Strange Acting

And the last part of combofix log:

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 21:38]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"RemoteControl"="D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-12-07 23:57]
"LanguageShortcut"="D:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-05-18 12:29]
"ATICCC"="D:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 11:12]
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [2006-09-01 16:57]
"SansaDispatch"="D:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe" [2007-01-30 16:48]
"!AVG Anti-Spyware"="D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2006-10-07 08:20]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="D:\Program Files\Messenger\msmsgs.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2006-09-28 10:13]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\__c00A7A4]
D:\WINDOWS\System32\__c00A7A4.dat

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*


********************************************************************

catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-03 18:39:05
Windows 5.1.2600 Service Pack 1 NTFS


scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0


********************************************************************

Completion time: 2007-06-03 18:39:46
D:\ComboFix-quarantined-files.txt … 2007-06-03 18:39

— E O F —

I must bring to your attention that when i ran killbox.exe , i did exacly what you told me to do , but as you mentioned not to add the files by right clicking, if doing so, only one file while show up..But i did it by clicking paste from clipboard, but still only file showed up , wish is the one i couldn't delete in previous steps "__c00A7A4.dat"

Here the results .

First part:


"zonner" - 2007-06-03 18:37:47 Service Pack 1
ComboFix 07-05.27.BV - Running from: "D:\Documents and Settings\zonner\Desktop\"


(((((((((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))


D:\WINDOWS\system32\xnrbfqpq.dll


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


"D:\windows\system32\explorer.exe"
"D:\WINDOWS\system32\mp43.exe"
"D:\WINDOWS\opera6.ini"


((((((((((((((((((((((((((((((( Files Created from 2007-05-03 to 2007-06-03 ))))))))))))))))))))))))))))))))))


2007-06-03 18:23

d——– D:\!KillBox
2007-06-03 08:47 524,288 –ah—– D:\DOCUME~1\ADMINI~1.GRO\NTUSER.DAT
2007-06-03 08:31 3,968 –a—— D:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-06-02 14:59 8,704 –a—— D:\WINDOWS\system32\kbdjpn.dll
2007-06-02 14:59 8,192 –a—— D:\WINDOWS\system32\kbdkor.dll
2007-06-02 14:59 6,144 –a—— D:\WINDOWS\system32\kbd106.dll
2007-06-02 14:59 6,144 –a—— D:\WINDOWS\system32\kbd101c.dll
2007-06-02 14:59 6,144 –a—— D:\WINDOWS\system32\kbd101b.dll
2007-06-02 14:59 5,632 –a—— D:\WINDOWS\system32\kbd103.dll
2007-06-02 11:43 524,288 –ah—– D:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-06-01 06:34 d——– D:\VundoFix Backups
2007-05-31 08:02 77,312 –a—— D:\WINDOWS\ua2.dll
2007-05-29 08:55 35,840 –a—— D:\WINDOWS\system32\__c00D2C40.dat
2007-05-29 08:54 35,840 –a—— D:\WINDOWS\system32\__c00BF22E.dat
2007-05-28 23:18 52,736 –a—— D:\WINDOWS\swiydr.exe
2007-05-17 13:22 d——– D:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-05-15 11:09 24,576 –a—— D:\WINDOWS\system32\xpsp1hfm.exe
2007-05-12 14:39 d——– D:\DOCUME~1\zonner\APPLIC~1\ArcSoft
2007-05-12 14:35 d——– D:\WINDOWS\LastGood
2007-05-12 14:34 499,712 -ra—— D:\WINDOWS\system32\msvcp71.dll
2007-05-12 14:34 245,408 –a—— D:\WINDOWS\system32\unicows.dll
2007-05-12 14:34 1,645,320 –a—— D:\WINDOWS\system32\gdiplus.dll
2007-05-12 14:34 d——– D:\Program Files\Common Files\ArcSoft
2007-05-09 19:00 d——– D:\WINDOWS\LastGood.Tmp
2007-05-09 18:39 6,684,672 –a—— D:\WINDOWS\system32\atioglx1.dll
2007-05-07 17:43 d——– D:\Program Files\SanDisk
2007-05-07 17:43 d——– D:\DOCUME~1\zonner\APPLIC~1\InstallShield


