Spyware / Malware / Virus Removal

[Resolved]I've Been Hijacked, Please Help! Here Is My Log.

38 min read

Looking for the outcome? Ask AI

Davi Topic Starter

Post #1August 3, 2007, 2:36 PM UTC

I noticed a few weeks ago that I was being redirected to pages different from the actual pages I was trying to go to. I read up online about this new awful hijacking problem, and downloaded all suggested removal programs. None of them seemed to fix this problem. So i switched from internet explorer to Mozilla Firefox, and the problem disapperaed; however, i noticed once again that if I type a web address incorrectly it takes me to one of those pages (porn). I have followed all the instructions from the Hijackthis program. I would deeply appreciate help from someone who knows what this stuff means. Please contact me any way you can- my e-mail is [removed]. I will keep checking the forum for a response, very frantically.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:18:53 AM, on 8/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\NICServ.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~2\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O16 - DPF: {2B1AA38D-2D12-11D5-AAD0-00C04FA03D78} (LocalExec Control) - https://portal.cwu.edu/nps/portal/gadgets/c…t/LocalExec.CAB
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{54E8D6A5-A6CF-4953-B1AC-80BF1FD813D8}: NameServer = 85.255.114.196,85.255.112.149
O17 - HKLM\System\CCS\Services\Tcpip\..\{8FBD3DBA-27AD-40A8-9BB0-C8E898587668}: NameServer = 85.255.114.196,85.255.112.149
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.196 85.255.112.149
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.196 85.255.112.149
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.196 85.255.112.149
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICSer_WPC54GS - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\NICServ.exe

–
End of file - 3748 bytes

Scotty

Post #2August 3, 2007, 8:36 PM UTC

Hi! Welcome to the Tom Coyote forums.
My name is Scotty. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient and I'd be grateful if you would note the following:

I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for this issue on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.

Davi

Post #3August 6, 2007, 4:11 PM UTC

Ad-Aware 2007 Adobe Flash Player Plugin Adobe Reader 7.0.7 Adobe Shockwave Player Ahead InCD Ahead InCD EasyWrite Reader AOL Instant Messenger Apple Mobile Device Support Apple Software Update ATI Display Driver Conexant 56K ACLink Modem Digital Photo Album Deluxe Gregg College Keyboarding & Document Processing Home 10 HijackThis 2.0.2 Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows XP (KB926239) InterActual Player iPod for Windows 2006-06-28 IrfanView (remove only) iTunes Microsoft .NET Framework 1.1 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Office Excel MUI (English) 2007 Microsoft Office Home and Student 2007 Microsoft Office Home and Student 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft User-Mode Driver Framework Feature Pack 1.0 Mozilla Firefox (2.0.0.6) Nero - Burning Rom Principles of Radiographic Imaging QuickTime Radiography Examination Security Update for Excel 2007 (KB936509) Security Update for Office 2007 (KB934062) Security Update for Office 2007 (KB936514) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows Media Player 9 (KB911565) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899589) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901190) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB903235) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911567) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912812) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913446) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923694) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928090) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929123) Security Update for Windows XP (KB929969) Security Update for Windows XP (KB930178) Security Update for Windows XP (KB931261) Security Update for Windows XP (KB931768) Security Update for Windows XP (KB931784) Security Update for Windows XP (KB932168) Security Update for Windows XP (KB933566) Security Update for Windows XP (KB935839) Security Update for Windows XP (KB935840) Spybot - Search & Destroy 1.4 Update for Office 2007 (KB932080) Update for Office 2007 (KB934391) Update for Office 2007 (KB934393) Update for Windows XP (KB894391) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB908531) Update for Windows XP (KB910437) Update for Windows XP (KB911280) Update for Windows XP (KB916595) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB927891) Update for Windows XP (KB930916) Update for Windows XP (KB931836) Update for Word 2007 (KB934173) Windows Installer 3.1 (KB893803) Windows Live Messenger Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 11 Windows Media Player 11 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891781 Wireless-G Notebook Adapter with SpeedBooster

Scotty

Post #4August 6, 2007, 4:29 PM UTC

Hi Davi

You have no anti-virus on your computer. It is important you install one now before we continue with your fix. Check this out for a list of free AV scanners, AVG is highly recommended

Rename HijackThis
There is a possibility an infection which is hiding part of the HijackThis log because it's called hijackthis.exe.
Please rename hijackthis.exe to hello.exe

Download and Run FixWarout
Please download FixWareout from one of these sites:
http://downloads.subratam.org/Fixwareout.exe
http://www.bleepingcomputer.com/files/lonny/Fixwareout.exe

Save it to your desktop and run it. Click Next, then Install, then make sure "Run fixit" is checked and click Finish. The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal.

At the end of the fix, you may need to restart your computer again.

Remove bad HijackThis entries

Run HijackThis
Click on the Scan button
Put a check beside all of the items listed below (if present):

O17 - HKLM\System\CCS\Services\Tcpip\..\{54E8D6A5-A6CF-4953-B1AC-80BF1FD813D8}: NameServer = 85.255.114.196,85.255.112.149
O17 - HKLM\System\CCS\Services\Tcpip\..\{8FBD3DBA-27AD-40A8-9BB0-C8E898587668}: NameServer = 85.255.114.196,85.255.112.149
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.196 85.255.112.149
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.196 85.255.112.149
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.196 85.255.112.149
Close all open windows and browsers/email, etc…
Click on the "Fix Checked" button
When completed, close the application.

Finally, please post a fresh HijackThis log, along with the contents of the logfile C:\fixwareout\report.txt

Now lets check some settings on your system.
(2000/XP) Only
In the windows control panel. If you are using Windows XP's Category View, select the Network and Internet Connections category otherwise double click on Network Connections. Then right click on your default connection, usually local area connection for cable and dsl, and left click on properties. Click the Networking tab. Double-click on the Internet Protocol (TCP/IP) item and select the radio dial that says Obtain DNS servers automatically
Press OK twice to get out of the properties screen and reboot if it asks.
That option might not be avaiable on some systems
Next Go start run type cmd and hit OK
type
ipconfig /flushdns
then hit enter, type exit hit enter
(that space between g and / is needed)

Then post a new HijackThis log, please.

Davi

Post #5August 6, 2007, 10:42 PM UTC

I have renamed the HiJackthis to Hello.exe, next
I downloaded AVG, it found a threat on its own. It was called

Trojan horse PSW.Generic3.USU (In) C:\WINDOWS\system32\mppds.dll

So I clicked the "Heal" option and now it is under the "Virus Vault" portion of the program.
Next, I downloaded FixWareOut and it rebooted my system and opened this log once it was rebooted.

Username "Davi" - 2007-08-06 15:21:27 [Fixwareout edited 2007/07/05]

»»»»»Prerun check
HKLM\SOFTWARE\~\Winlogon\ "System"="kdxyd.exe"

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{2982084F-9372-4B40-A4B2-BDD1DF351DFD}
"DhcpNameServer"="[removed],[removed]" HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{54E8D6A5-A6CF-4953-B1AC-80BF1FD813D8}
"DhcpNameServer"="[removed],[removed]"
Successfully flushed the DNS Resolver Cache.

System was rebooted successfully.

