Jump to content

Build Theme!
  •  
  • Infected?

WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. :D Join 93081 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!


Photo

[Resolved] kavo0 and tavo0 problems, big problems


  • This topic is locked This topic is locked
14 replies to this topic

#1 average1

average1

    New Member

  • New Member
  • Pip
  • 11 posts

Posted 30 April 2008 - 09:36 AM

Okay, so Avira prompts me countinuously about kavo0 and tavo0, but then I ran malwarebytes and a FEW other things started popping up! I really need and want to know how I can fix these problems and perhaps learn how to read logfiles properly so I can have more confidance on my pc. I would greatly appreciate some help from an expert. here are the logfiles. The only thing I noticed is that "MSIE: Internet Explorer....etc." should it read this even if I use Firefox?

Logfile of HijackThis v1.99.1
Scan saved at 8:26:09 AM, on 30/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Bell\Sympatico Security Advisor\SSA.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\NetAssistant\bin\mpbtn.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://firefox.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [SSA.exe] "C:\Program Files\Bell\Sympatico Security Advisor\SSA.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BIBLauncher] C:\Program files\Business-in-a-BoxBIBLauncher.exe
O4 - HKCU\..\Run: [kava] C:\WINDOWS\system32\kavo.exe
O4 - HKCU\..\Run: [tava] C:\WINDOWS\system32\tavo.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: NetAssistant.lnk = C:\Program Files\NetAssistant\bin\matcli.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file://C:\Program Files\Chocolatier\Images\stg_drm.ocx
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file://C:\Program Files\Chocolatier\Images\armhelper.ocx
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll



malwarebytes Logfile


Malwarebytes' Anti-Malware 1.11
Database version: 701

Scan type: Quick Scan
Objects scanned: 40627
Time elapsed: 31 minute(s), 55 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 29
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 10
Files Infected: 11

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\tavo0.dll (Rootkit.Agent) -> No action taken.

Registry Keys Infected:
HKEY_CLASSES_ROOT\shoppingreport.iebutton (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.Shopping.Report) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{20ea9658-6bc3-4599-a87d-6371fe9295fc} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{a16ad1e9-f69a-45af-9462-b1c286708842} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{c9ccbb35-d123-4a31-affc-9b2933132116} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.iebutton.1 (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.hbinfoband (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.hbinfoband.1 (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.iebuttona (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.iebuttona.1 (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.hbax (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.hbax.1 (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.rprtctrl (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.rprtctrl.1 (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{8ad9ad05-36be-4e40-ba62-5422eb0d02fb} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{aebf09e2-0c15-43c8-99bf-928c645d98a0} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{d8560ac2-21b5-4c1a-bdd4-bd12bc83b082} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{cdca70d8-c6a6-49ee-9bed-7429d6c477a2} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{d136987f-e1c4-4ccc-a220-893df03ec5df} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{e343edfc-1e6c-4cb5-aa29-e9c922641c80} (Adware.Shopping.Report) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\shoppingreport (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\Software\Security Tools (Trojan.Zlob) -> No action taken.
HKEY_CURRENT_USER\Software\ShoppingReport (Adware.Shopping.Report) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\ShoppingReport (Adware.Shopping.Report) -> No action taken.

Registry Values Infected:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> No action taken.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\ShoppingReport (Adware.Shopping.Report) -> No action taken.
C:\Program Files\ShoppingReport\Bin (Adware.Shopping.Report) -> No action taken.
C:\Program Files\ShoppingReport\cs (Adware.Shopping.Report) -> No action taken.
C:\Program Files\ShoppingReport\Bin\2.0.26 (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\Jesse\Application Data\ShoppingReport (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\Jesse\Application Data\ShoppingReport\cs (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\Jesse\Application Data\ShoppingReport\cs\db (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\Jesse\Application Data\ShoppingReport\cs\dwld (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\Jesse\Application Data\ShoppingReport\cs\report (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\Jesse\Application Data\ShoppingReport\cs\res2 (Adware.Shopping.Report) -> No action taken.

Files Infected:
C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll (Adware.Shopping.Report) -> No action taken.
C:\Program Files\ShoppingReport\Uninst.exe (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\Jesse\Application Data\ShoppingReport\cs\Config.xml (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\Jesse\Application Data\ShoppingReport\cs\db\Aliases.dbs (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\Jesse\Application Data\ShoppingReport\cs\db\Sites.dbs (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\Jesse\Application Data\ShoppingReport\cs\dwld\WhiteList.xip (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\Jesse\Application Data\ShoppingReport\cs\report\aggr_storage.xml (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\Jesse\Application Data\ShoppingReport\cs\report\send_storage.xml (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\Jesse\Application Data\ShoppingReport\cs\res2\WhiteList.dbs (Adware.Shopping.Report) -> No action taken.
C:\WINDOWS\system32\tavo0.dll (Rootkit.Agent) -> No action taken.
C:\WINDOWS\system32\tavo1.dll (Rootkit.Agent) -> No action taken.

    Advertisements

Register to Remove


#2 Scotty

Scotty

    Always Happy

  • Authentic Member
  • PipPipPipPipPip
  • 3,634 posts

Posted 30 April 2008 - 09:56 AM

Hi! Welcome to the forums.
My name is Scotty. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient.

Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.



If you already have Combofix, please delete that copy and download it again as it's being updated regularly.

There is a tutorial on the basic use of Combofix here:
http://www.bleepingc...to-use-combofix


Please download Combofix from Bleeping Computer.

If you can't download it from there, please try these 2 alternative sites:

Forospyware
Geeks to Go

  • Save it to your Desktop.
  • Disconnect from the Internet.
  • Click on this LINK to disable
  • Click Start>Run copy/paste or type "%userprofile%\desktop\combofix.exe" /killall into the Run box and click OK.
  • When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.
1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.



In your next reply post:
ComboFix.txt
New HijackThis log taken after the above scan has run


You could never learn how to do this in a short time. If you really want to learn, there is a link to the Classroom here, in my sig.
You too could train to help others- Join the Classroom

Posted Image


Posted Image

Posted Image

#3 average1

average1

    New Member

  • New Member
  • Pip
  • 11 posts

Posted 30 April 2008 - 10:30 AM

okay here are the logfiles. Thanks again for the help, means alot.


ComboFix 08-04-29.5 - Jesse 2008-04-30 9:10:47.1 - NTFSx86
Running from: C:\Documents and Settings\Jesse\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\Documents and Settings\Jesse\Application Data\ShoppingReport
C:\Documents and Settings\Jesse\Application Data\ShoppingReport\cs\Config.xml
C:\Documents and Settings\Jesse\Application Data\ShoppingReport\cs\db\Aliases.dbs
C:\Documents and Settings\Jesse\Application Data\ShoppingReport\cs\db\Sites.dbs
C:\Documents and Settings\Jesse\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
C:\Documents and Settings\Jesse\Application Data\ShoppingReport\cs\report\aggr_storage.xml
C:\Documents and Settings\Jesse\Application Data\ShoppingReport\cs\report\send_storage.xml
C:\Documents and Settings\Jesse\Application Data\ShoppingReport\cs\res2\WhiteList.dbs
C:\Program Files\ShoppingReport
C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
C:\Program Files\ShoppingReport\Uninst.exe
C:\WINDOWS\system32\tavo0.dll
C:\WINDOWS\system32\tavo1.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NWSAPAGENT
-------\Service_NwSapAgent


((((((((((((((((((((((((( Files Created from 2008-03-28 to 2008-04-30 )))))))))))))))))))))))))))))))
.

2008-04-30 07:46 . 2008-04-30 07:46 <DIR> d-------- C:\Documents and Settings\Jesse\Application Data\Malwarebytes
2008-04-30 07:45 . 2008-04-30 08:19 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-30 07:45 . 2008-04-30 07:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-30 07:07 . 2008-04-30 08:37 <DIR> d-------- C:\Documents and Settings\Jesse\Application Data\LimeWire
2008-04-30 06:50 . 2008-04-30 06:50 <DIR> d-------- C:\Program Files\Avira
2008-04-30 06:50 . 2008-04-30 06:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-04-30 06:07 . 2008-04-30 06:07 <DIR> d-------- C:\Program Files\LimeWire
2008-04-28 11:27 . 2008-04-28 11:26 117,994 -r-hs---- C:\gsxlexd.cmd
2008-04-24 14:43 . 2008-04-24 14:43 117,646 -r-hs---- C:\nsv.bat
2008-04-23 13:50 . 2008-04-23 13:49 116,539 -r-hs---- C:\c9.com
2008-04-14 14:44 . 2008-04-30 06:10 125,952 --a------ C:\WINDOWS\system32\kavo0.VIR
2008-04-14 05:30 . 2008-04-14 05:31 <DIR> d-------- C:\Program Files\Interpretive Simulations
2008-04-08 16:37 . 2007-04-03 10:19 1,990 --a------ C:\WINDOWS\system32\drivers\net_m32.inf
2008-04-08 16:34 . 2008-04-28 11:22 <DIR> d-------- C:\Program Files\Common Files\Panda Software
2008-04-08 11:58 . 2008-04-28 11:03 <DIR> d-------- C:\Program Files\Opera
2008-04-08 10:40 . 2008-04-08 11:44 <DIR> dr-h----- C:\$VAULT$.AVG
2008-04-08 10:28 . 2008-04-08 10:40 <DIR> d-------- C:\Documents and Settings\Jesse\Application Data\AVG7
2008-04-08 10:09 . 2008-04-08 10:09 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-04-08 10:08 . 2008-04-08 16:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-30 14:39 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-04-28 18:22 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-09 19:50 --------- d-----w C:\Program Files\Syncrosoft
2008-04-09 19:06 --------- d-----w C:\Program Files\Java
2008-04-08 18:40 --------- d-----w C:\Program Files\ImgBurn
2007-04-02 00:41 314 ----a-w C:\Program Files\INSTALL.LOG
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24 1694208]
"BIBLauncher"="C:\Program files\Business-in-a-BoxBIBLauncher.exe" [ ]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 10:37 2321600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2003-10-01 22:37 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2003-10-01 22:19 118784]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-12-08 18:35 32768]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 03:50 155648]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2004-03-03 08:47 1294446]
"Motive SmartBridge"="C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe" [2004-10-22 15:13 393216]
"SSA.exe"="C:\Program Files\Bell\Sympatico Security Advisor\SSA.exe" [2006-05-15 10:41 1986560]
"StandardInstall"="" []
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-31 18:44 271672]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 05:00 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 20:28:24 258048]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 20:50:52 53248]
NetAssistant.lnk - C:\Program Files\NetAssistant\bin\matcli.exe [2007-04-01 18:12:51 217088]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Documents and Settings\\Jesse\\Desktop\\Magic\\Manalink.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=

S2 MBAMService;MBAMService;"C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe" [2008-04-07 20:17]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{03d9c820-fb33-11db-b7df-0018d121b1ac}]
\Shell\AutoRun\command - ntdelect.com
\Shell\explore\Command - ntdeIect.com
\Shell\open\Command - ntdeIect.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{14e58290-3dbf-11db-b5e6-00e09107f791}]
\Shell\AutoRun\command - E:\ekf6dbg0.com
\Shell\explore\Command - E:\ekf6dbg0.com
\Shell\open\Command - E:\ekf6dbg0.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2581d135-e1e9-11db-b76e-00e09107f791}]
\Shell\Auto\command - sxs.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sxs.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{76cd4960-d30b-11db-b74d-00e09107f791}]
\Shell\AutoRun\command - E:\gqsk.bat
\Shell\explore\Command - E:\gqsk.bat
\Shell\open\Command - E:\gqsk.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ff6e8163-a789-11dc-b9b4-00e09107f791}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ff6e8164-a789-11dc-b9b4-00e09107f791}]
\Shell\AutoRun\command - ntdelect.com
\Shell\explore\Command - G:\ntdeIect.com
\Shell\open\Command - G:\ntdeIect.com

