[Closed] Privacy In Danger bug troubles

Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the HJT forum and wait for help.

Unless informed of in advance, failure to post replies within 5 days will result in this thread being closed.

Hi swage

I'm Gary R, I'll be glad to help you with your computer problems.

Please observe these rules while we work:

• Perform all actions in the order given.
• If you don't know, stop and ask! Don't keep going on.
• Please reply to this thread. Do not start a new topic.
• Stick with it till you're given the all clear.
• Remember, absence of symptoms does not mean the infection is all gone.

If you can do these things, everything should go smoothly.

• If you're using XP, you'll need Administrator privileges to perform the fixes. (XP accounts are Administrator by default)
• If you're using Vista, it will be necessary to right click all tools we use and select —-> Run as Admistrator

It may be helpful to you to print out or take a copy of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Download SDFix and save it to your Desktop.

• Double click SDFix.exe
• Accept default location and click Install button.
• It will now extract the files to C:\SDFix

Reboot your computer into Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
• Choose your usual account.

Note: if you cannot boot into safe mode using this method, DO NOT attempt to do so by using MSConfig, this could result in your computer becoming unbootable. Just let me know.

Once in safe mode.

• Open the extracted SDFix folder and double click RunThis.bat to start the script.
• Type Y to begin the cleanup process.
• It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
  (Report.txt will also be copied to Clipboard ready for posting back on the forum).
• Finally paste me the contents of Report.txt

Next

Please download Malwarebytes' Anti-Malware to your Desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.

• Click on the Malwarebytes' Anti-Malware icon to launch the programme.
  
  • Click the Updates tab.
    
  • Click Check for Updates and allow the programme to download the latest definitions.
• Click the Scanner tab.
  
  • Check Perform Quick Scan.
  • Click Scan and wait for the scan to complete.
  • When the scan is complete, click OK, then Show Results.
  • Ensure all items are checked then click Remove Selected.
    
  • A box will pop-up telling you that files have been quarantined.
  • A log will pop-up.
• Post the log in your next reply please.

You can also access the log by doing the following

• Click on the Logs tab.
  
• Click on the log at the bottom of those listed to highlight it.
• Click Open

Next

Run a new scan with HJT and post me the log please.

Summary of the logs I need from you in your next post:

• SDFix log (report.txt)
• MBAM log
• New HJT log

Please post each log separately to prevent them being cut off by the forum post size limiter.

Malwarebytes' Anti-Malware 1.18 Database version: 871 1:41:28 PM 6/20/2008 mbam-log-6-20-2008 (13-41-25).txt Scan type: Quick Scan Objects scanned: 47457 Time elapsed: 8 minute(s), 24 second(s) Memory Processes Infected: 3 Memory Modules Infected: 0 Registry Keys Infected: 7 Registry Values Infected: 5 Registry Data Items Infected: 1 Folders Infected: 3 Files Infected: 23 Memory Processes Infected: C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\winlogan.exe (Trojan.Downloader) -> No action taken. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\csrssc.exe (Trojan.Downloader) -> No action taken. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\csrssc.exe (Trojan.Downloader) -> No action taken. Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\Software\UpMedia (Adware.SmartShopper) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> No action taken. HKEY_CURRENT_USER\Software\Adsl Software Limited (Rogue.MalWarrior) -> No action taken. HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{0351d11c-1087-4a1e-b4f6-586a144059ff} (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jdgf894jrghoiiskd (Trojan.Downloader) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jdgf894jrghoiiskd (Trojan.Downloader) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Jnskdfmf9eldfd (Trojan.Downloader) -> No action taken. HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page (Trojan.FakeAlert) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> No action taken. Registry Data Items Infected: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> No action taken. Folders Infected: C:\WINDOWS\system32\UpMedia (Adware.SmartShopper) -> No action taken. C:\Documents and Settings\All Users\Application Data\Adsl Software Limited (Rogue.MalWarrior) -> No action taken. C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\WinSpywareProtect (Rogue.MalWarrior) -> No action taken. Files Infected: C:\WINDOWS\system32\iiffGYon.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\noYGffii.ini (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\noYGffii.ini2 (Trojan.Vundo) -> No action taken. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\winlogan.exe (Trojan.Downloader) -> No action taken. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\csrssc.exe (Trojan.Downloader) -> No action taken. C:\WINDOWS\system32\awtuUMgE.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\rqRkIAst.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\yayyVnKd.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\eaqb.exe (Trojan.FakeAlert) -> No action taken. C:\nnjamld.exe (Trojan.Agent) -> No action taken. C:\ptgttuaq.exe (Trojan.FakeAlert) -> No action taken. C:\tqwkrav.exe (Trojan.Agent) -> No action taken. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\H0DO1CEW\luzznriima[1].htm (Trojan.Agent) -> No action taken. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\KO2L467U\dwxnbsj[1].htm (Trojan.Agent) -> No action taken. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\KO2L467U\tuylqdhim[1].htm (Trojan.FakeAlert) -> No action taken. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\P8XLK3P5\1279.0[1].exe (Trojan.FakeAlert) -> No action taken. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\PNYYG01O\tuhvzqdrv[1].htm (Trojan.FakeAlert) -> No action taken. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\PNYYG01O\wmvcodec2.03[1].exe (Trojan.Vundo) -> No action taken. C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\WinSpywareProtect\WinSpywareProtect.exe (Rogue.MalWarrior) -> No action taken. C:\WINDOWS\system32\xxyWNeFx.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\gEwwWmJD.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\mlJYrRkj.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> No action taken.