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-02 21:12:03 ——– d—–w D:\DOCUME~1\zonner\APPLIC~1\Azureus
2007-05-31 00:47:07 3,912 —-a-w D:\WINDOWS\mozver.dat
2007-05-24 02:27:39 ——– d—–w D:\DOCUME~1\zonner\APPLIC~1\LimeWire
2007-05-15 14:32:35 ——– d—–w D:\Program Files\QuickTime
2007-05-15 09:48:25 ——– d—–w D:\Program Files\Azureus
2007-05-12 18:34:19 ——– d–h–w D:\Program Files\InstallShield Installation Information
2007-05-09 22:57:06 1,324 —-a-w D:\WINDOWS\system32\d3d9caps.dat
2007-05-07 21:45:23 ——– d–h–w D:\Program Files\WindowsUpdate
2007-04-18 17:11:48 ——– d—–w D:\Program Files\MSN Messenger
2007-03-23 01:05:00 520,192 ——w D:\WINDOWS\system32\ati2sgag.exe
2007-03-15 01:58:38 315,392 —-a-w D:\WINDOWS\system32\ATIDEMGX.dll
2007-03-15 01:57:36 267,776 —-a-w D:\WINDOWS\system32\ati2dvag.dll
2007-03-15 01:55:38 307,200 —-a-w D:\WINDOWS\system32\atiiiexx.dll
2007-03-15 01:50:40 122,880 —-a-w D:\WINDOWS\system32\atipdlxx.dll
2007-03-15 01:50:28 114,688 —-a-w D:\WINDOWS\system32\Oemdspif.dll
2007-03-15 01:50:20 26,112 —-a-w D:\WINDOWS\system32\Ati2mdxx.exe
2007-03-15 01:50:14 42,496 —-a-w D:\WINDOWS\system32\ati2edxx.dll
2007-03-15 01:50:00 114,688 —-a-w D:\WINDOWS\system32\ati2evxx.dll
2007-03-15 01:48:40 450,560 —-a-w D:\WINDOWS\system32\ati2evxx.exe
2007-03-15 01:47:54 53,248 —-a-w D:\WINDOWS\system32\ATIDDC.DLL
2007-03-15 01:40:12 2,820,544 —-a-w D:\WINDOWS\system32\ati3duag.dll
2007-03-15 01:29:48 1,315,712 —-a-w D:\WINDOWS\system32\ativvaxx.dll
2007-03-15 01:19:34 5,402,624 —-a-w D:\WINDOWS\system32\atioglxx.dll
2007-03-15 01:16:16 258,048 —-a-w D:\WINDOWS\system32\atikvmag.dll
2007-03-15 01:14:44 17,408 —-a-w D:\WINDOWS\system32\atitvo32.dll
2007-03-15 01:10:30 356,352 —-a-w D:\WINDOWS\system32\ati2cqag.dll
2007-03-06 22:04:54 143,676 —-a-w D:\WINDOWS\system32\atiicdxx.dat

Good morning.

I must bring to your attention that when i ran killbox.exe , i did exacly what you told me to do , but as you mentioned not to add the files by right clicking, if doing so, only one file while show up..But i did it by clicking paste from clipboard, but still only file showed up , wish is the one i couldn't delete in previous steps "__c00A7A4.dat"

The other two files should have already been deleted by SD Fix. I was worried that they might still be there, as SD Fix didn't reboot. The fact that Killbox couldn't find them, and the ComboFix report, confirms that they are no longer there. The HijackThis log is looking good, but there is one more line which we need to fix.

Run HijackThis and click Scan and then check (tick) the following, if present (don't worry if any are missing):

O20 - Winlogon Notify: __c00A7A4 - D:\WINDOWS\System32\__c00A7A4.dat (file missing)


Close down all programs, browsers and other open windows. Make sure that only the above items are checked and then click on Fix checked.

————————————————

Killbox

There's another two files to delete.

Open Killbox and copy the entire text within the quote box below.

D:\WINDOWS\system32\__c00D2C40.dat
D:\WINDOWS\system32\__c00BF22E.dat

• Open Killbox
• Click the option Delete on Reboot
• Click on the All Files button
• Go to File and click on Paste from Clipboard (Note: You must use the file menu–pasting by right-clicking the mouse will only enter one file).
• If no files appear in the drop-down box, please stop and let me know
• Click on the red button with the white 'X' on it (Delete File)
• Wait for the confirmation message that will ask you to Reboot Now
• Click Yes
• Exit the program

Reboot your computer

———————————————-

Submit File to Jotti

Please click on http://virusscan.jotti.org/
Use the "Browse" button and locate the following file on your computer:

D:\WINDOWS\swiydr.exe

Click the "Submit" button.
Please copy and paste the results, as a reply to this thread.

If Jotti's service load is too high, you can use the following scanner instead:
http://www.virustotal.com/xhtml/index_en.html

Please repeat the above with the following file: D:\WINDOWS\system32\d3d9caps.dat

———————————————

Please post:

• The results of the Jotti/VirusTotal scans
• A new HijackThis log

Please also let me know how the computer is running now.