.
Contents of the 'Scheduled Tasks' folder
"2008-04-30 16:20:59 C:\WINDOWS\Tasks\SDMsgUpdate (TE).job"
- C:\PROGRA~1\SMARTD~1\Messages\SDNotify.exeW-PTE -V900 -SSDU.ini -A -Mhttp://www.smartdraw.com/msgs/messagecheck.aspx -D0 -T -N -X
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-30 09:21:23
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Ahead\InCD\incdsrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\NetAssistant\bin\mpbtn.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-04-30 9:27:02 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-30 16:26:30

Pre-Run: 41,833,197,568 bytes free
Post-Run: 42,477,486,080 bytes free

151 --- E O F --- 2008-04-08 19:06:12



HijackThis



AAA Logo 1.22
Ad-Aware SE Personal
Adobe Flash Player Plugin
Adobe Reader 8.1.1
Adobe Shockwave Player
Adobe® Photoshop® Album Starter Edition 3.0
AlphaZIP [Trial]
Apple Mobile Device Support
Apple Software Update
Avira AntiVir Personal – Free Antivirus
Business-in-a-Box
DivX Content Uploader
DivX Web Player
DVD Decrypter (Remove Only)
GetDiz 3.0
Google Earth
Hijackthis 1.99.1
HijackThis 1.99.1
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB926239)
HP Image Zone 4.7
HP PSC & OfficeJet 4.7
HP Software Update
HP Update
InCD
InCD EasyWrite Reader
Intel® Extreme Graphics 2 Driver
IrfanView (remove only)
iTunes
Java™ 6 Update 5
Kruptos 2
LG GILJABI
LimeWire 4.16.7
Malwarebytes' Anti-Malware
MarketShare #version#
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Standard Edition 2003
Microsoft Silverlight
Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Mozilla ActiveX Control v1.7.12
Mozilla Firefox (2.0.0.14)
MSN
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 Parser and SDK
Nero OEM
NetAssistant
Patin-Couffin 19
PowerDVD
QuickTime
QuickTime 3.0
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928090)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB929969)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931768)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933566)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937143)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB939653)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB942615)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944338)
Security Update for Windows XP (KB944533)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB947864)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Simply Accounting by Sage 2007
SoundMAX
Steinberg Nuendo v3.0.2.623
Sympatico Security Advisor 1.4.10
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB942840)
Update for Windows XP (KB946627)
VideoLAN VLC media player 0.8.6d
WebEx Record and Playback
Wide Screen Software's sunPATH
Windows Installer 3.1 (KB893803)
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
WinRAR archiver

#4 average1

average1

    New Member

  • New Member
  • Pip
  • 11 posts

Posted 30 April 2008 - 11:25 AM

I'm not sure if the last combofix run worked because when i was rebooting, It stalled on me and I had to power down manually. I also might have had firefox running when it was doing its thing. here is a refreshed version, not sure if it changes anything


ComboFix 08-04-29.5 - Jesse 2008-04-30 9:57:41.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.255 [GMT -7:00]
Running from: C:\Documents and Settings\Jesse\desktop\combofix.exe
Command switches used :: /killall

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
/wow section - STAGE 41
The process cannot access the file because it is being used by another process.
The process cannot access the file because it is being used by another process.
The process cannot access the file because it is being used by another process.
The process cannot access the file because it is being used by another process.
The process cannot access the file because it is being used by another process.


((((((((((((((((((((((((( Files Created from 2008-03-28 to 2008-04-30 )))))))))))))))))))))))))))))))
.

2008-04-30 07:46 . 2008-04-30 07:46 <DIR> d-------- C:\Documents and Settings\Jesse\Application Data\Malwarebytes
2008-04-30 07:45 . 2008-04-30 08:19 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-30 07:45 . 2008-04-30 07:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-30 07:07 . 2008-04-30 09:33 <DIR> d-------- C:\Documents and Settings\Jesse\Application Data\LimeWire
2008-04-30 06:50 . 2008-04-30 06:50 <DIR> d-------- C:\Program Files\Avira
2008-04-30 06:50 . 2008-04-30 06:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-04-30 06:07 . 2008-04-30 06:07 <DIR> d-------- C:\Program Files\LimeWire
2008-04-28 11:27 . 2008-04-28 11:26 117,994 -r-hs---- C:\gsxlexd.cmd
2008-04-24 14:43 . 2008-04-24 14:43 117,646 -r-hs---- C:\nsv.bat
2008-04-23 13:50 . 2008-04-23 13:49 116,539 -r-hs---- C:\c9.com
2008-04-14 14:44 . 2008-04-30 06:10 125,952 --a------ C:\WINDOWS\system32\kavo0.VIR
2008-04-14 05:30 . 2008-04-14 05:31 <DIR> d-------- C:\Program Files\Interpretive Simulations
2008-04-08 16:37 . 2007-04-03 10:19 1,990 --a------ C:\WINDOWS\system32\drivers\net_m32.inf
2008-04-08 16:34 . 2008-04-28 11:22 <DIR> d-------- C:\Program Files\Common Files\Panda Software
2008-04-08 11:58 . 2008-04-28 11:03 <DIR> d-------- C:\Program Files\Opera
2008-04-08 10:40 . 2008-04-08 11:44 <DIR> dr-h----- C:\$VAULT$.AVG
2008-04-08 10:28 . 2008-04-08 10:40 <DIR> d-------- C:\Documents and Settings\Jesse\Application Data\AVG7
2008-04-08 10:09 . 2008-04-08 10:09 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-04-08 10:08 . 2008-04-08 16:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-30 14:39 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-04-28 18:22 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-09 19:50 --------- d-----w C:\Program Files\Syncrosoft
2008-04-09 19:06 --------- d-----w C:\Program Files\Java
2008-04-08 18:40 --------- d-----w C:\Program Files\ImgBurn
2007-04-02 00:41 314 ----a-w C:\Program Files\INSTALL.LOG
.

((((((((((((((((((((((((((((( snapshot@2008-04-30_ 9.26.14.00 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-30 16:16:23 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-30 17:13:52 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24 1694208]
"BIBLauncher"="C:\Program files\Business-in-a-BoxBIBLauncher.exe" [ ]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 10:37 2321600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2003-10-01 22:37 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2003-10-01 22:19 118784]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-12-08 18:35 32768]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 03:50 155648]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2004-03-03 08:47 1294446]
"Motive SmartBridge"="C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe" [2004-10-22 15:13 393216]
"SSA.exe"="C:\Program Files\Bell\Sympatico Security Advisor\SSA.exe" [2006-05-15 10:41 1986560]
"StandardInstall"="" []
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-31 18:44 271672]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 05:00 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 20:28:24 258048]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 20:50:52 53248]
NetAssistant.lnk - C:\Program Files\NetAssistant\bin\matcli.exe [2007-04-01 18:12:51 217088]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Documents and Settings\\Jesse\\Desktop\\Magic\\Manalink.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=

S2 MBAMService;MBAMService;"C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe" [2008-04-07 20:17]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{03d9c820-fb33-11db-b7df-0018d121b1ac}]
\Shell\AutoRun\command - ntdelect.com
\Shell\explore\Command - ntdeIect.com
\Shell\open\Command - ntdeIect.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{14e58290-3dbf-11db-b5e6-00e09107f791}]
\Shell\AutoRun\command - E:\ekf6dbg0.com
\Shell\explore\Command - E:\ekf6dbg0.com
\Shell\open\Command - E:\ekf6dbg0.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2581d135-e1e9-11db-b76e-00e09107f791}]
\Shell\Auto\command - sxs.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sxs.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{76cd4960-d30b-11db-b74d-00e09107f791}]
\Shell\AutoRun\command - E:\gqsk.bat
\Shell\explore\Command - E:\gqsk.bat
\Shell\open\Command - E:\gqsk.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ff6e8163-a789-11dc-b9b4-00e09107f791}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ff6e8164-a789-11dc-b9b4-00e09107f791}]
\Shell\AutoRun\command - ntdelect.com
\Shell\explore\Command - G:\ntdeIect.com
\Shell\open\Command - G:\ntdeIect.com

.
Contents of the 'Scheduled Tasks' folder
"2008-04-30 17:15:21 C:\WINDOWS\Tasks\SDMsgUpdate (TE).job"
- C:\PROGRA~1\SMARTD~1\Messages\SDNotify.exeW-PTE -V900 -SSDU.ini -A -Mhttp://www.smartdraw.com/msgs/messagecheck.aspx -D0 -T -N -X
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-30 10:15:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Ahead\InCD\incdsrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\NetAssistant\bin\mpbtn.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-04-30 10:22:02 - machine was rebooted [Jesse]
ComboFix-quarantined-files.txt 2008-04-30 17:21:31
ComboFix2.txt 2008-04-30 16:27:04

Pre-Run: 42,453,774,336 bytes free
Post-Run: 42,444,460,032 bytes free

142 --- E O F --- 2008-04-08 19:06:12

#5 Scotty

Scotty

    Always Happy

  • Authentic Member
  • PipPipPipPipPip
  • 3,634 posts

Posted 30 April 2008 - 12:48 PM

Hi

Download Flash_Disinfector from here and save it to your desktop.
Doubleclick on Flash_Disinfector.exe to run it and follow the prompts.
Wait until it has finished scanning and then exit the program.
The utility may ask you to insert your flash drive and/or other removable drives. This may include your mobile phone.
Please do so and allow the utility to clean up those drives as well.



Remember to disconnect from the Internet before carrying out the next instruction, and to save the following script before you do.You must
also manually disable your anti-virus and anti-spyware programs. See the link below for instructions on doing this.

http://www.bleepingc...opic114351.html

Open Notepad - it must be Notepad, not Wordpad.
Copy the text below in the code box by highlighting all the text with your mouse and pressing Ctrl+C

KillAll::
 
File::
C:\gsxlexd.cmd
C:\nsv.bat
C:\c9.com
C:\WINDOWS\system32\kavo0.VIR
C:\WINDOWS\system32\drivers\net_m32.inf

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{03d9c820-fb33-11db-b7df-0018d121b1ac}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{14e58290-3dbf-11db-b5e6-00e09107f791}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2581d135-e1e9-11db-b76e-00e09107f791}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{76cd4960-d30b-11db-b74d-00e09107f791}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ff6e8163-a789-11dc-b9b4-00e09107f791}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ff6e8164-a789-11dc-b9b4-00e09107f791}]

Go to the Notepad window and click Edit > Paste
Then click File > Save
Name the file "CFScript.txt" (including the quotes)
Save the file to your Desktop

Posted Image


Refering to the picture above, drag CFScript into ComboFix.exe

In your next reply post:
ComboFix.txt
New HijackThis log taken after the above scan has run

You too could train to help others- Join the Classroom

Posted Image


Posted Image

Posted Image

#6 average1

average1

    New Member

  • New Member
  • Pip
  • 11 posts

Posted 30 April 2008 - 01:53 PM

sorry it took a while. I had problems powering down/up, is this normal when I run combofix?? Scotty, I owe you one. thanks for the patience.


ComboFix 08-04-29.5 - Jesse 2008-04-30 12:14:17.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.255 [GMT -7:00]
Running from: C:\Documents and Settings\Jesse\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jesse\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\c9.com
C:\gsxlexd.cmd
C:\nsv.bat
C:\WINDOWS\system32\drivers\net_m32.inf
C:\WINDOWS\system32\kavo0.VIR
.
/wow section - STAGE 41
pv: No matching processes found
The process cannot access the file because it is being used by another process.
The process cannot access the file because it is being used by another process.
The process cannot access the file because it is being used by another process.
The process cannot access the file because it is being used by another process.
The process cannot access the file because it is being used by another process.