You have not followed the directions for using MBAM as I gave them to you.

Run the scan again, paying particular attention this time to the part highlighted in red.

• Double-click mbam-setup.exe and follow the prompts to install the program.

• Click on the Malwarebytes' Anti-Malware icon to launch the programme.
  
  • Click the Updates tab.
    
  • Click Check for Updates and allow the programme to download the latest definitions.
• Click the Scanner tab.
  
  • Check Perform Quick Scan.
  • Click Scan and wait for the scan to complete.
  • When the scan is complete, click OK, then Show Results.
  • Ensure all items are checked then click Remove Selected.
    
  • A box will pop-up telling you that files have been quarantined.
  • A log will pop-up.
• Post the log in your next reply please.

You can also access the log by doing the following

• Click on the Logs tab.
  
• Click on the log at the bottom of those listed to highlight it.
• Click Open

Don't forget to run a new scan with HJT and post me the log please

Hey, Apologies about that, seconds after I posted the log I realized that I had missed a step, but before I could correct it, I lost my internet access… Really appreciate your help, this thing has been driving me crazy. Malwarebytes' Anti-Malware 1.18 Database version: 871 1:54:49 PM 6/20/2008 mbam-log-6-20-2008 (13-54-49).txt Scan type: Quick Scan Objects scanned: 47457 Time elapsed: 8 minute(s), 24 second(s) Memory Processes Infected: 3 Memory Modules Infected: 0 Registry Keys Infected: 7 Registry Values Infected: 5 Registry Data Items Infected: 1 Folders Infected: 3 Files Infected: 23 Memory Processes Infected: C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\winlogan.exe (Trojan.Downloader) -> Unloaded process successfully. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\csrssc.exe (Trojan.Downloader) -> Unloaded process successfully. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\csrssc.exe (Trojan.Downloader) -> Unloaded process successfully. Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\Software\UpMedia (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Adsl Software Limited (Rogue.MalWarrior) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{0351d11c-1087-4a1e-b4f6-586a144059ff} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jdgf894jrghoiiskd (Trojan.Downloader) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jdgf894jrghoiiskd (Trojan.Downloader) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Jnskdfmf9eldfd (Trojan.Downloader) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: C:\WINDOWS\system32\UpMedia (Adware.SmartShopper) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\Adsl Software Limited (Rogue.MalWarrior) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\WinSpywareProtect (Rogue.MalWarrior) -> Quarantined and deleted successfully. Files Infected: C:\WINDOWS\system32\iiffGYon.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\noYGffii.ini (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\noYGffii.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\winlogan.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\csrssc.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\system32\awtuUMgE.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\rqRkIAst.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\yayyVnKd.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\eaqb.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\nnjamld.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\ptgttuaq.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\tqwkrav.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\H0DO1CEW\luzznriima[1].htm (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\KO2L467U\dwxnbsj[1].htm (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\KO2L467U\tuylqdhim[1].htm (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\P8XLK3P5\1279.0[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\PNYYG01O\tuhvzqdrv[1].htm (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\PNYYG01O\wmvcodec2.03[1].exe (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\WinSpywareProtect\WinSpywareProtect.exe (Rogue.MalWarrior) -> Quarantined and deleted successfully. C:\WINDOWS\system32\xxyWNeFx.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\gEwwWmJD.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\mlJYrRkj.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.