»»»»» Postrun check
HKLM\SOFTWARE\~\Winlogon\ "system"=""
….
….
»»»»» Misc files.
….
»»»»» Checking for older varients.
….
»»»»» Other
C:\WINDOWS\Temp\kdxyd.ren 66444 08/04/2004

»»»»» Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
….
Hosts file was reset, If you use a custom hosts file please replace it
»»»»» End report »»»»»

Here is the new HijackThis scan log after i removed the entries you listed; however, I am afraid i only renamed the shortcut Hijackthis.exe to hello.exe, i cant seem to find the main file, but i am not sure.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:37:48 PM, on 8/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\NICServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Grisoft\AVG7\avgvv.exe
C:\WINDOWS\system32\mspaint.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Davi\My Documents\My Programs\HijackThis\hello.exe.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~2\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O16 - DPF: {2B1AA38D-2D12-11D5-AAD0-00C04FA03D78} (LocalExec Control) - https://portal.cwu.edu/nps/portal/gadgets/c…t/LocalExec.CAB
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICSer_WPC54GS - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\NICServ.exe

–
End of file - 4148 bytes

Davi

Post #6August 6, 2007, 10:49 PM UTC

Here is the new post after i ran the ipconfig /flushdns, sorry i forgot to do that step when i posted the last log. here is the final log i believe, after all the instructions. One more question, if it is fixed now, am i able to get rid of these ad-aware programs and spybot, and fixwareout since i have AVG or do i need to keep them all?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:42:01 PM, on 8/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\NICServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Grisoft\AVG7\avgvv.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Davi\My Documents\My Programs\HijackThis\hello.exe.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~2\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O16 - DPF: {2B1AA38D-2D12-11D5-AAD0-00C04FA03D78} (LocalExec Control) - https://portal.cwu.edu/nps/portal/gadgets/c…t/LocalExec.CAB
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICSer_WPC54GS - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\NICServ.exe

–
End of file - 4115 bytes

Scotty

Post #7August 6, 2007, 11:26 PM UTC

Hi Davi

Viruses and spyware are different things. Having an anti-virus and an anti-spyware monitor is a minimum to remain secure. As you have Spybot, when we have finished cleaning you up, I will tell you how to enable the Teatimer function which will protect your Registry from harmful changes. And as spyware scanners find different things, it's best to have a second for on-demand use. They do have to be updated manually though, at least once a week.

Please do an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings
In the scan settings make sure that the following are selected:
- Scan using the following Anti-Virus database:
  
  + Extended(If available otherwise Standard)
- Scan Options:
  
  + Scan Archives
  + Scan Mail Bases
Click OK
Now under select a target to scan select My Computer
The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button
Save the file to your desktop.
Copy and paste that information in your next post.