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\c9.com
C:\gsxlexd.cmd
C:\nsv.bat
C:\WINDOWS\system32\drivers\net_m32.inf
C:\WINDOWS\system32\kavo0.VIR

.
((((((((((((((((((((((((( Files Created from 2008-03-28 to 2008-04-30 )))))))))))))))))))))))))))))))
.

2008-04-30 07:46 . 2008-04-30 07:46 <DIR> d-------- C:\Documents and Settings\Jesse\Application Data\Malwarebytes
2008-04-30 07:45 . 2008-04-30 08:19 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-30 07:45 . 2008-04-30 07:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-30 07:07 . 2008-04-30 10:27 <DIR> d-------- C:\Documents and Settings\Jesse\Application Data\LimeWire
2008-04-30 06:50 . 2008-04-30 06:50 <DIR> d-------- C:\Program Files\Avira
2008-04-30 06:50 . 2008-04-30 06:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-04-30 06:07 . 2008-04-30 06:07 <DIR> d-------- C:\Program Files\LimeWire
2008-04-14 05:30 . 2008-04-14 05:31 <DIR> d-------- C:\Program Files\Interpretive Simulations
2008-04-08 16:34 . 2008-04-28 11:22 <DIR> d-------- C:\Program Files\Common Files\Panda Software
2008-04-08 11:58 . 2008-04-28 11:03 <DIR> d-------- C:\Program Files\Opera
2008-04-08 10:40 . 2008-04-08 11:44 <DIR> dr-h----- C:\$VAULT$.AVG
2008-04-08 10:28 . 2008-04-08 10:40 <DIR> d-------- C:\Documents and Settings\Jesse\Application Data\AVG7
2008-04-08 10:09 . 2008-04-08 10:09 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-04-08 10:08 . 2008-04-08 16:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-30 14:39 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-04-28 18:22 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-09 19:50 --------- d-----w C:\Program Files\Syncrosoft
2008-04-09 19:06 --------- d-----w C:\Program Files\Java
2008-04-08 18:40 --------- d-----w C:\Program Files\ImgBurn
2007-04-02 00:41 314 ----a-w C:\Program Files\INSTALL.LOG
.

((((((((((((((((((((((((((((( snapshot@2008-04-30_ 9.26.14.00 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-30 16:16:23 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-30 19:41:02 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24 1694208]
"BIBLauncher"="C:\Program files\Business-in-a-BoxBIBLauncher.exe" [ ]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 10:37 2321600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2003-10-01 22:37 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2003-10-01 22:19 118784]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-12-08 18:35 32768]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 03:50 155648]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2004-03-03 08:47 1294446]
"Motive SmartBridge"="C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe" [2004-10-22 15:13 393216]
"SSA.exe"="C:\Program Files\Bell\Sympatico Security Advisor\SSA.exe" [2006-05-15 10:41 1986560]
"StandardInstall"="" []
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-31 18:44 271672]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 05:00 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 20:28:24 258048]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 20:50:52 53248]
NetAssistant.lnk - C:\Program Files\NetAssistant\bin\matcli.exe [2007-04-01 18:12:51 217088]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Documents and Settings\\Jesse\\Desktop\\Magic\\Manalink.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=

S2 MBAMService;MBAMService;"C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe" [2008-04-07 20:17]

.
Contents of the 'Scheduled Tasks' folder
"2008-04-30 19:41:15 C:\WINDOWS\Tasks\SDMsgUpdate (TE).job"
- C:\PROGRA~1\SMARTD~1\Messages\SDNotify.exeW-PTE -V900 -SSDU.ini -A -Mhttp://www.smartdraw.com/msgs/messagecheck.aspx -D0 -T -N -X
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-30 12:41:44
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Ahead\InCD\incdsrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\SMARTD~1\Messages\SDNotify.exe
C:\Program Files\NetAssistant\bin\mpbtn.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-04-30 12:48:09 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-30 19:47:41
ComboFix2.txt 2008-04-30 17:22:03
ComboFix3.txt 2008-04-30 16:27:04

Pre-Run: 42,238,976,000 bytes free
Post-Run: 42,226,745,344 bytes free

135 --- E O F --- 2008-04-08 19:06:12

#7 average1

average1

    New Member

  • New Member
  • Pip
  • 11 posts

Posted 30 April 2008 - 02:00 PM

Here is the HJT logfile I recorded right after CF was done.

Logfile of HijackThis v1.99.1
Scan saved at 13:00, on 2008-04-30
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Bell\Sympatico Security Advisor\SSA.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\NetAssistant\bin\mpbtn.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://firefox.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [SSA.exe] "C:\Program Files\Bell\Sympatico Security Advisor\SSA.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BIBLauncher] C:\Program files\Business-in-a-BoxBIBLauncher.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: NetAssistant.lnk = C:\Program Files\NetAssistant\bin\matcli.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file://C:\Program Files\Chocolatier\Images\stg_drm.ocx
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file://C:\Program Files\Chocolatier\Images\armhelper.ocx
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MBAMService - Malwarebytes - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

#8 Scotty

Scotty

    Always Happy

  • Authentic Member
  • PipPipPipPipPip
  • 3,634 posts

Posted 30 April 2008 - 04:38 PM

It shouldnt do that but it looks like we are almost done with Combo now.

Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it.

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache

*The other boxes are optional*
Then click the Empty Selected button.

Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

*Note* If you do not have Firefox or Opera, those options will be greyed out.



Please do an online scan with Kaspersky Online Scanner.
You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then start to download the latest definition files.
  • Once the scanner is installed and the definitions downloaded, click Next.
  • Now click on Scan Settings
  • In the scan settings make sure that the following are selected:
    • Scan using the following Anti-Virus database:

      + Extended(If available otherwise Standard)
    • Scan Options:

      + Scan Archives
      + Scan Mail Bases
  • Click OK
  • Now under select a target to scan select My Computer
  • The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button
  • Save the file to your desktop.
  • Copy and paste that information in your next post.

With the exception of Internet Explorer, which is needed for the Kaspersky Scan, keep ALL programs closed
until the scan is complete. This includes your anti-virus. Once you have
installed the Scanner, and the updated definitions, you can disconnect from the Internet.Re-enable the anti-virus before reconnecting to the Internet.
Instructions on disabling a variety of security programs can be found at the link below.

http://www.bleepingc...opic114351.html
You too could train to help others- Join the Classroom