Good morning to you there is result for swiydr.exe : Antivirus Version Update Result AhnLab-V3 2007.5.31.2 06.04.2007 no virus found AntiVir 7.4.0.29 06.04.2007 TR/Hijack.Zeroups Authentium 4.93.8 05.23.2007 no virus found Avast 4.7.997.0 06.04.2007 no virus found AVG 7.5.0.467 06.03.2007 no virus found BitDefender 7.2 06.04.2007 Trojan.Vmcopup.A CAT-QuickHeal 9.00 06.02.2007 (Suspicious) - DNAScan ClamAV devel-20070416 06.04.2007 no virus found DrWeb 4.33 06.04.2007 Trojan.DownLoader.22964 eSafe 7.0.15.0 06.03.2007 Suspicious Trojan/Worm eTrust-Vet 30.7.3690 06.04.2007 no virus found Ewido 4.0 06.04.2007 no virus found FileAdvisor 1 06.04.2007 no virus found Fortinet 2.85.0.0 06.02.2007 W32/BackDoor.A!tr F-Prot 4.3.2.48 06.01.2007 no virus found F-Secure 6.70.13030.0 06.04.2007 Packed.Win32.Morphine.a Ikarus T3.1.1.8 06.04.2007 MalwareScope.Trojan-Spy.BZub.1 Kaspersky 4.0.2.24 06.04.2007 Packed.Win32.Morphine.a McAfee 5044 06.01.2007 Generic BackDoor.u Microsoft 1.2503 06.04.2007 VirTool:Win32/Obfuscator.E NOD32v2 2306 06.04.2007 probably unknown NewHeur_PE virus Norman 5.80.02 06.04.2007 W32/BHO.QG Panda 9.0.0.4 06.03.2007 Malware Generic Prevx1 V2 06.04.2007 no virus found Sophos 4.18.0 06.01.2007 Mal/Behav-010 Sunbelt 2.2.907.0 05.30.2007 no virus found Symantec 10 06.04.2007 no virus found TheHacker 6.1.6.129 06.04.2007 no virus found VBA32 3.12.0 06.04.2007 Trojan-Downloader.Win32.ConHook.ah VirusBuster 4.3.23:9 06.03.2007 no virus found Webwasher-Gateway 6.0.1 06.04.2007 Trojan.Hijack.Zeroups Aditional Information File size: 52736 bytes MD5: 34f956449a539e19ae8af0b6002471c8 SHA1: 99c777ef2ece2ff1249a22e056b3863192d54287 packers: MORPHINE And the other file : Antivirus Version Update Result AhnLab-V3 2007.5.31.2 06.04.2007 no virus found AntiVir 7.4.0.29 06.04.2007 no virus found Authentium 4.93.8 05.23.2007 no virus found Avast 4.7.997.0 06.04.2007 no virus found AVG 7.5.0.467 06.03.2007 no virus found BitDefender 7.2 06.04.2007 no virus found CAT-QuickHeal 9.00 06.02.2007 no virus found ClamAV devel-20070416 06.04.2007 no virus found DrWeb 4.33 06.04.2007 no virus found eSafe 7.0.15.0 06.03.2007 no virus found eTrust-Vet 30.7.3690 06.04.2007 no virus found Ewido 4.0 06.04.2007 no virus found FileAdvisor 1 06.04.2007 no virus found Fortinet 2.85.0.0 06.02.2007 no virus found F-Prot 4.3.2.48 06.01.2007 no virus found F-Secure 6.70.13030.0 06.04.2007 no virus found Ikarus T3.1.1.8 06.04.2007 no virus found Kaspersky 4.0.2.24 06.04.2007 no virus found McAfee 5044 06.01.2007 no virus found Microsoft 1.2503 06.04.2007 no virus found NOD32v2 2306 06.04.2007 no virus found Norman 5.80.02 06.04.2007 no virus found Panda 9.0.0.4 06.03.2007 no virus found Prevx1 V2 06.04.2007 no virus found Sophos 4.18.0 06.01.2007 no virus found Sunbelt 2.2.907.0 05.30.2007 no virus found Symantec 10 06.04.2007 no virus found TheHacker [removed] 06.04.2007 no virus found VBA32 3.12.0 06.04.2007 no virus found VirusBuster 4.3.23:9 06.03.2007 no virus found Webwasher-Gateway 6.0.1 06.04.2007 no virus found Aditional Information File size: 1324 bytes MD5: 69b29ace9a6930e01ce4dc9fe5d81b0d SHA1: 12863e707888df08c73953f6884bd24e1058634e Look like the first file is full of "KaKa"

The last part of dss.exe: R2 RichVideo (Cyberlink RichVideo Service(CRVS)) - "d:\program files\cyberlink\shared files\richvideo.exe"

Hi.

I'm pleased that deleting that file cured your Firefox problem.