Davi

Post #8August 8, 2007, 11:02 PM UTC

Ok, I ran Kaspersky and It said i have 59 viruses!?! with 704 infected objects?! and 13 suspicious files?! Looks like this is more serious than I thought. There was no save as text option but there was Save Report As, and i picked text file. So here it is, hope this is what we're looking for. ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Wednesday, August 08, 2007 3:53:06 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.0 Kaspersky Anti-Virus database last update: 8/08/2007 Kaspersky Anti-Virus database records: 377249 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 58028 Number of viruses found: 59 Number of infected objects: 704 Number of suspicious objects: 13 Duration of the scan process: 02:30:13 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Broderbund Software\Print\The Print Shop\20.0\Books\Sender\Sender.abk Object is locked skipped C:\Documents and Settings\All Users\Application Data\Broderbund Software\Print\The Print Shop\20.0\PMWPRINT.INI Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cb9297cbbaa170c988a3eba886ef3705_38cd6b5e-f142-4475-a9ea-c1405a2b533b Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\avg7\Log\emc.log Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\Davi\Application Data\Mozilla\Firefox\Profiles\wdhncnjh.default\cert8.db Object is locked skipped C:\Documents and Settings\Davi\Application Data\Mozilla\Firefox\Profiles\wdhncnjh.default\history.dat Object is locked skipped C:\Documents and Settings\Davi\Application Data\Mozilla\Firefox\Profiles\wdhncnjh.default\key3.db Object is locked skipped C:\Documents and Settings\Davi\Application Data\Mozilla\Firefox\Profiles\wdhncnjh.default\parent.lock Object is locked skipped C:\Documents and Settings\Davi\Application Data\Mozilla\Firefox\Profiles\wdhncnjh.default\search.sqlite Object is locked skipped C:\Documents and Settings\Davi\Application Data\Mozilla\Firefox\Profiles\wdhncnjh.default\urlclassifier2.sqlite Object is locked skipped C:\Documents and Settings\Davi\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Davi\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Davi\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Davi\Local Settings\Application Data\Mozilla\Firefox\Profiles\wdhncnjh.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\Davi\Local Settings\Application Data\Mozilla\Firefox\Profiles\wdhncnjh.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\Davi\Local Settings\Application Data\Mozilla\Firefox\Profiles\wdhncnjh.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\Davi\Local Settings\Application Data\Mozilla\Firefox\Profiles\wdhncnjh.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\Davi\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Davi\Local Settings\Temp\~DFA8AC.tmp Object is locked skipped C:\Documents and Settings\Davi\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Davi\My Documents\My Programs\Asterisk Key\ariskkey.exe Infected: not-a-virus:PSWTool.Win32.Aster.55 skipped C:\Documents and Settings\Davi\ntuser.dat Object is locked skipped C:\Documents and Settings\Davi\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped C:\Program Files\Norton AntiVirus\Quarantine18F5AC5 Infected: Email-Worm.Win32.NetSky.d skipped C:\Program Files\Norton AntiVirus\Quarantine4BA2551/document.txt .exe Infected: Email-Worm.Win32.NetSky.q skipped C:\Program Files\Norton AntiVirus\Quarantine4BA2551 ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine4BA2551 CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine55A2EA1 Infected: Email-Worm.Win32.NetSky.q skipped C:\Program Files\Norton AntiVirus\Quarantine5C26E2E Infected: Email-Worm.Win32.NetSky.q skipped C:\Program Files\Norton AntiVirus\Quarantine5D827E3.tmp Infected: not-a-virus:AdWare.Win32.Wintol.p skipped C:\Program Files\Norton AntiVirus\Quarantine5EA3752/[From [removed]][Date Tue, 8 Jun 2004 09:35:24 -0700]/d4334938_dirk.zip/details.txt .pif Infected: Email-Worm.Win32.NetSky.q skipped C:\Program Files\Norton AntiVirus\Quarantine5EA3752/[From [removed]][Date Tue, 8 Jun 2004 09:35:24 -0700]/d4334938_dirk.zip Infected: Email-Worm.Win32.NetSky.q skipped C:\Program Files\Norton AntiVirus\Quarantine5EA3752 Mail: infected - 2 skipped C:\Program Files\Norton AntiVirus\Quarantine5EA3752 CryptFF: infected - 2 skipped C:\Program Files\Norton AntiVirus\Quarantine6000BE9 Infected: Email-Worm.Win32.NetSky.q skipped C:\Program Files\Norton AntiVirus\Quarantine62B7F0A/[From dick@hitbox[1].txt][Date Tue, 8 Jun 2004 12:40:18 -0700]/old_photos.pif Infected: Email-Worm.Win32.NetSky.q skipped C:\Program Files\Norton AntiVirus\Quarantine62B7F0A Mail: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine62B7F0A CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine6755BB4/[From [removed]][Date Fri, 21 May 2004 13:02:04 -0700]/details_dirk.txt Infected: Email-Worm.Win32.NetSky.q skipped C:\Program Files\Norton AntiVirus\Quarantine6755BB4 Mail: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine6755BB4 CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine6D74748/[From [removed]][Date Fri, 21 May 2004 13:28:09 -0700]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\Program Files\Norton AntiVirus\Quarantine6D74748/[From [removed]][Date Fri, 21 May 2004 13:28:09 -0700]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\Program Files\Norton AntiVirus\Quarantine6D74748/[From [removed]][Date Fri, 21 May 2004 13:28:09 -0700]/message.scr Infected: Email-Worm.Win32.NetSky.q skipped C:\Program Files\Norton AntiVirus\Quarantine6D74748 Mail: infected - 1, suspicious - 2 skipped C:\Program Files\Norton AntiVirus\Quarantine6D74748 CryptFF: infected - 1, suspicious - 2 skipped C:\Program Files\Norton AntiVirus\Quarantine95B77FC/epwas.exe Suspicious: Password-protected-EXE skipped C:\Program Files\Norton AntiVirus\Quarantine95B77FC ZIP: suspicious - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine95B77FC CryptFF: suspicious - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine9C6753A.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine9C6753A.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine9C6753A.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine9E13169 Infected: Email-Worm.Win32.Bagle.z skipped C:\Program Files\Norton AntiVirus\Quarantine9FA04AD.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine9FA04AD.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine9FA04AD.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\QuarantineA976400.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\QuarantineA976400.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\QuarantineA976400.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\QuarantineB962EE8.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\QuarantineB962EE8.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\QuarantineB962EE8.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\QuarantineBE55964.exe/UCMTSAIE.DLL Infected: not-a-virus:AdWare.Win32.Ucmore.a skipped C:\Program Files\Norton AntiVirus\QuarantineBE55964.exe/IUCMORE.DLL Infected: not-a-virus:AdWare.Win32.Ucmore skipped C:\Program Files\Norton AntiVirus\QuarantineBE55964.exe ZIP: infected - 2 skipped C:\Program Files\Norton AntiVirus\QuarantineBE55964.exe CryptFF: infected - 2 skipped C:\Program Files\Norton AntiVirus\QuarantineBEC2D5D.exe Infected: Trojan-Downloader.Win32.IstBar.go skipped C:\Program Files\Norton AntiVirus\QuarantineC1F1251.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\QuarantineC1F1251.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\QuarantineC1F1251.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\QuarantineC1F22A5.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\QuarantineC1F22A5.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\QuarantineC1F22A5.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\QuarantineC7A29EC.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\QuarantineC7A29EC.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\QuarantineC7A29EC.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\QuarantineC843836.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\QuarantineC843836.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\QuarantineC843836.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\QuarantineD23761E Infected: Trojan-Downloader.Win32.Wintrim.ag skipped C:\Program Files\Norton AntiVirus\QuarantineE31595B Infected: Net-Worm.Win32.Lovesan.a skipped C:\Program Files\Norton AntiVirus\QuarantineE744E49.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\QuarantineE744E49.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\QuarantineE744E49.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\QuarantineEBF13F6.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\QuarantineEBF13F6.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\QuarantineEBF13F6.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\QuarantineEFD31B2.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\QuarantineEFD31B2.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\QuarantineEFD31B2.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\QuarantineF357B75.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\QuarantineF357B75.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\QuarantineF357B75.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\QuarantineF76432D.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\QuarantineF76432D.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\QuarantineF76432D.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\QuarantineFB460E9.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\QuarantineFB460E9.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\QuarantineFB460E9.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\105E2851.dll Infected: not-a-virus:Dialer.Win32.E-Group.l skipped C:\Program Files\Norton AntiVirus\Quarantine\10823606.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\10823606.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\10823606.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\10BD29C6.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\10BD29C6.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\10BD29C6.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\10F71D85.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\10F71D85.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\10F71D85.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\1149372B.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\1149372B.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\1149372B.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\118754E7.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\118754E7.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\118754E7.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\11EC6A77.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\11EC6A77.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\11EC6A77.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\12200A3E.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\12200A3E.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\12200A3E.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\123744A8.exe Infected: Trojan.Win32.StartPage.aw skipped C:\Program Files\Norton AntiVirus\Quarantine\123A6EA4.exe Infected: Trojan.Win32.StartPage.aw skipped C:\Program Files\Norton AntiVirus\Quarantine\123D18A1.exe Infected: Trojan-Downloader.Win32.VB.cm skipped C:\Program Files\Norton AntiVirus\Quarantine\123D18A1.htm Infected: Trojan-Downloader.JS.Small.d skipped C:\Program Files\Norton AntiVirus\Quarantine\1241429D.php Infected: Trojan-Downloader.JS.IstBar.a skipped C:\Program Files\Norton AntiVirus\Quarantine\126251F6.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\126251F6.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\126251F6.