Still some work to do.

Download OTMoveIt2 by Old Timer and save it to your Desktop.

• Double-click OTMoveIt2.exe to run it.
• Copy the lines in the codebox below.

C:\WINDOWS\system32\kdxbv.exe
C:\WINDOWS\system32\iifdbYQI.dll
C:\Program Files\Common Files\Microsoft Shared\MSInfo\Network.exe

• Return to OTMoveIt2, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.

• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar), and paste it in your next reply.
• Close OTMoveIt2

Next

Run a scan with HJT and when finished check the following items (if found).

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxbv.exe] C:\WINDOWS\system32\kdxbv.exe

O20 - Winlogon Notify: iifdbyqi - iifdbYQI.dll (file missing)

O23 - Service: Windows Network Log Manage - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\MSInfo\Network.exe



Now close all open windows and click Fix Checked to remove them.

Next

• Click Start > Run and type cleanmgr then click OK.
• This will bring up the Disk Cleanup window.
• Check the following entries.
  
  • Temporary Internet Files.
  • Recycle Bin.
  • Temporary Files.
• Click OK.
• When a prompt pops up click Yes.

Next

Please do an online scan with Kaspersky Online Scanner

Note: You must be using Internet Explorer as your browser as it will be necessary to install an Active X component to your computer.

Important If you have previously used Kaspersky Online Scanner (before 8th Aug 2006), you will have to uninstall the old version using Add/Remove Programs in Control Panel before you can use the new version.

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then start to download the latest definition files.
• Once the scanner is installed and the definitions downloaded, click Next.
• Now click on Scan Settings.
• In the scan settings make sure that the following are selected:
  
  • Scan using the following Anti-Virus database:
    
    • Extended (If available otherwise Standard)
  • Scan Options:
    
    • Scan Archives
    • Scan Mail Bases
• Click OK.
• Now under select a target to scan select My Computer.
• The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
• Click the Save Report As… button (see red arrow below)
  
  [external image: Posted Image]
  
• In the Save as… prompt, select Desktop
• In the File name box, name the file KAVScan
• In the Save as type prompt, select Text file (see below)
  
  [external image: Posted Image]
• Copy and paste that information in your next post please.

Note: The Kaspersky online scanner is not yet fully compatible with IE7. You may get returned to a window without the Accept/Decline buttons after allowing the ActiveX control. The buttons are there - you just can't see them! Click on the zoom button (bottom, right of the window) and change it from 100% to 75%. You should now see the buttons. Reset to 100% once the license has been accepted.

Finally

Run a new scan with HJT and post me the log please.

Summary of the logs I need from you in your next post:

• OTMoveIt log
• Kaspersky log
• New HJT log

Please post each log separately to prevent them being cut off by the forum post size limiter.

Still some work to do.

Download OTMoveIt2 by Old Timer and save it to your Desktop.

• Double-click OTMoveIt2.exe to run it.
• Copy the lines in the codebox below.

C:\WINDOWS\system32\kdxbv.exe
C:\WINDOWS\system32\iifdbYQI.dll
C:\Program Files\Common Files\Microsoft Shared\MSInfo\Network.exe

• Return to OTMoveIt2, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.

• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar), and paste it in your next reply.
• Close OTMoveIt2

Next

Run a scan with HJT and when finished check the following items (if found).

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxbv.exe] C:\WINDOWS\system32\kdxbv.exe

O20 - Winlogon Notify: iifdbyqi - iifdbYQI.dll (file missing)

O23 - Service: Windows Network Log Manage - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\MSInfo\Network.exe



Now close all open windows and click Fix Checked to remove them.

Next

• Click Start > Run and type cleanmgr then click OK.
• This will bring up the Disk Cleanup window.
• Check the following entries.
  