You have posted the main Deckard's scan report but there should be one called extra.txt. Please could you post that with your next reply.

———————————————————————–

There are some registry entries which we need to restore to their default setting and a couple that we need to delete. However, we need to back up the registry before making the changes.

Backup the Windows Registry

• Download Erunt to your desktop from here
• Double-click on the file to install the program
• Untick the NTREGOPT desktop shortcut option
• Click No when you get the option to run Erunt at Windows startup.
• During the installation, tick Launch Erunt
• Accept the defaults for running a backup
• Erunt will then backup your registry

———————————————————————-

Edit the Windows Registry

Select the contents of the Code Box below and copy/paste into Notepad

Windows Registry Editor Version 5.00

[-HKEY_CLASSES_ROOT\.dbt]

[-HKEY_CLASSES_ROOT\DBTFILE]

[HKEY_CLASSES_ROOT\batfile\shell\edit\command]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,4e,00,4f,00,\
54,00,45,00,50,00,41,00,44,00,2e,00,45,00,58,00,45,00,20,00,25,00,31,00,00,\
00

[HKEY_CLASSES_ROOT\regfile\shell\edit\command]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,4e,00,4f,00,\
54,00,45,00,50,00,41,00,44,00,2e,00,45,00,58,00,45,00,20,00,25,00,31,00,00,\
00

[HKEY_CLASSES_ROOT\cplfile\shell\cplopen\command]
@="rundll32.exe shell32.dll,Control_RunDLL \"%1\",%*"

• Make sure that Word Wrap is turned off in Notepad - (click the Format menu and uncheck Word Wrap)
• Click Save As on the File menu and name the file fix.reg
• Change the Save as Type to All Files
• Save the file on your desktop
• Close Notepad and make sure that all other windows are closed

Important:

• Make sure there are NO blank lines before Windows Registry Editor Version 5.00
• Make sure there is ONE blank line at the end of the file (hit the Return key)
• Make sure that you have copied all of the text (e.g. don't miss the first 'W')
• Double-click on the fix.reg file
• When it prompts to merge, click Yes

——————————————————–

Kaspersky Online Scanner

Finally, I would like you to run an online scan to make sure that we've got everything. Using Internet Explorer, go to: http://www.kaspersky.com/virusscanner

• Click on Kaspersky Online Scanner
• Click the Accept button
• Follow the prompts to download and install the ActiveX component(s) and other software
  • If a yellow information bar appears at the top of the browser window, click on it and select Install ActiveX Control
  • If a message box appears, click on OK or Run as appropriate
• Click Accept again (see the note below if using IE7)
• The program will launch and then start to download the latest definition files.
• Once the scanner is installed and the definitions downloaded, click 'Next'.
• Now click on 'Scan Settings'
• In the scan settings make sure that the following are selected:
  • Scan using the following Anti-Virus database: 'Extended' (If available, otherwise 'Standard')
  • Scan Options: 'Scan Archives' and 'Scan Mail Bases'
• Click 'OK'
• Now under 'Select a target to scan' select 'My Computer'
• The scan will take a while, so be patient and let it run. Once the scan is complete, it will display whether your system has been infected.
• Now click on the Save as… button:
• Save the report to your desktop (Save as type: Text document (txt))

Note: You may get returned to a window without the Accept/Decline buttons after allowing the ActiveX control. The buttons are there - you just can't see them! Click on the zoom button (bottom, right of the window) and change it from 100% to 75%. You should now see the buttons. Reset to 100% once the license has been accepted.

————————————————————

Please post, as a reply to this thread (you may need more than one post):

• The other Deckard's report (extra.txt)
• The Kaspersky report
• A new HijackThis log

Dear beynac . I tryed a few time to procedd with the final step , wish is to run an online scan , but i cant get the page to load , might be to besy or temporary out . I'am running out of time for this morning , have to go to work So i will try again as soon as i come back from work Thx again .

Hi. If you still have problems with Kaspersky, you could try this one:

Please run the F-Secure Online Scanner

Note: This scanner is for Internet Explorer only.

• Follow the instructions for installation.
• Accept the License Agreement.
• Once the ActiveX installs, click Full System Scan
• Once the download completes, the scan will begin automatically.
• The scan will take some time to finish, so please be patient.
• When the scan completes, click the Automatic cleaning (recommended) button.
• Click the Show Report button and Copy/Paste the entire report in your next reply.

———————————————

Please post either the Kaspersky report or the f-secure one, together with a new HijackThis log.