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\126F4991/[From [removed]][Date Mon, 7 Jun 2004 17:24:42 -0700]/information_dirk.doc.pif Infected: Email-Worm.Win32.NetSky.q skipped C:\Program Files\Norton AntiVirus\Quarantine\126F4991 Mail: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\126F4991 CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\13C923E1.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\13C923E1.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\13C923E1.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\14805318.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\14805318.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\14805318.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\14E668A9.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\14E668A9.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\14E668A9.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\153A2C4B.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\153A2C4B.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\153A2C4B.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\159C17DF.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\159C17DF.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\159C17DF.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\15E75D8D.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\15E75D8D.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\15E75D8D.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\161F2750.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\161F2750.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\161F2750.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\165D450B.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\165D450B.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\165D450B.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\16AF5EB2.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\16AF5EB2.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\16AF5EB2.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\18150DFE Infected: Email-Worm.Win32.NetSky.d skipped C:\Program Files\Norton AntiVirus\Quarantine\18D3112D Infected: Email-Worm.Win32.NetSky.d skipped C:\Program Files\Norton AntiVirus\Quarantine\19E35524/1/exploit.htm Infected: Trojan-Downloader.VBS.Psyme.based skipped C:\Program Files\Norton AntiVirus\Quarantine\19E35524 CHM: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\19E35524 CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\1C00657B.php Infected: Trojan-Downloader.JS.IstBar.a skipped C:\Program Files\Norton AntiVirus\Quarantine\1CB613B2 Infected: Email-Worm.Win32.NetSky.d skipped C:\Program Files\Norton AntiVirus\Quarantine\1CEB3378 Infected: Email-Worm.Win32.NetSky.d skipped C:\Program Files\Norton AntiVirus\Quarantine\1D05035B Infected: Email-Worm.Win32.NetSky.d skipped C:\Program Files\Norton AntiVirus\Quarantine\1D12108E.tmp Infected: not-a-virus:AdWare.Win32.Wintol.p skipped C:\Program Files\Norton AntiVirus\Quarantine\1D653778.exe Infected: not-a-virus:AdWare.Win32.PowerScan.b skipped C:\Program Files\Norton AntiVirus\Quarantine\1D653778.php Infected: Trojan-Downloader.JS.IstBar.b skipped C:\Program Files\Norton AntiVirus\Quarantine\1D6A18EC Infected: Email-Worm.Win32.NetSky.d skipped C:\Program Files\Norton AntiVirus\Quarantine\1D9110C1 Infected: Email-Worm.Win32.NetSky.d skipped C:\Program Files\Norton AntiVirus\Quarantine\1F284961 Infected: Email-Worm.Win32.NetSky.d skipped C:\Program Files\Norton AntiVirus\Quarantine\23183F02/[From [removed][2].txt][Date Fri, 28 May 2004 09:36:20 -0700]/important.txt Infected: Email-Worm.Win32.NetSky.q skipped C:\Program Files\Norton AntiVirus\Quarantine\23183F02 Mail: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\23183F02 CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\239B7523.tmp Infected: not-a-virus:AdWare.Win32.Wintol.p skipped C:\Program Files\Norton AntiVirus\Quarantine\249A451B.tmp Infected: not-a-virus:AdWare.Win32.Wintol.p skipped C:\Program Files\Norton AntiVirus\Quarantine\29C1016D Infected: Email-Worm.Win32.Bagle.y skipped C:\Program Files\Norton AntiVirus\Quarantine\2DCE4643 Infected: Email-Worm.Win32.NetSky.d skipped C:\Program Files\Norton AntiVirus\Quarantine\2E223739.tmp Infected: not-a-virus:AdWare.Win32.Wintol.p skipped C:\Program Files\Norton AntiVirus\Quarantine\2E31497A.tmp Infected: Net-Worm.Win32.Mytob.x skipped C:\Program Files\Norton AntiVirus\Quarantine\30580327.exe Infected: Trojan-Downloader.Win32.IstBar.gen skipped C:\Program Files\Norton AntiVirus\Quarantine\305B2D24.dll Infected: Trojan-Downloader.Win32.IstBar.dh skipped C:\Program Files\Norton AntiVirus\Quarantine\305E5720.exe Infected: Trojan-Downloader.Win32.IstBar.ga skipped C:\Program Files\Norton AntiVirus\Quarantine\3062011D.exe Infected: not-a-virus:AdWare.Win32.PowerScan.b skipped C:\Program Files\Norton AntiVirus\Quarantine\30652B19.exe Infected: not-a-virus:AdWare.Win32.PowerScan.b skipped C:\Program Files\Norton AntiVirus\Quarantine\30652B19.php Infected: Trojan-Downloader.JS.IstBar.a skipped C:\Program Files\Norton AntiVirus\Quarantine\30685515.dll Infected: not-a-virus:AdWare.Win32.SideFind skipped C:\Program Files\Norton AntiVirus\Quarantine\30685515.exe Infected: Trojan-Downloader.Win32.IstBar.gen skipped C:\Program Files\Norton AntiVirus\Quarantine\306B7F12.exe Infected: Trojan-Downloader.Win32.IstBar.gen skipped C:\Program Files\Norton AntiVirus\Quarantine\3072530B.dll Infected: not-a-virus:AdWare.Win32.SideFind skipped C:\Program Files\Norton AntiVirus\Quarantine\3072530B.exe Infected: Trojan-Downloader.Win32.IstBar.gen skipped C:\Program Files\Norton AntiVirus\Quarantine\3192691A/[From [removed]][Date Mon, 24 May 2004 16:13:10 -0700]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\Program Files\Norton AntiVirus\Quarantine\3192691A/[From [removed]][Date Mon, 24 May 2004 16:13:10 -0700]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\Program Files\Norton AntiVirus\Quarantine\3192691A/[From [removed]][Date Mon, 24 May 2004 16:13:10 -0700]/message.scr Infected: Email-Worm.Win32.NetSky.q skipped C:\Program Files\Norton AntiVirus\Quarantine\3192691A Mail: infected - 1, suspicious - 2 skipped C:\Program Files\Norton AntiVirus\Quarantine\3192691A CryptFF: infected - 1, suspicious - 2 skipped C:\Program Files\Norton AntiVirus\Quarantine\31FD52A4/[From [removed]][Date Mon, 24 May 2004 16:24:31 -0700]/letter.scr Infected: Email-Worm.Win32.NetSky.q skipped C:\Program Files\Norton AntiVirus\Quarantine\31FD52A4 Mail: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\31FD52A4 CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\330007B2.tmp Infected: Email-Worm.Win32.Sober.p skipped C:\Program Files\Norton AntiVirus\Quarantine\33671DE5 Infected: Email-Worm.Win32.NetSky.d skipped C:\Program Files\Norton AntiVirus\Quarantine\339569B3 Infected: Email-Worm.Win32.NetSky.d skipped C:\Program Files\Norton AntiVirus\Quarantine\34E22444/zizhhq.scr Infected: Email-Worm.Win32.Mydoom.e skipped C:\Program Files\Norton AntiVirus\Quarantine\34E22444 ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\34E22444 CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\379236B2 Infected: Email-Worm.Win32.NetSky.d skipped C:\Program Files\Norton AntiVirus\Quarantine\37A5378C Infected: Email-Worm.Win32.NetSky.d skipped C:\Program Files\Norton AntiVirus\Quarantine\390231D7.php Infected: Trojan-Downloader.JS.IstBar.a skipped C:\Program Files\Norton AntiVirus\Quarantine\39BB100B Infected: Email-Worm.Win32.NetSky.d skipped C:\Program Files\Norton AntiVirus\Quarantine\3AFB2074.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\3AFB2074.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3AFB2074.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3B646001.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\3B646001.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3B646001.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3BAF25AE.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\3BAF25AE.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3BAF25AE.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3BF06D67.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\3BF06D67.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3BF06D67.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3C3B3314.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\3C3B3314.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3C3B3314.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3C643B8E Infected: Email-Worm.Win32.NetSky.d skipped C:\Program Files\Norton AntiVirus\Quarantine\3C737CD7.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\3C737CD7.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3C737CD7.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3CAE7096.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\3CAE7096.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3CAE7096.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3CF2624B.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\3CF2624B.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3CF2624B.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3D2943AF Infected: Email-Worm.Win32.NetSky.aa skipped C:\Program Files\Norton AntiVirus\Quarantine\3D300006.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\3D300006.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3D300006.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3D6E1DC2.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\3D6E1DC2.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3D6E1DC2.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3DFB2B28.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\3DFB2B28.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3DFB2B28.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3E361EE7.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\3E361EE7.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3E361EE7.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3E6D68AA.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\3E6D68AA.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3E6D68AA.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3EB5045B.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\3EB5045B.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3EB5045B.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3F1339A5.exe Infected: Trojan-Downloader.Win32.IstBar.gn skipped C:\Program Files\Norton AntiVirus\Quarantine\3F1663A1.exe Infected: Trojan-Downloader.Win32.IstBar.gn skipped C:\Program Files\Norton AntiVirus\Quarantine\3FE32392 Infected: Net-Worm.Win32.Welchia.a skipped C:\Program Files\Norton AntiVirus\Quarantine\405B6E7D.tmp Infected: not-a-virus:AdWare.Win32.Wintol.p skipped C:\Program Files\Norton AntiVirus\Quarantine\407B5067.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\407B5067.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\407B5067.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\40C0421C.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\40C0421C.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\40C0421C.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\420818B0.dll Infected: not-a-virus:AdWare.Win32.Dotcom.a skipped C:\Program Files\Norton AntiVirus\Quarantine\425612F0.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\425612F0.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\425612F0.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\425B6C57.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\425B6C57.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\425B6C57.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\42966016.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\42966016.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\42966016.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\429B04A5.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\429B04A5.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\429B04A5.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\42D47DD2.