  • Temporary Internet Files.
  • Recycle Bin.
  • Temporary Files.
• Click OK.
• When a prompt pops up click Yes.

Next

Please do an online scan with Kaspersky Online Scanner

Note: You must be using Internet Explorer as your browser as it will be necessary to install an Active X component to your computer.

Important If you have previously used Kaspersky Online Scanner (before 8th Aug 2006), you will have to uninstall the old version using Add/Remove Programs in Control Panel before you can use the new version.

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then start to download the latest definition files.
• Once the scanner is installed and the definitions downloaded, click Next.
• Now click on Scan Settings.
• In the scan settings make sure that the following are selected:
  
  • Scan using the following Anti-Virus database:
    
    • Extended (If available otherwise Standard)
  • Scan Options:
    
    • Scan Archives
    • Scan Mail Bases
• Click OK.
• Now under select a target to scan select My Computer.
• The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
• Click the Save Report As… button (see red arrow below)
  
  [external image: Posted Image]
  
• In the Save as… prompt, select Desktop
• In the File name box, name the file KAVScan
• In the Save as type prompt, select Text file (see below)
  
  [external image: Posted Image]
• Copy and paste that information in your next post please.

Note: The Kaspersky online scanner is not yet fully compatible with IE7. You may get returned to a window without the Accept/Decline buttons after allowing the ActiveX control. The buttons are there - you just can't see them! Click on the zoom button (bottom, right of the window) and change it from 100% to 75%. You should now see the buttons. Reset to 100% once the license has been accepted.

Finally

Run a new scan with HJT and post me the log please.

Summary of the logs I need from you in your next post:

• OTMoveIt log
• Kaspersky log
• New HJT log

Please post each log separately to prevent them being cut off by the forum post size limiter.