Hi beynac , sorry for the long respond. Thereis the online scan report: KASPERSKY ONLINE SCANNER REPORT Wednesday, June 06, 2007 10:32:13 AM Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 6/06/2007 Kaspersky Anti-Virus database records: 340918 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ F:\ Scan Statistics: Total number of scanned objects: 28893 Number of viruses found: 11 Number of infected objects: 823 / 0 Number of suspicious objects: 12 Duration of the scan process: 00:42:38 Infected Object Name / Virus Name / Last Action C:\System Volume Information\_restore{1EC33435-2455-4810-B624-B2DB2A7F1AE6}\RP204\A0065494.exe Infected: Net-Worm.Win32.Allaple.e skipped C:\System Volume Information\_restore{1EC33435-2455-4810-B624-B2DB2A7F1AE6}\RP204\A0065495.exe Infected: Net-Worm.Win32.Allaple.e skipped C:\System Volume Information\_restore{1EC33435-2455-4810-B624-B2DB2A7F1AE6}\RP204\A0065496.exe Infected: Net-Worm.Win32.Allaple.e skipped C:\System Volume Information\_restore{1EC33435-2455-4810-B624-B2DB2A7F1AE6}\RP204\A0065497.exe Infected: Net-Worm.Win32.Allaple.e skipped C:\System Volume Information\_restore{1EC33435-2455-4810-B624-B2DB2A7F1AE6}\RP204\A0065498.exe Infected: Net-Worm.Win32.Allaple.e skipped C:\System Volume Information\_restore{1EC33435-2455-4810-B624-B2DB2A7F1AE6}\RP204\A0065499.exe Infected: Net-Worm.Win32.Allaple.e skipped C:\System Volume Information\_restore{1EC33435-2455-4810-B624-B2DB2A7F1AE6}\RP204\A0065500.exe Infected: Net-Worm.Win32.Allaple.e skipped C:\System Volume Information\_restore{1EC33435-2455-4810-B624-B2DB2A7F1AE6}\RP204\A0065501.exe Infected: Net-Worm.Win32.Allaple.e skipped C:\System Volume Information\_restore{1EC33435-2455-4810-B624-B2DB2A7F1AE6}\RP204\A0065502.exe Infected: Net-Worm.Win32.Allaple.e skipped C:\System Volume Information\_restore{1EC33435-2455-4810-B624-B2DB2A7F1AE6}\RP204\A0065503.exe Infected: Net-Worm.Win32.Allaple.e skipped C:\System Volume Information\_restore{1EC33435-2455-4810-B624-B2DB2A7F1AE6}\RP204\A0065504.exe Infected: Net-Worm.Win32.Allaple.e skipped C:\System Volume Information\_restore{1EC33435-2455-4810-B624-B2DB2A7F1AE6}\RP204\A0065505.exe Infected: Net-Worm.Win32.Allaple.e skipped C:\System Volume Information\_restore{1EC33435-2455-4810-B624-B2DB2A7F1AE6}\RP204\A0065506.exe Infected: Net-Worm.Win32.Allaple.e skipped C:\System Volume Information\_restore{1EC33435-2455-4810-B624-B2DB2A7F1AE6}\RP204\A0065507.exe Infected: Net-Worm.Win32.Allaple.e skipped C:\System Volume Information\_restore{1EC33435-2455-4810-B624-B2DB2A7F1AE6}\RP204\A0065508.exe Infected: Net-Worm.Win32.Allaple.e skipped C:\System Volume Information\_restore{1EC33435-2455-4810-B624-B2DB2A7F1AE6}\RP204\A0065565.exe Infected: Net-Worm.Win32.Allaple.e skipped C:\System Volume Information\_restore{1EC33435-2455-4810-B624-B2DB2A7F1AE6}\RP208\A0071069.exe Infected: Trojan-Clicker.Win32.Agent.jn skipped C:\System Volume Information\_restore{1EC33435-2455-4810-B624-B2DB2A7F1AE6}\RP208\A0071070.exe Infected: Trojan-Clicker.Win32.Agent.jn skipped C:\System Volume Information\_restore{1EC33435-2455-4810-B624-B2DB2A7F1AE6}\RP208\A0071071.exe Infected: Trojan-Clicker.Win32.Agent.jn skipped C:\res\etnqnckj.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\!KillBox\__c00A7A4.dat Suspicious: Packed.Win32.Morphine.a skipped D:\!KillBox\__c00A7A4.dat( 1) Suspicious: Packed.Win32.Morphine.a skipped D:\!KillBox\__c00BF22E.dat Suspicious: Packed.Win32.Morphine.a skipped D:\!KillBox\__c00D2C40.dat Suspicious: Packed.Win32.Morphine.a skipped D:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped D:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped D:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped D:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped D:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped D:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped D:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped D:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped D:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped D:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped D:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped D:\Documents and Settings\zonner\Application Data\Mozilla\Firefox\Profiles\cm8154fv.default\cert8.db Object is locked skipped D:\Documents and Settings\zonner\Application Data\Mozilla\Firefox\Profiles\cm8154fv.default\formhistory.dat Object is locked skipped D:\Documents and Settings\zonner\Application Data\Mozilla\Firefox\Profiles\cm8154fv.default\history.dat Object is locked skipped D:\Documents and Settings\zonner\Application Data\Mozilla\Firefox\Profiles\cm8154fv.default\key3.db Object is locked skipped D:\Documents and Settings\zonner\Application Data\Mozilla\Firefox\Profiles\cm8154fv.default\parent.lock Object is locked skipped D:\Documents and Settings\zonner\Application Data\Mozilla\Firefox\Profiles\cm8154fv.default\search.sqlite Object is locked skipped D:\Documents and Settings\zonner\Application Data\Mozilla\Firefox\Profiles\cm8154fv.default\urlclassifier2.sqlite Object is locked skipped D:\Documents and Settings\zonner\Application Data\Sun\Java\Deployment\cache\6.0\41\3f27a9-22fb9981/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped D:\Documents and Settings\zonner\Application Data\Sun\Java\Deployment\cache\6.0\41\3f27a9-22fb9981/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped D:\Documents and Settings\zonner\Application Data\Sun\Java\Deployment\cache\6.0\41\3f27a9-22fb9981/Baaaaa.class Infected: Trojan.Java.ClassLoader.ao skipped D:\Documents and Settings\zonner\Application Data\Sun\Java\Deployment\cache\6.0\41\3f27a9-22fb9981 ZIP: infected - 3 skipped D:\Documents and Settings\zonner\Cookies\index.dat Object is locked skipped D:\Documents and Settings\zonner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped D:\Documents and Settings\zonner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped D:\Documents and Settings\zonner\Local Settings\Application Data\Mozilla\Firefox\Profiles\cm8154fv.default\Cache\_CACHE_001_ Object is locked skipped D:\Documents and Settings\zonner\Local Settings\Application Data\Mozilla\Firefox\Profiles\cm8154fv.default\Cache\_CACHE_002_ Object is locked skipped D:\Documents and Settings\zonner\Local Settings\Application Data\Mozilla\Firefox\Profiles\cm8154fv.default\Cache\_CACHE_003_ Object is locked skipped D:\Documents and Settings\zonner\Local Settings\Application Data\Mozilla\Firefox\Profiles\cm8154fv.default\Cache\_CACHE_MAP_ Object is locked skipped D:\Documents and Settings\zonner\Local Settings\History\History.IE5\index.dat Object is locked skipped D:\Documents and Settings\zonner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped D:\Documents and Settings\zonner\NTUSER.DAT Object is locked skipped D:\Documents and Settings\zonner\ntuser.dat.LOG Object is locked skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\bhnjlqvh.