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\42D47DD2.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\42D47DD2.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\42ED1E4B.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\42ED1E4B.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\42ED1E4B.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\4315458A.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\4315458A.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\4315458A.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\434835E6.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\434835E6.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\434835E6.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\43496551.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\43496551.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\43496551.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\438E5705.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\438E5705.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\438E5705.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\43905197.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\43905197.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\43905197.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\43D348BA.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\43D348BA.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\43D348BA.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\440A127D.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\440A127D.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\440A127D.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\443B0847.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\443B0847.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\443B0847.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\44792602.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\44792602.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\44792602.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\44BA6DBB.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\44BA6DBB.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\44BA6DBB.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\44EB6385.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\44EB6385.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\44EB6385.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\45232D48.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\45232D48.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\45232D48.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\455E2107.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\455E2107.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\455E2107.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\46047E50.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\46047E50.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\46047E50.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\463F720F.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\463F720F.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\463F720F.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\467A65CE.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\467A65CE.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\467A65CE.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\46BB2D86.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\46BB2D86.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\46BB2D86.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\46EF4D4D.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\46EF4D4D.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\46EF4D4D.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\47311505.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\47311505.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\47311505.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\476534CB.tmp/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k skipped C:\Program Files\Norton AntiVirus\Quarantine\476534CB.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\476534CB.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\4B57392D.tmp Infected: Email-Worm.Win32.Bagle.au skipped C:\Program Files\Norton AntiVirus\Quarantine\4B983E5B.exe Infected: Trojan-Downloader.Win32.Dyfuca.cr skipped C:\Program Files\Norton AntiVirus\Quarantine\4B9B6857.dll Infected: Trojan-Downloader.Win32.IstBar.fz skipped C:\Program Files\Norton AntiVirus\Quarantine\4BA23C50.exe Infected: Trojan-Downloader.Win32.IstBar.go skipped C:\Program Files\Norton AntiVirus\Quarantine\4BA81049.exe Infected: Trojan-Downloader.Win32.IstBar.gm skipped C:\Program Files\Norton AntiVirus\Quarantine\4BAB3A46.dll Infected: Trojan-Downloader.Win32.Dyfuca.gen skipped C:\Program Files\Norton AntiVirus\Quarantine\4BAB3A46.exe Infected: Trojan-Downloader.Win32.Dyfuca.dk skipped C:\Program Files\Norton AntiVirus\Quarantine\4BAF6442.exe Infected: Trojan-Downloader.Win32.Dyfuca.dk skipped C:\Program Files\Norton AntiVirus\Quarantine\4BB86237.exe Infected: Trojan-Downloader.Win32.Lookme.g skipped C:\Program Files\Norton AntiVirus\Quarantine\4BB97690.exe/data0001.cab/VVSN.exe Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped C:\Program Files\Norton AntiVirus\Quarantine\4BB97690.exe/data0001.cab Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped C:\Program Files\Norton AntiVirus\Quarantine\4BB97690.exe Embedded CAB: infected - 2 skipped C:\Program Files\Norton AntiVirus\Quarantine\4BB97690.exe CryptFF: infected - 2 skipped C:\Program Files\Norton AntiVirus\Quarantine\4BBC0C34.dll Infected: Trojan-Downloader.Win32.Dyfuca.dc skipped C:\Program Files\Norton AntiVirus\Quarantine\4BBC0C34.exe/data0001.cab/VVSN.exe Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped C:\Program Files\Norton AntiVirus\Quarantine\4BBC0C34.exe/data0001.cab Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped C:\Program Files\Norton AntiVirus\Quarantine\4BBC0C34.exe Embedded CAB: infected - 2 skipped C:\Program Files\Norton AntiVirus\Quarantine\4BBC0C34.exe CryptFF: infected - 2 skipped C:\Program Files\Norton AntiVirus\Quarantine\4BC2602C.tmp Infected: not-a-virus:AdWare.Win32.Wintol.p skipped C:\Program Files\Norton AntiVirus\Quarantine\4BC50A29.tmp Infected: not-a-virus:AdWare.Win32.Wintol.p skipped C:\Program Files\Norton AntiVirus\Quarantine\4BC93425.tmp Infected: not-a-virus:AdWare.Win32.Wintol.p skipped C:\Program Files\Norton AntiVirus\Quarantine\4C83630E.tmp Infected: not-a-virus:AdWare.Win32.Wintol.p skipped C:\Program Files\Norton AntiVirus\Quarantine\4D25117B.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\4D25117B.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\4D25117B.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\4DB548DD.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\4DB548DD.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\4DB548DD.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\4DD816B6.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\4DD816B6.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\4DD816B6.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\4DEC12A0.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\4DEC12A0.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\4DEC12A0.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\4DF61095.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\4DF61095.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\4DF61095.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\4E066283.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\4E066283.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\4E066283.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\4EB313C5.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\4EB313C5.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\4EB313C5.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\50314421.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\50314421.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\50314421.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\50A057A6.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\50A057A6.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\50A057A6.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\50DB4B66.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\50DB4B66.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\50DB4B66.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\50E371CF Infected: Email-Worm.Win32.NetSky.d skipped C:\Program Files\Norton AntiVirus\Quarantine\50F2714D.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\50F2714D.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\50F2714D.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\50FF193E.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\50FF193E.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\50FF193E.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\51131529.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\51131529.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\51131529.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\518B26A4.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\518B26A4.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\518B26A4.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\535279A5.exe Infected: Trojan-Downloader.Win32.IstBar.gn skipped C:\Program Files\Norton AntiVirus\Quarantine\54204EC3.exe Infected: Trojan-Downloader.Win32.IstBar.gn skipped C:\Program Files\Norton AntiVirus\Quarantine\54A2573E.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\54A2573E.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\54A2573E.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\54CC790F.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\54CC790F.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\54CC790F.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\54E31EF6.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\54E31EF6.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\54E31EF6.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\54EE23E1.exe Infected: Trojan-Downloader.Win32.IstBar.gn skipped C:\Program Files\Norton AntiVirus\Quarantine\54F046E8.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\54F046E8.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\54F046E8.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\54FA44DD.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\54FA44DD.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\54FA44DD.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\550A16CB.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\550A16CB.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\550A16CB.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\555F5A6E.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\555F5A6E.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\555F5A6E.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\55696CA3.htm Infected: Trojan-Downloader.JS.Small.d skipped C:\Program Files\Norton AntiVirus\Quarantine\55BC78FE.exe Infected: Trojan-Downloader.Win32.IstBar.gn skipped C:\Program Files\Norton AntiVirus\Quarantine\56402B76.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\56402B76.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\56402B76.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\565E2555.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\565E2555.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\565E2555.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5696760D.exe Infected: Trojan-Downloader.Win32.IstBar.gn skipped C:\Program Files\Norton AntiVirus\Quarantine\56A96B03.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\56A96B03.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\56A96B03.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\56C010E9.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\56C010E9.