next to Automatic updates. It should now change to inactive.
  • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
  • Wait until you see the Update succesfull message.
• Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
• Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.

*******************************************************************************************

Open HijackThis, Click Do a system scan only, checkmark these. Then close all others windows except HijackThis and press fix checked.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {469A7591-94FA-43BF-B8F7-91B00715363B} - C:\WINDOWS\system32\yayvuvs.dll (file missing)
O2 - BHO: (no name) - {590A0FE4-1C6C-4ACE-96F5-4D97254DD724} - C:\WINDOWS\system32\urqqr.dll (file missing)
O2 - BHO: (no name) - {8D0C8CC2-40CB-4B1E-B6C2-0C572E10BDB3} - C:\WINDOWS\system32\efcdd.dll (file missing)
O2 - BHO: (no name) - {B5016BC2-13B0-44A2-B4A4-80B06DA086CA} - C:\WINDOWS\system32\opnnn.dll (file missing)
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu1000904.exe 61A847B5BBF72813329B385F72FD01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O4 - HKLM\..\Run: [InfoData] rundll32.exe "C:\WINDOWS\system32\bqnfbrcm.dll",realset
O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\fbvfffpa.dll",realset
O4 - HKCU\..\Run: [IpWins] C:\Program Files\Ipwindows\ipwins.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…?p=ZNxdm824KPCA
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O20 - Winlogon Notify: fccyxxx - C:\WINDOWS\
O20 - Winlogon Notify: ied026 - ied026.dll (file missing)
O20 - Winlogon Notify: iiffg - C:\WINDOWS\
O20 - Winlogon Notify: rqronom - C:\WINDOWS\

*******************************************************************************************

Make your hidden files visible:

• Click start
• Click my computer
• Select the Tools menu and click Folder Options.
• After the new window appears select the View tab.
• Put a checkmark in the checkbox labeled Display the contents of system folders.
• Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
• Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
• Remove the checkmark from the checkbox labeled Hide protected operating system files.
• Press the Apply button and then the OK button and shutdown My Computer.

*******************************************************************************************

Please download ATF-cleaner and save it to your desktop.

• Double-click ATF-Cleaner.exe to run the program.
  
• Under Main choose: Select All
  
• Click the Empty Selected button.
  
  If you use Firefox browser:
  
  
• Click Firefox at the top and choose: Select All
  
• Click the Empty Selected button.
  
• NOTE: If you would like to keep your saved passwords, please click No at the prompt.
  
  If you use Opera browser:
  
  
• Click Opera at the top and choose: Select All
  
• Click the Empty Selected button.
  
• NOTE: If you would like to keep your saved passwords, please click No at the prompt.
  
• Click Exit on the Main menu to close the program.

*******************************************************************************************
Please then reboot your computer in Safe Mode by doing the following:

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
• Choose your usual account.

*******************************************************************************************

Delete these files: (if found)
C:\WINDOWS\retadpu1000904.exe
C:\WINDOWS\system32\bqnfbrcm.dll
C:\WINDOWS\system32\fbvfffpa.dll


*******************************************************************************************

Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.

• Click on Scanner on the toolbar.
• Click on the Settings tab.
  • Under How to act?
    • Click on Recommended Action and choose Quarantine from the popup menu.
  • Under How to scan?
    • All checkboxes should be ticked.
  • Under Possibly unwanted software:
    • All checkboxes should be ticked.
  • Under Reports:
    • Select Automatically generate report after every scan and uncheck Only if threats were found.
  • Under What to scan?
    • Select Scan every file.
• Click on the Scan tab.
• Click on Complete System Scan to start the scan process.
• Let the program scan the machine.
• When the scan has finished, follow the instructions below.
  IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
  • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
  • At the bottom of the window click on the Apply all Actions button. (3)
    [external image: Posted Image]
• When done, click the Save Scan Report button. (4)
  • Click the Save Report as button.
  • Save the report to your Desktop.
• Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

Reboot in Normal Mode.

*******************************************************************************************


Post:
- A fresh HijackThis log
- AVG's log

——————————————————— AVG Anti-Spyware - Scan Report ——————————————————— + Created at: 9:19:26 AM 05/05/2007 + Scan result: C:\Program Files\TopText\CHCON.dll -> Adware.EZula : Cleaned with backup (quarantined). C:\Program Files\TopText\CHPON.dll -> Adware.EZula : Cleaned with backup (quarantined). C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1078\A0075831.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\WINDOWS\SYSTEM32\70tovmto.ini -> Adware.Sahat : Cleaned with backup (quarantined). C:\WINDOWS\b122.exe -> Adware.Softomate : Cleaned with backup (quarantined). C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1078\A0075855.dll -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1078\A0077914.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1079\A0077995.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1081\A0078092.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1082\A0078098.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\Program Files\TopText\sepng.dll -> Not-A-Virus.PSWTool.Win32.EZula.bf : Cleaned with backup (quarantined). :mozilla.127:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned. :mozilla.100:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.101:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.102:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.103:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.104:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.105:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.106:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.107:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.108:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.109:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.110:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.111:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.112:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.113:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.114:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.115:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.183:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.233:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.245:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.305:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.92:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.93:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.94:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.95:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.96:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.97:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.98:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.99:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.64:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.65:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.69:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.40:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.28:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.480:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.481:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.59:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned. :mozilla.62:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned. :mozilla.189:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Com : Cleaned. :mozilla.190:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.191:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.192:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.193:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.27:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.209:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.76:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.543:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.544:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.545:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.123:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.124:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.125:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.126:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.26:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.329:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.559:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Paypal : Cleaned. :mozilla.29:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.30:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.31:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.32:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.52:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.53:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.54:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.55:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.355:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned. :mozilla.356:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned. :mozilla.77:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.78:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.79:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.80:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.81:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.82:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.83:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.84:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.85:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.86:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.87:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.7:C:\Documents and Settings\Korene\Application Data\Mozilla\Profiles\default\8bd6biii.slt\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.176:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.381:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.382:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.383:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.384:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.385:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.398:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.399:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.400:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.401:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.409:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.410:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.411:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.412:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.413:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.34:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.335:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.336:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.337:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.338:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.358:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.359:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.360:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.361:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.362:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.496:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned. :mozilla.70:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.71:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.72:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.73:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.74:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.75:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.88:C:\Documents and Settings\Korene\Application Data\Mozilla\Firefox\Profiles\f0xyccr4.default\cookies.txt -> TrackingCookie.Zedo : Cleaned. C:\QooBox\Quarantine\C\Program Files\Ipwindows\UnInstall.exe.vir -> Trojan.Rond : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\Program Files\Ipwindows\ipwins.exe.vir -> Trojan.Rond : Cleaned with backup (quarantined). C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1080\A0078036.exe -> Trojan.Rond : Cleaned with backup (quarantined). C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1080\A0078037.exe -> Trojan.Rond : Cleaned with backup (quarantined). C:\Documents and Settings\Korene\Desktop\olo.exe -> Worm.Agent.a : Cleaned with backup (quarantined). C:\Documents and Settings\Korene\olo.exe -> Worm.Agent.a : Cleaned with backup (quarantined). C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1078\A0077915.exe -> Worm.Agent.a : Cleaned with backup (quarantined). C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1080\A0077999.exe -> Worm.Agent.a : Cleaned with backup (quarantined). C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1080\A0078056.exe -> Worm.Agent.a : Cleaned with backup (quarantined). ::Report end