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\bnqcntce.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\brvtbnxs.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\bteettez.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\btrwbses.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\bvnjkxbs.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\cesevbhb.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\cjlvqxbe.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\clhvxrbx.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\crhtwnrc.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\ctsqeltz.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\ewcevskt.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\henwjnwc.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\hkrwjbjj.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\hlsnvsjt.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\hqtskbqk.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\hthhljte.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\jhrrktss.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\jvjjbjsv.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\jwcnbkrh.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\klhlnshb.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\klnljlzh.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\knljnwvl.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\kswvqqeh.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\kvbjnzsl.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\lhbhcxel.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\lksbthqh.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\lltrlzhk.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\lnhbjnre.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\lvshsslw.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\lxenzebl.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\lxnwebez.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\lzkxtjnb.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\nbsecnwe.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\nbtnqrke.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\nrtwcvzj.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\nwvhrwkv.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\nxwjljtj.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\rbhtxezn.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\sbjsbrtk.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\skwtrkbq.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\swetseeq.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\tbksjlth.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\tsczrbsl.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\ttbekltl.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\tvqjbbjn.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\vezhhcnn.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\vqxbsjrk.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\vwhnkhnc.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\weslnsbh.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\whelwlrh.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\zbhnktkz.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\zsbwznxk.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\Legal\Adobe Reader\7.0.0\en_US\khckjebx.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\Legal\Adobe Reader\7.0.0\en_US\license.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\PictureTasks\Howto\qhhjjzbk.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Adobe\Acrobat 7.0\Reader\rckjnzbl.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\hkvbhknh.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\common\html\btjttenl.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\common\html\eqkkewlk.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\common\html\eshnqtwb.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\common\html\hkcvsjce.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\common\html\ktjejhqj.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\common\html\lebhskqt.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\common\html\lnhrjsln.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\common\html\lxwsjknl.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\common\html\qnnkzneh.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\common\html\rjnkqsts.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\common\html\rrznqsbb.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\common\html\sccejhcx.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\common\html\sxxkqkhb.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\common\html\tkjjhbhc.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\common\html\vjhnteee.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\common\html\vkvrzhbz.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\common\html\vssjbnbc.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\common\html\vvcebqeq.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\common\html\zljtvrrl.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\common\html\znwjrjwn.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\java\html\hlervvhk.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\java\html\kstjsjjb.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\java\html\nbsttwtz.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\java\html\rrzweehl.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\java\html\sshetwlr.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\java\html\trksjtwv.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\java\html\tserbxrb.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\js\html\bbktlvhl.