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\56C010E9.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\56DA60CD.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\56DA60CD.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\56DA60CD.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\56F75AAC.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\56F75AAC.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\56F75AAC.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5725267A.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5725267A.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5725267A.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\572973E7.dll Infected: not-a-virus:Dialer.Win32.E-Group.h skipped C:\Program Files\Norton AntiVirus\Quarantine\57464A56.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\57464A56.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\57464A56.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\574A328F.tmp Infected: not-a-virus:AdWare.Win32.Wintol.p skipped C:\Program Files\Norton AntiVirus\Quarantine\5761212F.exe Infected: Trojan-Downloader.Win32.IstBar.gn skipped C:\Program Files\Norton AntiVirus\Quarantine\57634436.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\57634436.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\57634436.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\576D422B.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\576D422B.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\576D422B.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\57774020.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\57774020.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\57774020.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\57813E15.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\57813E15.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\57813E15.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\578A3C0B.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\578A3C0B.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\578A3C0B.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\579B0DF9.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\579B0DF9.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\579B0DF9.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\57A40BEE.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\57A40BEE.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\57A40BEE.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\57B55DDC.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\57B55DDC.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\57B55DDC.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\57BF5BD1.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\57BF5BD1.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\57BF5BD1.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\57CC03C3.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\57CC03C3.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\57CC03C3.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\57D257BC.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\57D257BC.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\57D257BC.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\57DC55B1.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\57DC55B1.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\57DC55B1.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\57EC279F.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\57EC279F.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\57EC279F.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\57F62594.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\57F62594.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\57F62594.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\58002389.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\58002389.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\58002389.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\580D4B7B.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\580D4B7B.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\580D4B7B.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\58174970.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\58174970.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\58174970.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\58247162.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\58247162.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\58247162.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\58322049.exe Infected: Trojan-Downloader.Win32.IstBar.gn skipped C:\Program Files\Norton AntiVirus\Quarantine\5844153E.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5844153E.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5844153E.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5855672C.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5855672C.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5855672C.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\58A356D6.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\58A356D6.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\58A356D6.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\58AB579E.tmp Infected: not-a-virus:AdWare.Win32.Wintol.p skipped C:\Program Files\Norton AntiVirus\Quarantine\58EB7287.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\58EB7287.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\58EB7287.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\59007566.exe Infected: Trojan-Downloader.Win32.IstBar.gn skipped C:\Program Files\Norton AntiVirus\Quarantine\5905426A.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5905426A.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5905426A.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\590F405F.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\590F405F.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\590F405F.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\591F124D.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\591F124D.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\591F124D.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\59266646.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\59266646.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\59266646.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\59330E37.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\59330E37.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\59330E37.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\593D0C2D.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\593D0C2D.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\593D0C2D.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\594A341E.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\594A341E.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\594A341E.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\59533214.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\59533214.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\59533214.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\595A060C.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\595A060C.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\595A060C.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\59672DFE.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\59672DFE.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\59672DFE.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\597455F0.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\597455F0.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\597455F0.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\597E53E5.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\597E53E5.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\597E53E5.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\598851DA.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\598851DA.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\598851DA.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\599579CC.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\599579CC.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\599579CC.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\59A875B6.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\59A875B6.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\59A875B6.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\59B51DA8.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\59B51DA8.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\59B51DA8.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\59C66F96.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\59C66F96.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\59C66F96.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\59CD4A84.exe Infected: Trojan-Downloader.Win32.IstBar.gn skipped C:\Program Files\Norton AntiVirus\Quarantine\59D31787.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\59D31787.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\59D31787.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\59D96B80.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\59D96B80.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\59D96B80.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\59E36975.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\59E36975.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\59E36975.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\59ED676B.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\59ED676B.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\59ED676B.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\59FA0F5C.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\59FA0F5C.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\59FA0F5C.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A0E0B47.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5A0E0B47.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A0E0B47.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A1B3338.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5A1B3338.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A1B3338.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A285B2A.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5A285B2A.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A285B2A.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A32591F.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5A32591F.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A32591F.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A3B5714.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5A3B5714.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A3B5714.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A487F06.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5A487F06.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A487F06.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A5C7AF0.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5A5C7AF0.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A5C7AF0.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A6922E2.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5A6922E2.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A6922E2.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A7320D7.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5A7320D7.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A7320D7.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A8048C9.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5A8048C9.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A8048C9.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A8A46BE.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5A8A46BE.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A8A46BE.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A976EB0.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5A976EB0.