Posted Image


Posted Image

Posted Image

#9 average1

average1

    New Member

  • New Member
  • Pip
  • 11 posts

Posted 03 May 2008 - 07:21 AM

Sorry I haven't replied in a few days, I'm starting a business and as you can imagine, it consumes most of my time. anyway, Here is the text file from kaspersky. I'm really infected, I just don't understand where it all came from. I also attached the file in case it was too hard to read on the screen. I hope you can still help me scotty. Scan Settings Scan using the following antivirus database extended Scan Archives true Scan Mail Bases true Scan Target My Computer C:\ D:\ Scan Statistics Total number of scanned objects 57255 Number of viruses found 92 Number of infected objects 551 Number of suspicious objects 0 Duration of the scan process 00:51:53 Infected Object Name Virus Name Last Action C:\autorun.inf\lpt3.This folder was created by Flash_Disinfector Object is locked skipped C:\Documents and Settings\Jesse\Application Data\Bell\Sympatico Security Advisor\client_gateway.log Object is locked skipped C:\Documents and Settings\Jesse\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Application Data\ApplicationHistory\hpqgalry.exe.cf8dd223.ini.inuse Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Application Data\HP\Digital Imaging\db\administrativeInfo.dbf Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.cdx Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.dbf Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.cdx Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.dbf Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Application Data\HP\Digital Imaging\db\CB_Server_Errors.txt Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.cdx Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.dbf Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.cdx Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.dbf Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.fpt Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.cdx Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.dbf Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.cdx Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.dbf Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Application Data\HP\Digital Imaging\db\managedFolderTable.dbf Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.cdx Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.dbf Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.cdx Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.dbf Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.cdx Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.dbf Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\History\History.IE5\MSHist012008050320080504\index.dat Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\temp\hpodvd09.log Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\temp\~DF873A.tmp Object is locked skipped C:\Documents and Settings\Jesse\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Jesse\My Documents\LimeWire\Incomplete\Preview-T-3545425-munga v s.mp3 Infected: Trojan-Downloader.WMA.Wimad.n skipped C:\Documents and Settings\Jesse\My Documents\LimeWire\Saved\munga v s.mp3 Infected: Trojan-Downloader.WMA.Wimad.n skipped C:\Documents and Settings\Jesse\My Documents\LimeWire\Saved\night creature riddim.mp3 Infected: Trojan-Downloader.WMA.Wimad.n skipped C:\Documents and Settings\Jesse\My Documents\prisma1[1].4-setup_exe.vir/stream/data0028 Infected: not-a-virus:RiskTool.Win32.FWDisabler.a skipped C:\Documents and Settings\Jesse\My Documents\prisma1[1].4-setup_exe.vir/stream Infected: not-a-virus:RiskTool.Win32.FWDisabler.a skipped C:\Documents and Settings\Jesse\My Documents\prisma1[1].4-setup_exe.vir NSIS: infected - 2 skipped C:\Documents and Settings\Jesse\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Jesse\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\NetAssistant\log\mpbtn.log Object is locked skipped C:\Program Files\NetAssistant\SmartBridge\AlertFilter.log Object is locked skipped C:\Program Files\NetAssistant\SmartBridge\log\httpclient.log Object is locked skipped C:\Program Files\NetAssistant\SmartBridge\SmartBridge.log Object is locked skipped C:\QooBox\Quarantine\C\c9.com.vir Infected: Trojan.Win32.Vaklik.aeg skipped C:\QooBox\Quarantine\C\gsxlexd.cmd.vir Infected: Worm.Win32.AutoRun.dny skipped C:\QooBox\Quarantine\C\nsv.bat.vir Infected: Trojan-PSW.Win32.OnLineGames.acak skipped C:\QooBox\Quarantine\C\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll.vir Infected: not-a-virus:AdWare.Win32.Shopper.q skipped C:\QooBox\Quarantine\C\WINDOWS\system32\kavo0.VIR.vir Infected: Trojan-PSW.Win32.OnLineGames.acng skipped C:\QooBox\Quarantine\C\WINDOWS\system32\tavo0.dll.vir Infected: Trojan-PSW.Win32.Magania.mpb skipped C:\QooBox\Quarantine\C\WINDOWS\system32\tavo1.dll.vir Infected: Trojan-PSW.Win32.OnLineGames.xmt skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP394\A0063574.bat Infected: Trojan-PSW.Win32.OnLineGames.qix skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP394\A0063575.inf Infected: Trojan-PSW.Win32.OnLineGames.qix skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP395\A0063576.bat Infected: Trojan-PSW.Win32.OnLineGames.qix skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP395\A0063577.inf Infected: Trojan-PSW.Win32.OnLineGames.qix skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP395\A0063854.dll Infected: Trojan-PSW.Win32.OnLineGames.qix skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP395\A0063858.exe Infected: Trojan-PSW.Win32.OnLineGames.qog skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP395\A0063859.dll Infected: Trojan-PSW.Win32.OnLineGames.qmi skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP395\A0063860.bat Infected: Trojan-PSW.Win32.OnLineGames.qix skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP395\A0063861.inf Infected: Trojan-PSW.Win32.OnLineGames.qix skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP395\A0063862.exe Infected: Trojan-PSW.Win32.OnLineGames.qix skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP395\A0063863.dll Infected: Trojan-PSW.Win32.OnLineGames.qix skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP396\A0063889.exe Infected: Trojan-PSW.Win32.OnLineGames.qog skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP396\A0063890.dll Infected: Trojan-PSW.Win32.OnLineGames.qmi skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP396\A0063891.exe Infected: Worm.Win32.AutoRun.cjo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP396\A0063892.bat Infected: Worm.Win32.AutoRun.cjo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP396\A0063893.inf Infected: Trojan-PSW.Win32.OnLineGames.ufh skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP396\A0063897.dll Infected: Trojan-PSW.Win32.OnLineGames.qng skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP396\A0063930.dll Infected: Trojan-PSW.Win32.OnLineGames.qmi skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP396\A0063934.bat Infected: Worm.Win32.AutoRun.cjo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP396\A0063935.inf Infected: Trojan-PSW.Win32.OnLineGames.ufh skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP396\A0063936.exe Infected: Trojan-PSW.Win32.OnLineGames.qog skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP396\A0063937.exe Infected: Worm.Win32.AutoRun.cjo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP396\A0063938.dll Infected: Trojan-PSW.Win32.OnLineGames.qng skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP396\A0063950.dll Infected: Trojan-PSW.Win32.OnLineGames.qng skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP396\A0063956.bat Infected: Worm.Win32.AutoRun.cjo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP396\A0063957.inf Infected: Trojan-PSW.Win32.OnLineGames.ufh skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP396\A0063958.exe Infected: Worm.Win32.AutoRun.cjo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP396\A0063959.dll Infected: Trojan-PSW.Win32.OnLineGames.qng skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP396\A0063967.dll Infected: Trojan-PSW.Win32.OnLineGames.qng skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP396\A0063968.dll Infected: Trojan-PSW.Win32.OnLineGames.qmi skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP396\A0063972.exe Infected: Trojan-PSW.Win32.OnLineGames.qog skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP396\A0063973.dll Infected: Trojan-PSW.Win32.OnLineGames.qmi skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP396\A0063974.bat Infected: Worm.Win32.AutoRun.cjo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP396\A0063975.inf Infected: Trojan-PSW.Win32.OnLineGames.ufh skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP396\A0063976.exe Infected: Worm.Win32.AutoRun.cjo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP396\A0063977.dll Infected: Trojan-PSW.Win32.OnLineGames.qng skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP397\A0063988.bat Infected: Worm.Win32.AutoRun.cjo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP397\A0063989.inf Infected: Trojan-PSW.Win32.OnLineGames.ufh skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0063990.bat Infected: Worm.Win32.AutoRun.cjo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0063991.inf Infected: Trojan-PSW.Win32.OnLineGames.ufh skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064009.dll Infected: Trojan-PSW.Win32.OnLineGames.qng skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064012.exe Infected: Worm.Win32.AutoRun.cjo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064014.bat Infected: Worm.Win32.AutoRun.cjo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064015.inf Infected: Trojan-PSW.Win32.OnLineGames.ufh skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064016.dll Infected: Trojan-PSW.Win32.OnLineGames.qng skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064027.dll Infected: Trojan-PSW.Win32.OnLineGames.qmi skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064031.exe Infected: Trojan-PSW.Win32.OnLineGames.qog skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064032.dll Infected: Trojan-PSW.Win32.OnLineGames.qmi skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064033.exe Infected: Worm.Win32.AutoRun.cjo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064034.bat Infected: Worm.Win32.AutoRun.cjo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064035.inf Infected: Trojan-PSW.Win32.OnLineGames.ufh skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064040.dll Infected: Trojan-PSW.Win32.OnLineGames.qng skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064049.dll Infected: Trojan-PSW.Win32.OnLineGames.qng skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064052.exe Infected: Trojan-PSW.Win32.OnLineGames.qog skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064053.dll Infected: Trojan-PSW.Win32.OnLineGames.qmi skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064054.exe Infected: Worm.Win32.AutoRun.cjo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064055.bat Infected: Worm.Win32.AutoRun.cjo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064056.inf Infected: Trojan-PSW.Win32.OnLineGames.ufh skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064058.dll Infected: Trojan-PSW.Win32.OnLineGames.qng skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064066.dll Infected: Trojan-PSW.Win32.OnLineGames.qng skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064067.dll Infected: Trojan-PSW.Win32.OnLineGames.qmi skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064071.exe Infected: Trojan-PSW.Win32.OnLineGames.qog skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064072.exe Infected: Worm.Win32.AutoRun.cjo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064073.bat Infected: Worm.Win32.AutoRun.cjo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064074.inf Infected: Trojan-PSW.Win32.OnLineGames.ufh skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP398\A0064076.dll Infected: Trojan-PSW.Win32.OnLineGames.qng skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP399\A0064087.cmd Infected: Trojan-PSW.Win32.OnLineGames.qpx skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP399\A0064095.dll Infected: Trojan-PSW.Win32.OnLineGames.qpx skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP399\A0064098.cmd Infected: Trojan-PSW.Win32.OnLineGames.qpx skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP399\A0064102.exe Infected: Trojan-PSW.Win32.OnLineGames.qpx skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP399\A0064153.dll Infected: Trojan-PSW.Win32.OnLineGames.qta skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP399\A0064154.dll Infected: Trojan-PSW.Win32.OnLineGames.qmi skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP399\A0064158.exe Infected: Trojan-PSW.Win32.OnLineGames.qta skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP399\A0064159.dll Infected: Trojan-PSW.Win32.OnLineGames.qpx skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP399\A0064180.dll Infected: Trojan-PSW.Win32.OnLineGames.qmi skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP399\A0064181.dll Infected: Trojan-PSW.Win32.Magania.eyj skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP399\A0064186.bat Infected: Trojan-PSW.Win32.OnLineGames.qwo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP399\A0064188.exe Infected: Trojan-PSW.Win32.OnLineGames.qwo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP399\A0064189.dll Infected: Trojan-PSW.Win32.Magania.eyj skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP400\A0064191.bat Infected: Trojan-PSW.Win32.OnLineGames.qwo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP400\A0064218.dll Infected: Trojan-PSW.Win32.OnLineGames.qmi skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP400\A0064221.bat Infected: Trojan-PSW.Win32.OnLineGames.qwo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP400\A0064223.exe Infected: Trojan-PSW.Win32.OnLineGames.qwo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP400\A0064224.dll Infected: Trojan-PSW.Win32.Magania.eyj skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP401\A0064276.bat Infected: Trojan-PSW.Win32.OnLineGames.qwo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP401\A0064291.dll Infected: Trojan-PSW.Win32.OnLineGames.qmi skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP401\A0064294.bat Infected: Trojan-PSW.Win32.OnLineGames.qwo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP401\A0064298.exe Infected: Trojan-PSW.Win32.OnLineGames.qwo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP401\A0064299.dll Infected: Trojan-PSW.Win32.Magania.eyj skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP402\A0064313.exe Infected: Worm.Win32.AutoRun.clt skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP402\A0064322.dll Infected: Packed.Win32.PolyCrypt.h skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP402\A0064323.dll Infected: Trojan-PSW.Win32.OnLineGames.qmi skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP402\A0064327.exe Infected: Worm.Win32.AutoRun.clt skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP402\A0064329.exe Infected: Worm.Win32.AutoRun.clt skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP402\A0064330.dll Infected: Packed.Win32.PolyCrypt.h skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP403\A0064331.exe Infected: Worm.Win32.AutoRun.clt skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP403\A0064351.dll Infected: Trojan-PSW.Win32.OnLineGames.qmi skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP403\A0064352.dll Infected: Packed.Win32.PolyCrypt.h skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP403\A0064357.exe Infected: Worm.Win32.AutoRun.clt skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP403\A0064359.exe Infected: Worm.Win32.AutoRun.clt skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP403\A0064360.dll Infected: Packed.Win32.PolyCrypt.h skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP403\A0064380.dll Infected: Trojan-PSW.Win32.OnLineGames.qmi skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP403\A0064385.exe Infected: Worm.Win32.AutoRun.clt skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP403\A0064387.exe Infected: Worm.Win32.AutoRun.clt skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP403\A0064388.dll Infected: Packed.Win32.PolyCrypt.h skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP404\A0064404.bat Infected: Trojan-PSW.Win32.OnLineGames.rad skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP404\A0064414.dll Infected: Packed.Win32.PolyCrypt.h skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP404\A0064415.dll Infected: Trojan-PSW.Win32.OnLineGames.qmi skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP404\A0064419.bat Infected: Trojan-PSW.Win32.OnLineGames.rad skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP404\A0064426.exe Infected: Trojan-PSW.Win32.OnLineGames.rad skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP404\A0064427.dll Infected: Trojan-PSW.Win32.OnLineGames.rah skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP404\A0064437.dll Infected: Trojan-PSW.Win32.OnLineGames.rah skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP404\A0064438.dll Infected: Trojan-PSW.Win32.OnLineGames.qmi skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP404\A0064443.bat Infected: Trojan-PSW.Win32.OnLineGames.rad skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP404\A0064454.dll Infected: Trojan-PSW.Win32.OnLineGames.rah skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP404\A0064455.dll Infected: Trojan-PSW.Win32.OnLineGames.qmi skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP404\A0064459.bat Infected: Trojan-PSW.Win32.OnLineGames.rad skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP404\A0064461.exe Infected: Trojan-PSW.Win32.OnLineGames.rad skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP404\A0064462.dll Infected: Trojan-PSW.Win32.OnLineGames.rah skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP404\A0064470.dll Infected: Trojan-PSW.Win32.OnLineGames.rah skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP404\A0064471.dll Infected: Trojan-PSW.Win32.OnLineGames.qmi skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP404\A0064475.bat Infected: Trojan-PSW.Win32.OnLineGames.rad skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP404\A0064477.exe Infected: Trojan-PSW.Win32.OnLineGames.rad skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP404\A0064478.dll Infected: Trojan-PSW.Win32.OnLineGames.rah skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP404\A0064490.dll Infected: Trojan-PSW.Win32.OnLineGames.qmi skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP404\A0064493.exe Infected: Trojan-PSW.Win32.OnLineGames.qog skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP404\A0064494.dll Infected: Trojan-PSW.Win32.OnLineGames.qmi skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP404\A0064495.bat Infected: Trojan-PSW.Win32.OnLineGames.rad skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP404\A0064497.exe Infected: Trojan-PSW.Win32.OnLineGames.rad skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP404\A0064498.dll Infected: Trojan-PSW.Win32.OnLineGames.rah skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP405\A0064499.bat Infected: Trojan-PSW.Win32.OnLineGames.rey skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP406\A0064501.bat Infected: Trojan-PSW.Win32.OnLineGames.rey skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP406\A0064569.exe Infected: Trojan-PSW.Win32.OnLineGames.rez skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP406\A0064570.dll Infected: Trojan-PSW.Win32.OnLineGames.rez skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP406\A0064571.bat Infected: Trojan-PSW.Win32.OnLineGames.rey skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP406\A0064573.exe Infected: Trojan-PSW.Win32.OnLineGames.rey skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP406\A0064574.dll Infected: Trojan-PSW.Win32.OnLineGames.rdu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP406\A0064594.bat Infected: Trojan-PSW.Win32.OnLineGames.rey skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP406\A0064596.exe Infected: Trojan-PSW.Win32.OnLineGames.rez skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP406\A0064597.exe Infected: Trojan-PSW.Win32.OnLineGames.rey skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP406\A0064598.dll Infected: Trojan-PSW.Win32.OnLineGames.rdu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP406\A0064613.bat Infected: Trojan-PSW.Win32.OnLineGames.rey skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP406\A0064617.exe Infected: Trojan-PSW.Win32.OnLineGames.rez skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP406\A0064618.dll Infected: Trojan-PSW.Win32.OnLineGames.rez skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP406\A0064619.exe Infected: Trojan-PSW.Win32.OnLineGames.rey skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP406\A0064627.dll Infected: Trojan-PSW.Win32.OnLineGames.rdu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP406\A0064631.bat Infected: Trojan-PSW.Win32.OnLineGames.rey skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP406\A0064633.exe Infected: Trojan-PSW.Win32.OnLineGames.rey skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP406\A0064634.dll Infected: Trojan-PSW.Win32.OnLineGames.rdu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP407\A0064639.bat Infected: Trojan-PSW.Win32.OnLineGames.rey skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP407\A0064641.exe Infected: Trojan-PSW.Win32.OnLineGames.rey skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP407\A0064642.dll Infected: Trojan-PSW.Win32.OnLineGames.rdu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP407\A0064643.dll Infected: Trojan-PSW.Win32.OnLineGames.rdu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP407\A0064666.dll Infected: Trojan-PSW.Win32.OnLineGames.rgp skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP407\A0064667.dll Infected: Trojan-PSW.Win32.OnLineGames.rez skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP407\A0064671.com Infected: Trojan-PSW.Win32.OnLineGames.rhc skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP407\A0064672.inf Infected: Trojan-PSW.Win32.OnLineGames.rhc skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP407\A0064673.exe Infected: Trojan-PSW.Win32.OnLineGames.rhc skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP407\A0064674.dll Infected: Trojan-PSW.Win32.OnLineGames.rgp skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP408\A0064675.com Infected: Trojan-PSW.Win32.OnLineGames.rhc skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP408\A0064676.inf Infected: Trojan-PSW.Win32.OnLineGames.rhc skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP408\A0064686.dll Infected: Trojan-PSW.Win32.OnLineGames.rez skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP408\A0064687.dll Infected: Trojan-PSW.Win32.OnLineGames.rgp skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP408\A0064690.com Infected: Trojan-PSW.Win32.OnLineGames.rhc skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP408\A0064691.inf Infected: Trojan-PSW.Win32.OnLineGames.rhc skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP408\A0064692.exe Infected: Trojan-PSW.Win32.OnLineGames.rhc skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP408\A0064693.dll Infected: Trojan-PSW.Win32.OnLineGames.rgp skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP408\A0064702.dll Infected: Trojan-PSW.Win32.OnLineGames.rez skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP408\A0064705.com Infected: Trojan-PSW.Win32.OnLineGames.rhc skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP408\A0064706.inf Infected: Trojan-PSW.Win32.OnLineGames.rhc skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP408\A0064707.exe Infected: Trojan-PSW.Win32.OnLineGames.rhc skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP408\A0064708.dll Infected: Trojan-PSW.Win32.OnLineGames.rgp skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP408\A0064733.dll Infected: Trojan-PSW.Win32.OnLineGames.rgp skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP408\A0064734.dll Infected: Trojan-PSW.Win32.OnLineGames.rez skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP408\A0064738.exe Infected: Trojan-PSW.Win32.OnLineGames.rid skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP408\A0064739.dll Infected: Trojan-PSW.Win32.OnLineGames.rid skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP408\A0064740.exe Infected: Trojan-PSW.Win32.OnLineGames.rid skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP408\A0064741.inf Infected: Trojan-PSW.Win32.OnLineGames.rjf skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP409\A0064748.exe Infected: Trojan-PSW.Win32.OnLineGames.rid skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP409\A0064749.inf Infected: Trojan-PSW.Win32.OnLineGames.rjf skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP409\A0064765.dll Infected: Trojan-PSW.Win32.OnLineGames.rid skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP409\A0064766.dll Infected: Trojan-PSW.Win32.OnLineGames.rez skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP409\A0064771.exe Infected: Trojan-PSW.Win32.OnLineGames.rid skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP409\A0064772.inf Infected: Trojan-PSW.Win32.OnLineGames.rjf skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP409\A0064773.exe Infected: Trojan-PSW.Win32.OnLineGames.rez skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP409\A0064774.dll Infected: Trojan-PSW.Win32.OnLineGames.rez skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP409\A0064781.exe Infected: Trojan-PSW.Win32.OnLineGames.rid skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP409\A0064782.dll Infected: Trojan-PSW.Win32.OnLineGames.rid skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP409\A0064795.dll Infected: Trojan-PSW.Win32.OnLineGames.rid skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP409\A0064800.bat Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP409\A0064801.inf Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP409\A0064802.exe Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP409\A0064817.dll Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP409\A0064818.dll Infected: Trojan-PSW.Win32.OnLineGames.rlu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP409\A0064820.bat Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP409\A0064821.inf Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP409\A0064824.exe Infected: Trojan-PSW.Win32.OnLineGames.rlt skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP409\A0064825.dll Infected: Trojan-PSW.Win32.OnLineGames.rlu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP409\A0064826.exe Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP409\A0064827.exe Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP409\A0064828.dll Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP410\A0064829.bat Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP410\A0064830.inf Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP410\A0064866.exe Infected: Trojan-PSW.Win32.OnLineGames.rlt skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP410\A0064867.bat Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP410\A0064868.inf Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP410\A0064869.exe Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP410\A0064870.dll Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP411\A0064873.bat Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP411\A0064874.inf Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP411\A0064913.dll Infected: Trojan-PSW.Win32.OnLineGames.ufx skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP411\A0064917.bat Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP411\A0064918.inf Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP411\A0064922.exe Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP411\A0064923.dll Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP411\A0064940.dll Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP411\A0064942.dll Infected: Trojan-PSW.Win32.OnLineGames.ufx skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP411\A0064944.bat Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP411\A0064945.inf Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP411\A0064946.exe Infected: Trojan-PSW.Win32.OnLineGames.ufx skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP411\A0064947.dll Infected: Trojan-PSW.Win32.OnLineGames.rlu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP411\A0064948.exe Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP411\A0064949.dll Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP412\A0064950.exe Infected: Trojan-PSW.Win32.OnLineGames.rpw skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP412\A0064952.exe Infected: Trojan-PSW.Win32.OnLineGames.rpw skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP412\A0064953.dll Infected: Trojan-PSW.Win32.OnLineGames.rpw skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP413\A0064962.exe Infected: Trojan-PSW.Win32.OnLineGames.rpw skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP413\A0064964.exe Infected: Trojan-PSW.Win32.OnLineGames.rpw skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP413\A0064965.dll Infected: Trojan-PSW.Win32.OnLineGames.rpw skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP413\A0064966.dll Infected: Trojan-PSW.Win32.OnLineGames.rpw skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP414\A0064967.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP414\A0064969.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP414\A0064980.exe Infected: Trojan-PSW.Win32.OnLineGames.ruk skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP414\A0064981.dll Infected: Trojan-PSW.Win32.OnLineGames.rul skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP414\A0064982.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP414\A0064984.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP414\A0064985.dll Infected: Trojan-PSW.Win32.OnLineGames.ruj skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP414\A0065018.dll Infected: Trojan-PSW.Win32.OnLineGames.rul skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP414\A0065019.dll Infected: Trojan-PSW.Win32.OnLineGames.ruj skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP414\A0065023.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP414\A0065025.