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\js\html\ekjzthjs.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\js\html\evhsjvhl.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\js\html\lcxejhzj.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\js\html\nerbhsxe.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\js\html\nxvtrljs.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\js\html\vbhtebrl.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\js\html\zslhnvvb.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\js\html\zvbcktcn.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\js\html\zxnrtsts.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\lxnnnskr.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\help\wwhelp\wwhimpl\nhztrxhe.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\Welcome\bhenvrnn.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\Welcome\ebvltzjk.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\Welcome\ejjbtnhx.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\Welcome\elnxhnbh.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\Welcome\evzskszs.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\Welcome\hznsqrkt.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\Welcome\lhnexjwv.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\Welcome\lrtkkjrv.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\Welcome\sjehlnkk.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\Welcome\sqnbsnns.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\Welcome\swskrqlt.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\ATI Technologies\ATI.ACE\Welcome\welcom_en-US_cycle.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\Azureus\nqxekhjk.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\Blank.htm Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\cccnelbs.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\Citrus Punch.htm Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\Clear Day.htm Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\ejtnhhtn.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\Fiesta.htm Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\Glacier.htm Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\hhlxlwsn.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\hqvbwssq.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\Ivy.htm Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\jlvblhte.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\jxhwhjnz.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\Leaves.htm Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\lwlqehrz.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\Maize.htm Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\Nature.htm Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\Network Blitz.htm Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\nsbvwewn.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\Pie Charts.htm Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\rclbtvnt.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\rrslstkz.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\Sunflower.htm Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\Sweets.htm Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\tebkhrqj.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\Technical.htm Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\tjjvsjjt.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\tvcsxbch.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Common Files\Microsoft Shared\Stationery\vtqhhxev.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\Common Files\System\ado\rqjncjjk.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\AVSettings\Audio.htm Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\AVSettings\Audio_DRC.htm Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\AVSettings\AVSetMenu.htm Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\AVSettings\Color.htm Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\AVSettings\Default.htm Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\AVSettings\hehkqqhs.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\AVSettings\jhncsntk.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\AVSettings\kcslvzbx.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\AVSettings\Main.htm Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\AVSettings\Main_Audio.htm Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\AVSettings\nbctsxbj.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\AVSettings\qlbsjvbl.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\AVSettings\snlwjwxk.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\AVSettings\Video.htm Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\AVSettings\xjtcjqkc.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\AVSettings\zvqtlhrj.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Chs\kelbhtlj.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Chs\pdvd7_aac\erlnzjnv.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Chs\pdvd7_aac\pdvd7_aac.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Chs\pdvd7_cprm\pdvd7_cprm.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Chs\pdvd7_cprm\srtweewr.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Chs\pdvd7_divx\pdvd7_divx.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Chs\pdvd7_divx\qlhzjelj.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Chs\pdvd7_dolby\lxkkbrbe.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Chs\pdvd7_dolby\pdvd7_dolby.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Chs\pdvd7_dolbyoem\hnjvlvjz.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Chs\pdvd7_dolbyoem\pdvd7_dolbyoem.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Chs\pdvd7_dts\pdvd7_dts.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Chs\pdvd7_dts\xnrtxkwr.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Chs\pdvd7_dts_es_neo\lkjwnblt.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Chs\pdvd7_dts_es_neo\pdvd7_dts_es_neo.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Chs\pdvd7_dvdaudio\bshkehle.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Chs\pdvd7_dvdaudio\pdvd7_dvdaudio.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Chs\pdvd7_h264\eqwtkhrt.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Chs\pdvd7_h264\pdvd7_h264.