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A976EB0.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A9B1FA1.exe Infected: Trojan-Downloader.Win32.IstBar.gn skipped C:\Program Files\Norton AntiVirus\Quarantine\5AA7409E.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5AA7409E.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5AA7409E.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5AB7128C.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5AB7128C.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5AB7128C.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5AC43A7D.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5AC43A7D.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5AC43A7D.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5AD2626F.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5AD2626F.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5AD2626F.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5ADB6064.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5ADB6064.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5ADB6064.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5AE469D5 Infected: Email-Worm.Win32.NetSky.d skipped C:\Program Files\Norton AntiVirus\Quarantine\5AEC3252.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5AEC3252.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5AEC3252.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5AF95A44.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5AF95A44.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5AF95A44.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5B060236.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5B060236.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5B060236.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5B10002B.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5B10002B.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5B10002B.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5B205219.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5B205219.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5B205219.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5B26318D Infected: Email-Worm.Win32.NetSky.d skipped C:\Program Files\Norton AntiVirus\Quarantine\5B344E03.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5B344E03.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5B344E03.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5B5471DF.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5B5471DF.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5B5471DF.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5B5E6FD5.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5B5E6FD5.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5B5E6FD5.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5B6B17C6.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped C:\Program Files\Norton AntiVirus\Quarantine\5B6B17C6.tmp ZIP: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5B6B17C6.tmp CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5D8D188C.tmp Infected: not-a-virus:AdWare.Win32.Wintol.p skipped C:\Program Files\Norton AntiVirus\Quarantine\5E712E55.tmp Infected: not-a-virus:AdWare.Win32.Wintol.p skipped C:\Program Files\Norton AntiVirus\Quarantine\5FB41056.CHM/exploit.htm Infected: Trojan-Downloader.VBS.Psyme.p skipped C:\Program Files\Norton AntiVirus\Quarantine\5FB41056.CHM CHM: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\5FB41056.CHM CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\632D1577.dll Infected: not-a-virus:AdWare.Win32.SideFind skipped C:\Program Files\Norton AntiVirus\Quarantine\641A5D1F.tmp Infected: not-a-virus:AdWare.Win32.Wintol.p skipped C:\Program Files\Norton AntiVirus\Quarantine\69F72516/kqvkyc.exe Suspicious: Password-protected-EXE skipped C:\Program Files\Norton AntiVirus\Quarantine\69F72516 ZIP: suspicious - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\69F72516 CryptFF: suspicious - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\6A4C68B8 Infected: Email-Worm.Win32.Bagle.z skipped C:\Program Files\Norton AntiVirus\Quarantine\6A865C78/aoywcsxs.exe Suspicious: Password-protected-EXE skipped C:\Program Files\Norton AntiVirus\Quarantine\6A865C78 ZIP: suspicious - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\6A865C78 CryptFF: suspicious - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\6BCA582D.tmp Infected: Email-Worm.Win32.Sober.n skipped C:\Program Files\Norton AntiVirus\Quarantine\6C266FC9.tmp Infected: Email-Worm.Win32.Sober.n skipped C:\Program Files\Norton AntiVirus\Quarantine\6CF01AEA.tmp Infected: Email-Worm.Win32.Bagle.bn skipped C:\Program Files\Norton AntiVirus\Quarantine\6F805F4D Infected: Email-Worm.Win32.Bagle.as skipped C:\Program Files\Norton AntiVirus\Quarantine\70033928 Infected: Email-Worm.Win32.NetSky.d skipped C:\Program Files\Norton AntiVirus\Quarantine\705552CE Infected: Email-Worm.Win32.NetSky.d skipped C:\Program Files\Norton AntiVirus\Quarantine\706E5847 Infected: Email-Worm.Win32.Bagle.as skipped C:\Program Files\Norton AntiVirus\Quarantine\70921F7B.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.BargainBuddy.l skipped C:\Program Files\Norton AntiVirus\Quarantine\70921F7B.exe/stream/data0002 Infected: not-a-virus:AdWare.Win32.BargainBuddy.j skipped C:\Program Files\Norton AntiVirus\Quarantine\70921F7B.exe/stream/data0003 Infected: not-a-virus:AdWare.Win32.BargainBuddy.n skipped C:\Program Files\Norton AntiVirus\Quarantine\70921F7B.exe/stream/data0005/stream/data0002 Infected: not-a-virus:AdWare.Win32.BargainBuddy.y skipped C:\Program Files\Norton AntiVirus\Quarantine\70921F7B.exe/stream/data0005/stream/data0005 Infected: not-a-virus:AdWare.Win32.BargainBuddy.i skipped C:\Program Files\Norton AntiVirus\Quarantine\70921F7B.exe/stream/data0005/stream Infected: not-a-virus:AdWare.Win32.BargainBuddy.i skipped C:\Program Files\Norton AntiVirus\Quarantine\70921F7B.exe/stream/data0005 Infected: not-a-virus:AdWare.Win32.BargainBuddy.i skipped C:\Program Files\Norton AntiVirus\Quarantine\70921F7B.exe/stream Infected: not-a-virus:AdWare.Win32.BargainBuddy.i skipped C:\Program Files\Norton AntiVirus\Quarantine\70921F7B.exe NSIS: infected - 8 skipped C:\Program Files\Norton AntiVirus\Quarantine\70921F7B.exe CryptFF: infected - 8 skipped C:\Program Files\Norton AntiVirus\Quarantine\70954978.dll Infected: not-a-virus:AdWare.Win32.Dotcom.a skipped C:\Program Files\Norton AntiVirus\Quarantine\70954978.exe Infected: Trojan-Downloader.Win32.QDown.m skipped C:\Program Files\Norton AntiVirus\Quarantine\70997374.dll Infected: Trojan-Downloader.Win32.Wintrim.bb skipped C:\Program Files\Norton AntiVirus\Quarantine\70997374.exe Infected: Trojan-Downloader.Win32.Wintrim.aj skipped C:\Program Files\Norton AntiVirus\Quarantine\709C1D71.dll Infected: not-a-virus:AdWare.Win32.Dotcom.a skipped C:\Program Files\Norton AntiVirus\Quarantine\709C1D71.exe/data0003/data0001 Infected: not-a-virus:AdWare.Win32.WebRebates.g skipped C:\Program Files\Norton AntiVirus\Quarantine\709C1D71.exe/data0003 Infected: not-a-virus:AdWare.Win32.WebRebates.g skipped C:\Program Files\Norton AntiVirus\Quarantine\709C1D71.exe/data0003 Infected: not-a-virus:AdWare.Win32.WebRebates.d skipped C:\Program Files\Norton AntiVirus\Quarantine\709C1D71.exe/data0004 Infected: not-a-virus:AdWare.Win32.WebRebates.d skipped C:\Program Files\Norton AntiVirus\Quarantine\709C1D71.exe/data0005 Infected: not-a-virus:AdWare.Win32.WebRebates.c skipped C:\Program Files\Norton AntiVirus\Quarantine\709C1D71.exe NSIS: infected - 5 skipped C:\Program Files\Norton AntiVirus\Quarantine\709C1D71.exe CryptFF: infected - 5 skipped C:\Program Files\Norton AntiVirus\Quarantine\70C632F4.exe Infected: Trojan-Downloader.Win32.IstBar.gn skipped C:\Program Files\Norton AntiVirus\Quarantine\71905E15.exe Infected: Trojan-Downloader.Win32.IstBar.gn skipped C:\Program Files\Norton AntiVirus\Quarantine\725E3333.exe Infected: Trojan-Downloader.Win32.IstBar.gn skipped C:\Program Files\Norton AntiVirus\Quarantine\732C0850.exe Infected: Trojan-Downloader.Win32.IstBar.gn skipped C:\Program Files\Norton AntiVirus\Quarantine\73F95D6E.exe Infected: Trojan-Downloader.Win32.IstBar.gn skipped C:\Program Files\Norton AntiVirus\Quarantine\7423771F.htm Infected: Trojan-Downloader.JS.Small.d skipped C:\Program Files\Norton AntiVirus\Quarantine\74C7328C.exe Infected: Trojan-Downloader.Win32.IstBar.gn skipped C:\Program Files\Norton AntiVirus\Quarantine\759831A6.exe Infected: Trojan-Downloader.Win32.IstBar.gn skipped C:\Program Files\Norton AntiVirus\Quarantine\766606C3.exe Infected: Trojan-Downloader.Win32.IstBar.gn skipped C:\Program Files\Norton AntiVirus\Quarantine\76926B46 Infected: Email-Worm.Win32.NetSky.d skipped C:\Program Files\Norton AntiVirus\Quarantine\76E956C3 Infected: Email-Worm.Win32.NetSky.d skipped C:\Program Files\Norton AntiVirus\Quarantine\771A4C8D Infected: Email-Worm.Win32.NetSky.d skipped C:\Program Files\Norton AntiVirus\Quarantine\77345BE1.exe Infected: Trojan-Downloader.Win32.IstBar.gn skipped C:\Program Files\Norton AntiVirus\Quarantine\780130FE.exe Infected: Trojan-Downloader.Win32.IstBar.gn skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{7E3F745F-B3EF-4B96-8D99-FBC810797C6C}\RP250\A0021399.dll Object is locked skipped C:\System Volume Information\_restore{7E3F745F-B3EF-4B96-8D99-FBC810797C6C}\RP250\A0021404.dll Object is locked skipped C:\System Volume Information\_restore{7E3F745F-B3EF-4B96-8D99-FBC810797C6C}\RP255\A0021534.dll Object is locked skipped C:\System Volume Information\_restore{7E3F745F-B3EF-4B96-8D99-FBC810797C6C}\RP256\A0021815.dll Object is locked skipped C:\System Volume Information\_restore{7E3F745F-B3EF-4B96-8D99-FBC810797C6C}\RP263\A0021898.dll Object is locked skipped C:\System Volume Information\_restore{7E3F745F-B3EF-4B96-8D99-FBC810797C6C}\RP264\A0021917.dll Object is locked skipped C:\System Volume Information\_restore{7E3F745F-B3EF-4B96-8D99-FBC810797C6C}\RP264\A0022437.exe Object is locked skipped C:\System Volume Information\_restore{7E3F745F-B3EF-4B96-8D99-FBC810797C6C}\RP264\A0022450.dll Object is locked skipped C:\System Volume Information\_restore{7E3F745F-B3EF-4B96-8D99-FBC810797C6C}\RP266\A0023166.dll Object is locked skipped C:\System Volume Information\_restore{7E3F745F-B3EF-4B96-8D99-FBC810797C6C}\RP266\A0023567.dll Object is locked skipped C:\System Volume Information\_restore{7E3F745F-B3EF-4B96-8D99-FBC810797C6C}\RP267\A0023572.dll Object is locked skipped C:\System Volume Information\_restore{7E3F745F-B3EF-4B96-8D99-FBC810797C6C}\RP267\A0024708.exe Object is locked skipped C:\System Volume Information\_restore{7E3F745F-B3EF-4B96-8D99-FBC810797C6C}\RP267\A0024868.dll Object is locked skipped C:\System Volume Information\_restore{7E3F745F-B3EF-4B96-8D99-FBC810797C6C}\RP268\A0024996.dll Object is locked skipped C:\System Volume Information\_restore{7E3F745F-B3EF-4B96-8D99-FBC810797C6C}\RP275\A0025238.dll Object is locked skipped C:\System Volume Information\_restore{7E3F745F-B3EF-4B96-8D99-FBC810797C6C}\RP283\A0026236.dll Object is locked skipped C:\System Volume Information\_restore{7E3F745F-B3EF-4B96-8D99-FBC810797C6C}\RP285\A0026594.dll Object is locked skipped C:\System Volume Information\_restore{7E3F745F-B3EF-4B96-8D99-FBC810797C6C}\RP291\A0026692.dll Infected: not-a-virus:PSWTool.Win32.Aster.55 skipped C:\System Volume Information\_restore{7E3F745F-B3EF-4B96-8D99-FBC810797C6C}\RP293\A0027685.dll Object is locked skipped C:\System Volume Information\_restore{7E3F745F-B3EF-4B96-8D99-FBC810797C6C}\RP293\A0027692.exe Object is locked skipped C:\System Volume Information\_restore{7E3F745F-B3EF-4B96-8D99-FBC810797C6C}\RP293\A0027697.exe Object is locked skipped C:\System Volume Information\_restore{7E3F745F-B3EF-4B96-8D99-FBC810797C6C}\RP293\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped C:\WINDOWS\system32\config\OSession.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed.