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP414\A0065026.dll Infected: Trojan-PSW.Win32.OnLineGames.ruj skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP415\A0065027.exe Infected: Trojan-PSW.Win32.OnLineGames.rxu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP415\A0065029.exe Infected: Trojan-PSW.Win32.OnLineGames.rxu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP415\A0065036.dll Infected: Trojan-PSW.Win32.OnLineGames.rul skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP415\A0065037.dll Infected: Trojan-PSW.Win32.OnLineGames.rxnn skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP415\A0065040.exe Infected: Trojan-PSW.Win32.OnLineGames.rxu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP415\A0065046.exe Infected: Trojan-PSW.Win32.OnLineGames.ruk skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP416\A0065049.exe Infected: Trojan-PSW.Win32.OnLineGames.rxu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP416\A0065058.dll Infected: Trojan-PSW.Win32.OnLineGames.rxnn skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP416\A0065062.exe Infected: Trojan-PSW.Win32.OnLineGames.rxu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP416\A0065063.dll Infected: Trojan-PSW.Win32.OnLineGames.rxnn skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP416\A0065064.exe Infected: Trojan-PSW.Win32.OnLineGames.rxu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP416\A0065066.exe Infected: Trojan-PSW.Win32.OnLineGames.san skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP417\A0065080.exe Infected: Trojan-PSW.Win32.OnLineGames.snu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP417\A0065081.exe Infected: Trojan-PSW.Win32.OnLineGames.skr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP417\A0065090.dll Infected: Packed.Win32.PolyCrypt.h skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP417\A0065091.dll Infected: Packed.Win32.PolyCrypt.h skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP417\A0065095.exe Infected: Trojan-PSW.Win32.OnLineGames.snu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP417\A0065096.com Infected: Trojan-PSW.Win32.OnLineGames.sgu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP417\A0065097.inf Infected: Trojan-PSW.Win32.OnLineGames.szb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP417\A0065099.exe Infected: Trojan-PSW.Win32.OnLineGames.sgu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP417\A0065100.dll Infected: Trojan-PSW.Win32.OnLineGames.skr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP417\A0065129.dll Infected: Packed.Win32.PolyCrypt.h skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP417\A0065133.exe Infected: Trojan-PSW.Win32.OnLineGames.snu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP417\A0065134.com Infected: Trojan-PSW.Win32.OnLineGames.sgu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP417\A0065135.inf Infected: Trojan-PSW.Win32.OnLineGames.szb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP417\A0065136.exe Infected: Trojan-PSW.Win32.OnLineGames.sgu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP418\A0065140.com Infected: Trojan-PSW.Win32.OnLineGames.ssa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP418\A0065141.inf Infected: Trojan-PSW.Win32.OnLineGames.szb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP419\A0065160.com Infected: Trojan-PSW.Win32.OnLineGames.ssa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP419\A0065161.inf Infected: Trojan-PSW.Win32.OnLineGames.szb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP419\A0065175.dll Infected: Trojan-PSW.Win32.Magania.gpa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP419\A0065176.dll Infected: Packed.Win32.PolyCrypt.h skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP419\A0065180.com Infected: Trojan-PSW.Win32.OnLineGames.ssa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP419\A0065181.inf Infected: Trojan-PSW.Win32.OnLineGames.szb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP419\A0065182.exe Infected: Trojan-PSW.Win32.OnLineGames.snu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP419\A0065183.dll Infected: Trojan-PSW.Win32.OnLineGames.rul skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP419\A0065184.exe Infected: Trojan-PSW.Win32.OnLineGames.ssa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP419\A0065185.dll Infected: Packed.Win32.PolyCrypt.h skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP419\A0065193.dll Infected: Trojan-PSW.Win32.Magania.gpa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP419\A0065197.exe Infected: Trojan-PSW.Win32.OnLineGames.snu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP419\A0065198.com Infected: Trojan-PSW.Win32.OnLineGames.ssa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP419\A0065199.inf Infected: Trojan-PSW.Win32.OnLineGames.szb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP419\A0065200.exe Infected: Trojan-PSW.Win32.OnLineGames.ssa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP419\A0065201.dll Infected: Trojan-PSW.Win32.Magania.gpa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP419\A0065210.com Infected: Trojan-PSW.Win32.OnLineGames.ssa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP419\A0065211.inf Infected: Trojan-PSW.Win32.OnLineGames.szb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP419\A0065214.exe Infected: Trojan-PSW.Win32.OnLineGames.ssa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP419\A0065215.dll Infected: Trojan-PSW.Win32.Magania.gpa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP420\A0065220.com Infected: Trojan-PSW.Win32.OnLineGames.ssa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP420\A0065221.inf Infected: Trojan-PSW.Win32.OnLineGames.szb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP420\A0065236.dll Infected: Packed.Win32.PolyCrypt.h skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP420\A0065239.com Infected: Trojan-PSW.Win32.OnLineGames.ssa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP420\A0065240.inf Infected: Trojan-PSW.Win32.OnLineGames.szb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP420\A0065243.exe Infected: Trojan-PSW.Win32.OnLineGames.tfe skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP420\A0065244.dll Infected: Packed.Win32.PolyCrypt.h skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP420\A0065245.exe Infected: Trojan-PSW.Win32.OnLineGames.ssa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP420\A0065246.dll Infected: Trojan-PSW.Win32.Magania.gpa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP421\A0065257.com Infected: Trojan-PSW.Win32.OnLineGames.ssa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP421\A0065258.inf Infected: Trojan-PSW.Win32.OnLineGames.szb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP421\A0065273.com Infected: Trojan-PSW.Win32.OnLineGames.ssa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP421\A0065274.inf Infected: Trojan-PSW.Win32.OnLineGames.szb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP421\A0065275.exe Infected: Trojan-PSW.Win32.OnLineGames.tfe skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP421\A0065276.dll Infected: Packed.Win32.PolyCrypt.h skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP421\A0065277.exe Infected: Trojan-PSW.Win32.OnLineGames.ssa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP421\A0065278.dll Infected: Trojan-PSW.Win32.Magania.gpa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP421\A0065292.exe Infected: Trojan-PSW.Win32.OnLineGames.szb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP421\A0065293.dll Infected: Trojan-PSW.Win32.OnLineGames.szb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP421\A0065294.exe Infected: Trojan-PSW.Win32.OnLineGames.tfe skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP421\A0065295.inf Infected: Trojan-PSW.Win32.OnLineGames.szb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP422\A0065306.com Infected: Trojan-PSW.Win32.OnLineGames.sxa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP422\A0065307.inf Infected: Worm.Win32.AutoRun.cwv skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP422\A0065314.dll Infected: Trojan-PSW.Win32.OnLineGames.tba skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP422\A0065315.dll Infected: Trojan-PSW.Win32.OnLineGames.szc skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP422\A0065320.com Infected: Trojan-PSW.Win32.OnLineGames.sxa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP422\A0065321.inf Infected: Worm.Win32.AutoRun.cwv skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP422\A0065322.exe Infected: Trojan-PSW.Win32.OnLineGames.sxa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP422\A0065323.dll Infected: Packed.Win32.PolyCrypt.h skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP422\A0065332.exe Infected: Trojan-PSW.Win32.OnLineGames.sxa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP422\A0065333.dll Infected: Trojan-PSW.Win32.OnLineGames.szc skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP423\A0065339.cmd Infected: Trojan-PSW.Win32.OnLineGames.tfa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP423\A0065341.exe Infected: Trojan-PSW.Win32.OnLineGames.tfa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP423\A0065342.exe Infected: Trojan-PSW.Win32.OnLineGames.tfa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP423\A0065343.dll Infected: Trojan-PSW.Win32.OnLineGames.tfa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP423\A0065344.dll Infected: Trojan-PSW.Win32.OnLineGames.tfa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP424\A0065377.bat Infected: Trojan-PSW.Win32.OnLineGames.tng skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP424\A0065378.inf Infected: Trojan-PSW.Win32.OnLineGames.tng skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP424\A0065379.exe Infected: Trojan-PSW.Win32.OnLineGames.tng skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP424\A0065380.dll Infected: Trojan-PSW.Win32.OnLineGames.tng skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP424\A0065381.dll Infected: Trojan-PSW.Win32.OnLineGames.tng skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP425\A0065396.com Infected: Trojan-PSW.Win32.OnLineGames.tob skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP425\A0065409.exe Infected: Trojan-PSW.Win32.OnLineGames.tob skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP425\A0065410.dll Infected: Trojan-PSW.Win32.OnLineGames.toc skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP425\A0065434.dll Infected: Trojan-PSW.Win32.OnLineGames.toc skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP425\A0065438.exe Infected: Trojan-PSW.Win32.OnLineGames.tob skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP425\A0065441.dll Infected: Trojan-PSW.Win32.OnLineGames.toc skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP426\A0065442.com Infected: Trojan-PSW.Win32.Magania.gxd skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP426\A0066432.dll Infected: Trojan-PSW.Win32.OnLineGames.tfa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP426\A0066436.com Infected: Trojan-PSW.Win32.Magania.gxd skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP426\A0066439.exe Infected: Trojan-PSW.Win32.Magania.gxd skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP426\A0066440.dll Infected: Trojan-PSW.Win32.OnLineGames.thx skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP426\A0066466.dll Infected: Trojan-PSW.Win32.OnLineGames.tfa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP426\A0066467.dll Infected: Trojan-PSW.Win32.OnLineGames.thx skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP426\A0066471.exe Infected: Trojan-PSW.Win32.Magania.gxd skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP426\A0066472.dll Infected: Trojan-PSW.Win32.OnLineGames.thx skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP427\A0066481.com Infected: Trojan-PSW.Win32.OnLineGames.tyu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP427\A0066482.inf Infected: Trojan-PSW.Win32.OnLineGames.ufb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP427\A0067466.dll Infected: Trojan-PSW.Win32.OnLineGames.tyr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP427\A0067467.dll Infected: Trojan-PSW.Win32.OnLineGames.tfa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP427\A0067469.com Infected: Trojan-PSW.Win32.OnLineGames.tyu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP427\A0067470.inf Infected: Trojan-PSW.Win32.OnLineGames.ufb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP427\A0067493.exe Infected: Trojan-PSW.Win32.OnLineGames.tyu skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP427\A0067494.dll Infected: Trojan-PSW.Win32.OnLineGames.tyr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP428\A0067512.com Infected: Trojan-PSW.Win32.OnLineGames.ufb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP428\A0067513.inf Infected: Trojan-PSW.Win32.OnLineGames.ufb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP428\A0067517.exe Infected: Trojan-PSW.Win32.OnLineGames.ufb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP428\A0067518.dll Infected: Trojan-PSW.Win32.OnLineGames.ufb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP428\A0067521.dll Infected: Trojan-PSW.Win32.OnLineGames.ufb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP429\A0067558.com Infected: Worm.Win32.AutoRun.czh skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP429\A0067559.inf Infected: Trojan-PSW.Win32.OnLineGames.ufb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP429\A0067566.exe Infected: Worm.Win32.AutoRun.czh skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP429\A0067567.dll Infected: Trojan-PSW.Win32.OnLineGames.ufb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP429\A0067568.dll Infected: Worm.Win32.AutoRun.czh skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP430\A0067583.com Infected: Worm.Win32.AutoRun.czh skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP430\A0067584.inf Infected: Trojan-PSW.Win32.OnLineGames.ufb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP430\A0067586.exe Infected: Worm.Win32.AutoRun.czh skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP430\A0067587.dll Infected: Worm.Win32.AutoRun.czh skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP430\A0067588.dll Infected: Worm.Win32.AutoRun.czh skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP431\A0067606.com Infected: Trojan-PSW.Win32.OnLineGames.uqp skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP431\A0067608.exe Infected: Trojan-PSW.Win32.OnLineGames.uqp skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP431\A0067609.dll Infected: Trojan-PSW.Win32.OnLineGames.uqp skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP431\A0067610.dll Infected: Trojan-PSW.Win32.OnLineGames.uqp skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP431\A0068468.dll Infected: Trojan-PSW.Win32.OnLineGames.tfa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP431\A0068473.com Infected: Trojan-PSW.Win32.OnLineGames.uqp skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP431\A0068476.exe Infected: Trojan-PSW.Win32.OnLineGames.uqp skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP431\A0068477.dll Infected: Trojan-PSW.Win32.OnLineGames.uqp skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP432\A0068481.com Infected: Packed.Win32.PolyCrypt.h skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP432\A0068483.exe Infected: Packed.Win32.PolyCrypt.h skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP432\A0068484.dll Infected: Packed.Win32.PolyCrypt.h skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP432\A0068485.dll Infected: Packed.Win32.PolyCrypt.h skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP433\A0068496.cmd Infected: Trojan-PSW.Win32.OnLineGames.wdl skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP433\A0068499.dll Infected: Trojan-PSW.Win32.OnLineGames.wfo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP434\A0068515.cmd Infected: Trojan-PSW.Win32.OnLineGames.wdl skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP435\A0068518.cmd Infected: Trojan-PSW.Win32.OnLineGames.wdl skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP436\A0068520.cmd Infected: Trojan-PSW.Win32.OnLineGames.wdl skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP437\A0068544.cmd Infected: Trojan-PSW.Win32.OnLineGames.wdl skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP437\A0069468.dll Infected: Trojan-PSW.Win32.OnLineGames.tfa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP437\A0069472.cmd Infected: Trojan-PSW.Win32.OnLineGames.wdl skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP437\A0069474.exe Infected: Trojan-PSW.Win32.OnLineGames.tfa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP437\A0069475.exe Infected: Trojan-PSW.Win32.OnLineGames.wdl skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP437\A0069476.dll Infected: Trojan-PSW.Win32.OnLineGames.tfa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP437\A0069477.dll Infected: Trojan-PSW.Win32.OnLineGames.vkf skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP438\A0069481.bat Infected: Worm.Win32.AutoRun.dda skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP438\A0069489.dll Infected: Trojan-PSW.Win32.OnLineGames.tfa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP438\A0069490.dll Infected: Worm.Win32.AutoRun.dda skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP438\A0069493.bat Infected: Worm.Win32.AutoRun.dda skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP438\A0069495.exe Infected: Worm.Win32.AutoRun.dda skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP438\A0069496.dll Infected: Worm.Win32.AutoRun.dda skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP439\A0069524.bat Infected: Worm.Win32.AutoRun.dda skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP440\A0069580.bat Infected: Worm.Win32.AutoRun.dda skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP441\A0069589.bat Infected: Worm.Win32.AutoRun.dda skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP442\A0069610.bat Infected: Worm.Win32.AutoRun.dda skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP443\A0069616.bat Infected: Worm.Win32.AutoRun.dda skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP444\A0069629.bat Infected: Worm.Win32.AutoRun.dda skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP444\A0069639.dll Infected: Trojan-PSW.Win32.OnLineGames.xjk skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP444\A0069642.bat Infected: Worm.Win32.AutoRun.dda skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP444\A0069644.exe Infected: Trojan-PSW.Win32.OnLineGames.xjk skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP445\A0069645.bat Infected: Worm.Win32.AutoRun.dda skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP446\A0069652.bat Infected: Worm.Win32.AutoRun.dda skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP446\A0070640.dll Infected: Worm.Win32.AutoRun.dda skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP446\A0070642.bat Infected: Worm.Win32.AutoRun.dda skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP447\A0070645.bat Infected: Worm.Win32.AutoRun.dda skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP447\A0070654.dll Infected: Worm.Win32.AutoRun.dda skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP447\A0070655.dll Infected: Trojan-PSW.Win32.OnLineGames.aaxk skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP447\A0070659.bat Infected: Worm.Win32.AutoRun.dda skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP447\A0070661.exe Infected: Trojan-PSW.Win32.OnLineGames.xli skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP447\A0070662.dll Infected: Trojan-PSW.Win32.OnLineGames.xjk skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP447\A0070695.exe Infected: Worm.Win32.AutoRun.dda skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070820.cmd Infected: Trojan-PSW.Win32.OnLineGames.wdl skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070821.com Infected: Trojan-PSW.Win32.OnLineGames.pwh skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070822.com Infected: Worm.Win32.AutoRun.czh skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070823.com Infected: Trojan-PSW.Win32.OnLineGames.tob skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070824.bat Infected: Trojan-PSW.Win32.OnLineGames.rad skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070825.exe Infected: Trojan-PSW.Win32.OnLineGames.qii skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070826.bat Infected: Trojan-PSW.Win32.OnLineGames.qix skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070827.com Infected: Trojan-PSW.Win32.OnLineGames.szb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070828.bat Infected: Trojan-PSW.Win32.OnLineGames.qwo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070829.com Infected: Trojan-PSW.Win32.Magania.gxd skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070830.com Infected: Trojan-PSW.Win32.OnLineGames.qta skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070831.bat Infected: Worm.Win32.AutoRun.cpr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070832.com Infected: Packed.Win32.PolyCrypt.h skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070833.exe Infected: Worm.Win32.AutoRun.clt skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070834.com Infected: Trojan-PSW.Win32.OnLineGames.sxa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070835.com Infected: Trojan-PSW.Win32.OnLineGames.prs skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070836.com Infected: Trojan-PSW.Win32.OnLineGames.klz skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070837.bat Infected: Trojan-PSW.Win32.OnLineGames.rey skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070838.bat Infected: Trojan-PSW.Win32.OnLineGames.tud skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070839.exe Infected: Trojan-PSW.Win32.OnLineGames.rid skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070840.exe Infected: Trojan-PSW.Win32.OnLineGames.pvp skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070841.com Infected: Trojan-PSW.Win32.OnLineGames.uqv skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070842.cmd Infected: Trojan-PSW.Win32.OnLineGames.thf skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070843.exe Infected: Trojan-PSW.Win32.OnLineGames.skr skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070844.com Infected: Trojan-PSW.Win32.OnLineGames.rhc skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070845.cmd Infected: Trojan-PSW.Win32.OnLineGames.tfa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070846.bat Infected: Worm.Win32.AutoRun.cjo skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070847.exe Infected: Trojan-Downloader.Win32.Zlob.jfz skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP448\A0070848.dll Infected: Trojan-PSW.Win32.OnLineGames.san skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP450\A0070962.exe Infected: not-a-virus:AdTool.Win32.Zango.e skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP452\A0071093.dll Infected: Trojan-PSW.Win32.OnLineGames.xmt skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP453\A0071124.dll Infected: Trojan-PSW.Win32.OnLineGames.xmt skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP453\A0071134.dll Infected: Worm.Win32.AutoRun.dda skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP453\A0071135.dll Infected: Worm.Win32.AutoRun.dda skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP453\A0071136.dll Infected: Trojan-PSW.Win32.OnLineGames.rah skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP453\A0071169.dll Infected: Trojan-PSW.Win32.OnLineGames.xmt skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP457\A0071484.dll Infected: Trojan-PSW.Win32.OnLineGames.xmt skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP462\A0072475.dll Infected: Trojan-PSW.Win32.OnLineGames.xmt skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP462\A0072487.exe Infected: Trojan-PSW.Win32.OnLineGames.xmt skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP462\A0073468.dll Infected: Trojan-PSW.Win32.OnLineGames.aavw skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP462\A0073481.exe Infected: Trojan-PSW.Win32.OnLineGames.aasa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP462\A0074475.dll Infected: Trojan-PSW.Win32.OnLineGames.aavx skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP462\A0074476.dll Infected: Trojan-PSW.Win32.OnLineGames.aavw skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP462\A0074479.exe Infected: Trojan-PSW.Win32.OnLineGames.aasa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP462\A0074480.inf Infected: Worm.Win32.AutoRun.dkz skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP462\A0074484.exe Infected: Trojan-PSW.Win32.OnLineGames.aasa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP462\A0074511.dll Infected: Trojan-PSW.Win32.OnLineGames.aavx skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP462\A0074512.dll Infected: Trojan-PSW.Win32.OnLineGames.aavw skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP462\A0074516.exe Infected: Trojan-PSW.Win32.OnLineGames.aasa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP462\A0074517.inf Infected: Worm.Win32.AutoRun.dkz skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP462\A0074525.exe Infected: Trojan-PSW.Win32.OnLineGames.aasa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP462\A0074526.exe Infected: Trojan-PSW.Win32.OnLineGames.aasa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP463\A0074529.exe Infected: Trojan-PSW.Win32.OnLineGames.aasa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP463\A0074530.inf Infected: Worm.Win32.AutoRun.dkz skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP464\A0074539.exe Infected: Trojan-PSW.Win32.OnLineGames.aasa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP464\A0074540.inf Infected: Worm.Win32.AutoRun.dkz skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP464\A0074600.dll Infected: Trojan-PSW.Win32.OnLineGames.aavw skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP464\A0074601.dll Infected: Trojan-PSW.Win32.OnLineGames.aazm skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP464\A0074605.exe Infected: Trojan-PSW.Win32.OnLineGames.aasa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP464\A0074607.inf Infected: Worm.Win32.AutoRun.dkz skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP464\A0074612.exe Infected: Trojan-PSW.Win32.OnLineGames.aasa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP465\A0074621.exe Infected: Trojan-PSW.Win32.OnLineGames.abes skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP465\A0074622.inf Infected: Trojan-PSW.Win32.OnLineGames.abes skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP466\A0074642.exe Infected: Trojan-PSW.Win32.OnLineGames.abes skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP466\A0074643.inf Infected: Trojan-PSW.Win32.OnLineGames.abes skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP467\A0074682.exe Infected: Trojan-PSW.Win32.OnLineGames.abes skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP467\A0074683.inf Infected: Trojan-PSW.Win32.OnLineGames.abes skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP468\A0074715.exe Infected: Trojan-PSW.Win32.OnLineGames.abes skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP468\A0074716.inf Infected: Trojan-PSW.Win32.OnLineGames.abes skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP468\A0074748.dll Infected: Trojan-PSW.Win32.OnLineGames.abes skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP468\A0074749.dll Infected: Trojan-PSW.Win32.OnLineGames.abon skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP468\A0074755.exe Infected: Trojan-PSW.Win32.OnLineGames.abes skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP468\A0074757.inf Infected: Trojan-PSW.Win32.OnLineGames.abes skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP468\A0075747.dll Infected: Trojan-PSW.Win32.OnLineGames.abon skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP468\A0075748.dll Infected: Trojan-PSW.Win32.OnLineGames.abes skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP468\A0075753.exe Infected: Trojan-PSW.Win32.OnLineGames.abes skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP468\A0075754.inf Infected: Trojan-PSW.Win32.OnLineGames.abes skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP468\A0075758.exe Infected: Trojan-PSW.Win32.OnLineGames.abon skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP468\A0075760.exe Infected: Trojan-PSW.Win32.OnLineGames.abes skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP468\A0075898.dll Infected: Trojan-PSW.Win32.OnLineGames.abxy skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP468\A0075899.dll Infected: Trojan-PSW.Win32.OnLineGames.abxx skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP468\A0075902.com Infected: Trojan.Win32.Vaklik.aeg skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP468\A0075904.exe Infected: Trojan.Win32.Vaklik.aeg skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP469\A0075956.bat Infected: Trojan-PSW.Win32.OnLineGames.acak skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP470\A0075988.bat Infected: Trojan-PSW.Win32.OnLineGames.acak skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP471\A0076175.bat Infected: Trojan-PSW.Win32.OnLineGames.acak skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP471\A0076358.dll Infected: Trojan-PSW.Win32.OnLineGames.abxy skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP471\A0076359.dll Infected: Trojan-PSW.Win32.OnLineGames.acaj skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP471\A0076363.bat Infected: Trojan-PSW.Win32.OnLineGames.acak skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP471\A0076365.exe Infected: Trojan-PSW.Win32.OnLineGames.acak skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP471\A0076366.exe Infected: Trojan-PSW.Win32.OnLineGames.abya skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP471\A0076382.dll Infected: Worm.Win32.AutoRun.dny skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP471\A0076383.dll Infected: Worm.Win32.AutoRun.dny skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP471\A0076386.cmd Infected: Worm.Win32.AutoRun.dny skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP471\A0076389.exe Infected: Worm.Win32.AutoRun.dny skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP471\A0076399.dll Infected: Worm.Win32.AutoRun.dny skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP471\A0076400.dll Infected: Worm.Win32.AutoRun.dny skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP471\A0076404.cmd Infected: Worm.Win32.AutoRun.dny skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP471\A0076406.exe Infected: Worm.Win32.AutoRun.dny skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP471\A0076407.exe Infected: Worm.Win32.AutoRun.dny skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP472\A0076408.bat Infected: Trojan-PSW.Win32.OnLineGames.acng skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP472\A0076443.dll Infected: Trojan-PSW.Win32.Magania.mpb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP472\A0076444.dll Infected: Trojan-PSW.Win32.OnLineGames.acng skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP472\A0076447.bat Infected: Trojan-PSW.Win32.OnLineGames.acng skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP472\A0076449.exe Infected: Trojan-PSW.Win32.Magania.mpb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP472\A0076450.exe Infected: Trojan-PSW.Win32.OnLineGames.acng skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP473\A0076451.bat Infected: Trojan-PSW.Win32.OnLineGames.acng skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP473\A0076453.exe Infected: Trojan-PSW.Win32.OnLineGames.acng skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP473\A0076454.dll Infected: Trojan-PSW.Win32.Magania.mpb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP473\A0076455.dll Infected: Trojan-PSW.Win32.OnLineGames.acng skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP473\A0076469.exe Infected: Trojan-PSW.Win32.Magania.mpb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP473\A0076470.exe Infected: Trojan-PSW.Win32.OnLineGames.abes skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP473\A0076471.exe Infected: Trojan-PSW.Win32.OnLineGames.aasa skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP474\A0078472.dll Infected: not-a-virus:AdWare.Win32.Shopper.q skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP474\A0078473.dll Infected: Trojan-PSW.Win32.OnLineGames.xmt skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP474\A0078474.dll Infected: Trojan-PSW.Win32.Magania.mpb skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP475\A0079530.com Infected: Trojan.Win32.Vaklik.aeg skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP475\A0079531.cmd Infected: Worm.Win32.AutoRun.dny skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP475\A0079532.bat Infected: Trojan-PSW.Win32.OnLineGames.acak skipped C:\System Volume Information\_restore{09803B7C-F708-4EC5-B05F-7F9A13B82ACB}\RP477\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{DA06918C-8BAF-42F0-BFB8-DE5D6DAB9877}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed.