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Chs\pdvd7_ia\hsehelcc.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Chs\pdvd7_ia\pdvd7_ia.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Chs\pdvd7_mpeg-la\pdvd7_mpeg-la.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Chs\pdvd7_mpeg-la\srjbwlre.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Chs\pdvd7_nb\pdvd7_nb.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Chs\pdvd7_nb\snztvsln.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Cht\hlslzsej.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Cht\pdvd7_aac\hhvrwbcz.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Cht\pdvd7_aac\pdvd7_aac.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Cht\pdvd7_cprm\pdvd7_cprm.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Cht\pdvd7_cprm\vzlrhnhq.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Cht\pdvd7_divx\kcvxhxjk.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Cht\pdvd7_divx\pdvd7_divx.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Cht\pdvd7_dolby\pdvd7_dolby.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Cht\pdvd7_dolby\sjlhlztr.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Cht\pdvd7_dolbyoem\kqzrthks.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Cht\pdvd7_dolbyoem\pdvd7_dolbyoem.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Cht\pdvd7_dts\ckblhhsb.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Cht\pdvd7_dts\pdvd7_dts.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Cht\pdvd7_dts_es_neo\etqtezwn.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Cht\pdvd7_dts_es_neo\pdvd7_dts_es_neo.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Cht\pdvd7_dvdaudio\bejjehnt.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Cht\pdvd7_dvdaudio\pdvd7_dvdaudio.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Cht\pdvd7_h264\bnrlwjrj.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Cht\pdvd7_h264\pdvd7_h264.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Cht\pdvd7_ia\pdvd7_ia.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Cht\pdvd7_ia\zsbkeewv.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Cht\pdvd7_mpeg-la\brjctxbe.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Cht\pdvd7_mpeg-la\pdvd7_mpeg-la.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Cht\pdvd7_nb\pdvd7_nb.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Cht\pdvd7_nb\vcrkvqqb.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Deu\lbhblqqn.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Deu\pdvd7_aac\bswbzeeb.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Deu\pdvd7_aac\pdvd7_aac.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Deu\pdvd7_cprm\nwtrhlks.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Deu\pdvd7_cprm\pdvd7_cprm.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Deu\pdvd7_divx\pdvd7_divx.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Deu\pdvd7_divx\rtsnejnw.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Deu\pdvd7_dolby\pdvd7_dolby.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Deu\pdvd7_dolby\rtrljssj.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Deu\pdvd7_dolbyoem\pdvd7_dolbyoem.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Deu\pdvd7_dolbyoem\ztvbehhs.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Deu\pdvd7_dts\hxeksztj.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Deu\pdvd7_dts\pdvd7_dts.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Deu\pdvd7_dts_es_neo\pdvd7_dts_es_neo.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Deu\pdvd7_dts_es_neo\qnrllnwt.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Deu\pdvd7_dvdaudio\ehtvlkxl.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Deu\pdvd7_dvdaudio\pdvd7_dvdaudio.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Deu\pdvd7_h264\pdvd7_h264.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Deu\pdvd7_h264\qvlnjwhk.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Deu\pdvd7_ia\pdvd7_ia.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Deu\pdvd7_ia\trtznlvt.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Deu\pdvd7_mpeg-la\pdvd7_mpeg-la.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Deu\pdvd7_mpeg-la\znhbjsrv.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Deu\pdvd7_nb\cxjrblsl.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Deu\pdvd7_nb\pdvd7_nb.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Enu\pdvd7_aac\pdvd7_aac.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Enu\pdvd7_aac\thnwxnlz.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Enu\pdvd7_cprm\pdvd7_cprm.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Enu\pdvd7_cprm\rwtbkcbb.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Enu\pdvd7_divx\bwkbhbck.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Enu\pdvd7_divx\pdvd7_divx.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Enu\pdvd7_dolby\pdvd7_dolby.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Enu\pdvd7_dolby\xkssleqc.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Enu\pdvd7_dolbyoem\pdvd7_dolbyoem.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Enu\pdvd7_dolbyoem\rjrneskc.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Enu\pdvd7_dts\pdvd7_dts.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Enu\pdvd7_dts\vjbsxzwb.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Enu\pdvd7_dts_es_neo\pdvd7_dts_es_neo.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Enu\pdvd7_dts_es_neo\zxbkhzte.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Enu\pdvd7_dvdaudio\pdvd7_dvdaudio.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Enu\pdvd7_dvdaudio\rbrzhhev.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Enu\pdvd7_h264\ltvslqbt.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Enu\pdvd7_h264\pdvd7_h264.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Enu\pdvd7_ia\kzqqrcwe.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Enu\pdvd7_ia\pdvd7_ia.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Enu\pdvd7_mpeg-la\pdvd7_mpeg-la.html Infected: Net-Worm.Win32.Allaple.a skipped D:\Program Files\CyberLink\PowerDVD\Language\Enu\pdvd7_mpeg-la\rtqchneh.exe Infected: Net-Worm.Win32.Allaple.e skipped D:\Program Files\CyberLink\PowerDVD\Language\Enu\pdvd7_nb\jnsnkble.exe Infected: Net-Worm.Win32.Allaple.e skipped