Scotty

Post #9August 9, 2007, 12:07 PM UTC

Hi davi

First of all, did you install Asterisk Key yourself?

Secondly, open up Norton and go into Quarantine. Delete everything in there.

Download Superantispyware (SAS) free home version.

SAS Free

Install it and double-click the icon on your desktop to run it.
· It will ask if you want to update the program definitions, click Yes.
· Under Configuration and Preferences, click the Preferences button.
· Click the Scanning Control tab.
· Under Scanner Options make sure the following are checked:

Close browsers before scanning
Scan for tracking cookies
Terminate memory threats before quarantining.
Please leave the others unchecked.
Click the Close button to leave the control center screen.

· On the main screen, under Scan for Harmful Software click Scan your computer.
· On the left check C:\Fixed Drive.
· On the right, under Complete Scan, choose Perform Complete Scan.
· Click Next to start the scan. Please be patient while it scans your computer.
· After the scan is complete a summary box will appear. Click OK.
· Make sure everything in the white box has a check next to it, then click Next.
· It will quarantine what it found and if it asks if you want to reboot, click Yes.
· To retrieve the removal information for me please do the following:

After reboot, double-click the SUPERAntispyware icon on your desktop.
Click Preferences. Click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
It will open in your default text editor (such as Notepad/Wordpad).
Please highlight everything in the notepad, then right-click and choose copy.

· Click close and close again to exit the program.
· Please paste that information here for me with a new HijackThis log.

Davi

Post #10August 9, 2007, 4:52 PM UTC

Hey Mac,

I did download asterisk key myself to retrieve an old wireless network password quite a while ago. Havent used it since, i can remove it if it is harmful. While the SuperAntiSpyware scan was running, AVG kept finding threats during the scan so i just clicked heal, hope this didnt interfere with anything. Here is the SuperAntiSpyware log, and the new Hijack this log. Thanks

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 08/09/2007 at 09:27 AM

Application Version : 3.9.1008

Core Rules Database Version : 3282
Trace Rules Database Version: 1293

Scan type : Complete Scan
Total Scan Time : 01:05:27

Memory items scanned : 397
Memory threats detected : 0
Registry items scanned : 4655
Registry threats detected : 0
File items scanned : 34186
File threats detected : 2

Adware.Tracking Cookie
C:\Documents and Settings\Davi\Cookies\davi@atdmt[2].txt
C:\Documents and Settings\Davi\Cookies\davi@revsci[2].txt

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:48:24 AM, on 8/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\NICServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Grisoft\AVG7\avgw.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Davi\My Documents\My Programs\HijackThis\hello.exe.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~2\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {2B1AA38D-2D12-11D5-AAD0-00C04FA03D78} (LocalExec Control) - https://portal.cwu.edu/nps/portal/gadgets/c…t/LocalExec.CAB
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICSer_WPC54GS - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\NICServ.exe

–
End of file - 4383 bytes

Scotty

Post #11August 9, 2007, 5:12 PM UTC

Hi davi

Asterisk Key is only bad in the wrong hands, for example, if you are on a shared computer, and someone else installed it to find out your passwords.

Navigate to and delete the following files and/or folders (if they are present):

Folders:
C:\Fixwareout

And if there is an icon or folder on your Desktop belonging to Wareout, delete that too.

Go to Start>Control Panel>Add/Remove Programs, and remove the entry for the Kaspersky Scan.

I would advise updating Adobe Reader, as the latest version clears up any vulnerabilities of previous versions.
First uninstall the version you have on your computer then download and install Adobe Reader 8.1.

Run HijackThis, select Do a system scan only and place checks against the following entries (if they are still present):

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab

WITH ALL OTHER WINDOWS CLOSED Click on Fix Checked and exit HijackThis.

You obviously still have remains of Norton on your computer, and could affect AVG. Download the Norton Removal Tool and run it.

Finally, post back with a new HijackThis log.

Davi

Post #12August 9, 2007, 7:44 PM UTC

Ok, ran norton uninstall tool, followed all the other directions, and here is the newest Hijackthis log. I still see the searchassistant and customize search under R0, is that supose to be there?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:39:13 PM, on 8/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\NICServ.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Davi\My Documents\My Programs\HijackThis\hello.exe.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~2\SDHelper.dll
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O16 - DPF: {2B1AA38D-2D12-11D5-AAD0-00C04FA03D78} (LocalExec Control) - https://portal.cwu.edu/nps/portal/gadgets/c…t/LocalExec.CAB
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICSer_WPC54GS - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\NICServ.exe

–
End of file - 3927 bytes

Scotty

Post #13August 9, 2007, 8:26 PM UTC

Hi davi

Yes they are fine. Windows must have recreated them, one of the basic lessons I forgot. Here is the good news.

This is my usual speech for when you are clean, which you appear to be.

Please follow these simple steps in order to keep your computer clean and secure:
Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable
and reenable system restore to make sure there are no infected files found in a restore point.

You can find instructions on how to enable and reenable system restore here:

Managing Windows Millenium System Restore

or

Windows XP System Restore Guide

Re-enable system restore with instructions from tutorial above
Make your Internet Explorer more secure - This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
- Change the Download signed ActiveX controls to Prompt
- Change the Download unsigned ActiveX controls to Disable
- Change the Initialize and script ActiveX controls not marked as safe to Disable
- Change the Installation of desktop items to Prompt
- Change the Launching programs and files in an IFRAME to Prompt
- Change the Navigate sub-frames across different domains to Prompt
- When all these settings have been made, click on the OK button.
- If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

Set correct settings for files that should be hidden in Windows XP

Click Start > My Computer > Tools menu (at top of page) > Folder Options > View tab.
Under "Hidden files and folders" if necessary select Do not show hidden files and folders.
If unchecked please checkHide protected operating system files (Recommended)
If necessary check "Display content of system folders"
If necessary Uncheck Hide file extensions for known file types.
Click OK

And take a look at this LINKY for further recommendations and tips to stay clean.

Follow this list and your potential for being infected again will reduce dramatically.

Glad I was able to help.

Scotty

Post #14August 9, 2007, 10:44 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved]I've Been Hijacked, Please Help! Here Is My Log.

✨ Ask AI

Ask AI