Attached Files



#10 average1

average1

    New Member

  • New Member
  • Pip
  • 11 posts

Posted 03 May 2008 - 07:23 AM

Im not letting my gf use my laptop for games ever again.......this is ridiculous.... Do I have to delete limewire and ALL my music just to get rid of the two or 3 tracks that are infected??? I have very few songs on there but stuff that I cant buy in Canada so I hope I dont have to lose everything, I'm sure as hell not downloading anything anymore.........UNLESS there IS a way to scan a song or file before downloading it???

Edited by average1, 03 May 2008 - 07:32 AM.


#11 Scotty

Scotty

    Always Happy

  • Authentic Member
  • PipPipPipPipPip
  • 3,634 posts

Posted 03 May 2008 - 09:49 AM

Hi

You dont need to uninstall Limewire, we will just remove what file is infected. You have to be careful when using filesharing programs though. They are the main source of infection.
BTW, the majority of the Kaspersky reported infections are in System Restore. We will be flushing that out, and removing Qoobox, when you remove Combofix.


Step 1:

Remember to disconnect from the Internet before carrying out the next instruction, and to save the following script before you do.You must
also manually disable your anti-virus and anti-spyware programs. See the link below for instructions on doing this.

http://www.bleepingc...opic114351.html

Open Notepad - it must be Notepad, not Wordpad.
Copy the text below in the code box by highlighting all the text with your mouse and pressing Ctrl+C

KillAll::
 
File::
C:\Documents and Settings\Jesse\My Documents\LimeWire\Incomplete\Preview-T-3545425-munga v s.mp3
C:\Documents and Settings\Jesse\My Documents\LimeWire\Saved\munga v s.mp3
C:\Documents and Settings\Jesse\My Documents\LimeWire\Saved\night creature riddim.mp3
C:\Documents and Settings\Jesse\My Documents\prisma1[1].4-setup_exe.vir

Go to the Notepad window and click Edit > Paste
Then click File > Save
Name the file "CFScript.txt" (including the quotes)
Save the file to your Desktop

Posted Image


Refering to the picture above, drag CFScript into ComboFix.exe

In your next reply post:
ComboFix.txt

Step 2:
After posting the above do this.

Time for some housekeeping
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the x and the /u, it needs to be there.

    Posted Image


Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it.

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache

*The other boxes are optional*
Then click the Empty Selected button.

Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

*Note* If you do not have Firefox or Opera, those options will be greyed out.


Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform full scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location.
  • The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
  • Post that log back here with a new HijackThis log.

You too could train to help others- Join the Classroom

Posted Image


Posted Image

Posted Image

#12 average1

average1

    New Member

  • New Member
  • Pip
  • 11 posts

Posted 03 May 2008 - 02:04 PM

Okay here are the logfiles from CF, MWB, and HJT

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Documents and Settings\Jesse\My Documents\LimeWire\Incomplete\Preview-T-3545425-munga v s.mp3
C:\Documents and Settings\Jesse\My Documents\LimeWire\Saved\munga v s.mp3
C:\Documents and Settings\Jesse\My Documents\LimeWire\Saved\night creature riddim.mp3
C:\Documents and Settings\Jesse\My Documents\prisma1[1].4-setup_exe.vir
.
/wow section - STAGE 41
pv: No matching processes found
The process cannot access the file because it is being used by another process.
The process cannot access the file because it is being used by another process.
The process cannot access the file because it is being used by another process.
The process cannot access the file because it is being used by another process.
The process cannot access the file because it is being used by another process.


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Jesse\My Documents\LimeWire\Incomplete\Preview-T-3545425-munga v s.mp3
C:\Documents and Settings\Jesse\My Documents\LimeWire\Saved\munga v s.mp3
C:\Documents and Settings\Jesse\My Documents\LimeWire\Saved\night creature riddim.mp3
C:\Documents and Settings\Jesse\My Documents\prisma1[1].4-setup_exe.vir

.
((((((((((((((((((((((((( Files Created from 2008-04-03 to 2008-05-03 )))))))))))))))))))))))))))))))
.

2008-05-02 19:10 . 2008-05-02 19:10 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-05-02 19:10 . 2008-05-02 19:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-04-30 07:46 . 2008-04-30 07:46 <DIR> d-------- C:\Documents and Settings\Jesse\Application Data\Malwarebytes
2008-04-30 07:45 . 2008-04-30 08:19 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-30 07:45 . 2008-04-30 07:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-30 07:07 . 2008-05-02 06:46 <DIR> d-------- C:\Documents and Settings\Jesse\Application Data\LimeWire
2008-04-30 06:50 . 2008-04-30 06:50 <DIR> d-------- C:\Program Files\Avira
2008-04-30 06:50 . 2008-04-30 06:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-04-30 06:07 . 2008-05-02 09:53 <DIR> d-------- C:\Program Files\LimeWire
2008-04-14 05:30 . 2008-04-14 05:31 <DIR> d-------- C:\Program Files\Interpretive Simulations
2008-04-08 16:34 . 2008-04-28 11:22 <DIR> d-------- C:\Program Files\Common Files\Panda Software
2008-04-08 11:58 . 2008-04-28 11:03 <DIR> d-------- C:\Program Files\Opera
2008-04-08 10:40 . 2008-04-08 11:44 <DIR> dr-h----- C:\$VAULT$.AVG
2008-04-08 10:28 . 2008-04-08 10:40 <DIR> d-------- C:\Documents and Settings\Jesse\Application Data\AVG7
2008-04-08 10:09 . 2008-04-08 10:09 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-04-08 10:08 . 2008-04-08 16:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-03 14:16 --------- d-----w C:\Program Files\AlphaZIP
2008-04-30 14:39 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-04-28 18:22 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-09 19:50 --------- d-----w C:\Program Files\Syncrosoft
2008-04-09 19:06 --------- d-----w C:\Program Files\Java
2008-04-08 18:40 --------- d-----w C:\Program Files\ImgBurn
2007-04-02 00:41 314 ----a-w C:\Program Files\INSTALL.LOG
.

((((((((((((((((((((((((((((( snapshot@2008-04-30_ 9.26.14.00 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-30 16:16:23 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-03 18:53:44 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2008-04-15 00:00:30 58,904 ----a-w C:\WINDOWS\system32\azipcontmn.dll
+ 2008-05-03 13:19:46 58,904 ----a-w C:\WINDOWS\system32\azipcontmn.dll
+ 2005-05-24 19:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 22:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 22:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24 1694208]
"BIBLauncher"="C:\Program files\Business-in-a-BoxBIBLauncher.exe" [ ]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 10:37 2321600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2003-10-01 22:37 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2003-10-01 22:19 118784]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-12-08 18:35 32768]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 03:50 155648]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2004-03-03 08:47 1294446]
"Motive SmartBridge"="C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe" [2004-10-22 15:13 393216]
"SSA.exe"="C:\Program Files\Bell\Sympatico Security Advisor\SSA.exe" [2006-05-15 10:41 1986560]
"StandardInstall"="" []
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-31 18:44 271672]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 05:00 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 20:28:24 258048]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 20:50:52 53248]
NetAssistant.lnk - C:\Program Files\NetAssistant\bin\matcli.exe [2007-04-01 18:12:51 217088]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Documents and Settings\\Jesse\\Desktop\\Magic\\Manalink.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=

S2 MBAMService;MBAMService;"C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe" [2008-04-07 20:17]

.
Contents of the 'Scheduled Tasks' folder
"2008-05-03 18:54:00 C:\WINDOWS\Tasks\SDMsgUpdate (TE).job"
- C:\PROGRA~1\SMARTD~1\Messages\SDNotify.exeW-PTE -V900 -SSDU.ini -A -Mhttp://www.smartdraw.com/msgs/messagecheck.aspx -D0 -T -N -X
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-03 11:54:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Ahead\InCD\incdsrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\SMARTD~1\Messages\SDNotify.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\NetAssistant\bin\mpbtn.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-05-03 12:00:59 - machine was rebooted [Jesse]
ComboFix-quarantined-files.txt 2008-05-03 19:00:39
ComboFix2.txt 2008-04-30 19:48:11
ComboFix3.txt 2008-04-30 17:22:03
ComboFix4.txt 2008-04-30 16:27:04

Pre-Run: 41,744,130,048 bytes free
Post-Run: 41,730,973,696 bytes free

142 --- E O F --- 2008-04-08 19:06:12


MWB

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 81165
Time elapsed: 38 minute(s), 2 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


HJT

Logfile of HijackThis v1.99.1
Scan saved at 12:56, on 2008-05-03
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Bell\Sympatico Security Advisor\SSA.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\NetAssistant\bin\mpbtn.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://firefox.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [SSA.exe] "C:\Program Files\Bell\Sympatico Security Advisor\SSA.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BIBLauncher] C:\Program files\Business-in-a-BoxBIBLauncher.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: NetAssistant.lnk = C:\Program Files\NetAssistant\bin\matcli.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file://C:\Program Files\Chocolatier\Images\stg_drm.ocx
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file://C:\Program Files\Chocolatier\Images\armhelper.ocx
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MBAMService - Malwarebytes - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

#13 Scotty

Scotty

    Always Happy

  • Authentic Member
  • PipPipPipPipPip
  • 3,634 posts

Posted 03 May 2008 - 02:08 PM

Congratulations, you appear to be malware free. :woot:


Delete the older versions of Java and download the newest.
Please follow these steps to remove older version Java components.
  • Close any programmes you may have running, ESPECIALLY your web browser
  • Click Start > Control Panel.
  • Click Add/Remove Programs.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove all versions of Java.
  • Reboot your computer once all Java components are removed.
Then download the latest version of Java Runtime Environment (JRE) (5th one down the list), which is JRE6u6, and click Yes at the page warning. Under "Platform" select Windows, then check the box to accept the Licence Agreement. Click Yes at the second page warning before downloading the Offline file.
There is no need to download the Sun Download manager but it is optional.


Malwarebytes Anti-Malware is a good program to keep. If you wish to keep it, use it to do a quick scan once a week and keep it updated.
Remember, only the paid for version offers real-time protection

Here is another couple of free programs I recommend.

Winpatrol
Winpatrol is heuristic protection program, meaning it looks for patterns in codes that work like malware. It also takes a snapshot of your system's critical resources and alerts you to any changes that may occur without you knowing. You can read more about Winpatrol's features here.

You can get a free copy of Winpatrol or use the Plus version for more features.

You can read Winpatrol's FAQ if you run into problems.

Spyware Blaster
SpywareBlaster is a program that is used to secure Internet Explorer by making it harder for ActiveX programs to run on your computer. It does this by disabling known offending ActiveX programs from running at all.

You can download SpywareBlaster from Javacool.

If you need help in using SpywareBlaster, you can read SpywareBlaster's tutorial at Bleeping Computer.


Hosts File
A Hosts file is like a phone book. You look up someone's name in the phone book before calling him/her. Similarly, your PC will look up the website's IP address before you can view the website.

Hosts file will replace your current Hosts file with another one containing well-known advertisement sites, spyware sites and other bad sites. This new Hosts file will protect you by re-directing these bad sites to 127.0.0.1.

Here is a good Hosts file:

MVPS Hosts File

A tutorial about Hosts File can be found at Malware Removal.


Make sure your Windows is ALWAYS up to date!

An unpatched Windows is vulnerable and even with the "best" Antivirus and Firewall installed, malware will find its way through.
So visit http://windowsupdate.microsoft.com/ to download and install the latest updates.


Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Please check out Tony Klein's article "How did I get infected in the first place?"

Here is some great information from experts in this field that will help you stay clean and safe online.
http://forum.malware...wtopic.php?t=14

Follow this list and your potential for being infected again will reduce dramatically.

I'd be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can be closed.
You too could train to help others- Join the Classroom

Posted Image


Posted Image

Posted Image

#14 average1

average1

    New Member

  • New Member
  • Pip
  • 11 posts

Posted 03 May 2008 - 02:53 PM

Thank you so very much. All the other info is amazing too, I really appreciate all the help. If it weren't for you my pc would still be messed up. I owe you one. cheers.

#15 Scotty

Scotty

    Always Happy

  • Authentic Member
  • PipPipPipPipPip
  • 3,634 posts

Posted 03 May 2008 - 05:18 PM

Since this issue appears to be resolved ... this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.
You too could train to help others- Join the Classroom

Posted Image


Posted Image

Posted Image

Related Topics



0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users