OTMoveIt2 by OldTimer - Version 1.0.4.2 log created on 06212008_124239 Files moved on Reboot… File move failed. C:\Program Files\Common Files\Microsoft Shared\MSInfo\Network.exe scheduled to be moved on reboot. & ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Sunday, June 22, 2008 11:08:05 Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 22/06/2008 Kaspersky Anti-Virus database records: 880080 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 124784 Number of viruses found: 19 Number of infected objects: 53 Number of suspicious objects: 0 Duration of the scan process: 02:03:25 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\Administrator\Desktop\catchme.zip/kdxbv.exe Infected: Trojan.Win32.Monder.gen skipped C:\Documents and Settings\Administrator\Desktop\catchme.zip/spools.exe Infected: Worm.Win32.Socks.agj skipped C:\Documents and Settings\Administrator\Desktop\catchme.zip ZIP: infected - 2 skipped C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-01302007-224454.log Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\QUAR1.38481 Infected: Trojan-Downloader.Win32.Suurch.ef skipped C:\Documents and Settings\Owner.SWAGE\Application Data\Mozilla\Firefox\Profiles\ccsjigus.default\cert8.db Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Application Data\Mozilla\Firefox\Profiles\ccsjigus.default\content-prefs.sqlite Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Application Data\Mozilla\Firefox\Profiles\ccsjigus.default\cookies.sqlite Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Application Data\Mozilla\Firefox\Profiles\ccsjigus.default\downloads.sqlite Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Application Data\Mozilla\Firefox\Profiles\ccsjigus.default\formhistory.sqlite Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Application Data\Mozilla\Firefox\Profiles\ccsjigus.default\key3.db Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Application Data\Mozilla\Firefox\Profiles\ccsjigus.default\parent.lock Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Application Data\Mozilla\Firefox\Profiles\ccsjigus.default\permissions.sqlite Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Application Data\Mozilla\Firefox\Profiles\ccsjigus.default\places.sqlite Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Application Data\Mozilla\Firefox\Profiles\ccsjigus.default\places.sqlite-journal Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Application Data\Mozilla\Firefox\Profiles\ccsjigus.default\places.sqlite-stmtjrnl Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Application Data\Mozilla\Firefox\Profiles\ccsjigus.default\search.sqlite Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\class%2560.class-1168912c-19632770.class Infected: Trojan-Clicker.HTML.IFrame.fh skipped C:\Documents and Settings\Owner.SWAGE\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\class%2560.class-70ebe39c-78ca0209.class Infected: Trojan-Clicker.HTML.IFrame.fh skipped C:\Documents and Settings\Owner.SWAGE\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-3ad601a5-4afde81b.zip/vmain.class Infected: Exploit.Java.Gimsh.b skipped C:\Documents and Settings\Owner.SWAGE\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-3ad601a5-4afde81b.zip ZIP: infected - 1 skipped C:\Documents and Settings\Owner.SWAGE\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-51fad18-3ec60652.zip/vmain.class Infected: Exploit.Java.Gimsh.a skipped C:\Documents and Settings\Owner.SWAGE\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-51fad18-3ec60652.zip ZIP: infected - 1 skipped C:\Documents and Settings\Owner.SWAGE\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-5efd1945-10ea8384.zip/vmain.class Infected: Exploit.Java.Gimsh.b skipped C:\Documents and Settings\Owner.SWAGE\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-5efd1945-10ea8384.zip ZIP: infected - 1 skipped C:\Documents and Settings\Owner.SWAGE\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Desktop\Installation Files\Magic.DVD.Ripper.v5.0.1.Incl.Keymaker-ARN\crack.rar/crack.exe Infected: Backdoor.Win32.Rbot.bll skipped C:\Documents and Settings\Owner.SWAGE\Desktop\Installation Files\Magic.DVD.Ripper.v5.0.1.Incl.Keymaker-ARN\crack.rar RAR: infected - 1 skipped C:\Documents and Settings\Owner.SWAGE\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\Owner.SWAGE\Desktop\SmitfraudFix.exe/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\Owner.SWAGE\Desktop\SmitfraudFix.exe RAR: infected - 1 skipped C:\Documents and Settings\Owner.SWAGE\Local Settings\Application Data\Last.fm\Client\lastfmhelper.log Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Local Settings\Application Data\Mozilla\Firefox\Profiles\ccsjigus.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Local Settings\Application Data\Mozilla\Firefox\Profiles\ccsjigus.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Local Settings\Application Data\Mozilla\Firefox\Profiles\ccsjigus.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Local Settings\Application Data\Mozilla\Firefox\Profiles\ccsjigus.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Local Settings\Application Data\Mozilla\Firefox\Profiles\ccsjigus.default\urlclassifier3.sqlite Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Local Settings\History\History.IE5\MSHist012008062220080623\index.dat Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\hsperfdata_Owner\3836 Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\MPSampleSubmit\r81213.exe.xor Infected: Trojan-Downloader.Win32.Agent.ppm skipped C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\~os5A.tmp\rkupginstaller.exe Infected: not-a-virus:AdWare.Win32.Relevant.d skipped C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\H0DO1CEW\css4[2] Infected: Trojan.Win32.Monder.ya skipped C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\H0DO1CEW\kb456456[1] Infected: Trojan.Win32.Monder.yc skipped C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner.SWAGE\My Documents\Downloads\Magic_DVD_Ripper_v5.3-build-4+Keygen_tested\keygen.exe Infected: Trojan-Dropper.Win32.Agent.rub skipped C:\Documents and Settings\Owner.SWAGE\My Documents\Downloads\Magic_DVD_Ripper_v5.3-build-4+Keygen_tested\MagicDVDRipper53.exe/data0000 Infected: Trojan-Dropper.Win32.Agent.rub skipped C:\Documents and Settings\Owner.SWAGE\My Documents\Downloads\Magic_DVD_Ripper_v5.3-build-4+Keygen_tested\MagicDVDRipper53.exe EmbeddedEXE: infected - 1 skipped C:\Documents and Settings\Owner.SWAGE\My Documents\Downloads\Magic_DVD_Ripper_v5.3-build-4+Keygen_tested.rar/Magic_DVD_Ripper_v5.3-build-4+Keygen_tested/keygen.exe Infected: Trojan-Dropper.Win32.Agent.rub skipped C:\Documents and Settings\Owner.SWAGE\My Documents\Downloads\Magic_DVD_Ripper_v5.3-build-4+Keygen_tested.rar/Magic_DVD_Ripper_v5.3-build-4+Keygen_tested/MagicDVDRipper53.exe/data0000 Infected: Trojan-Dropper.Win32.Agent.rub skipped C:\Documents and Settings\Owner.SWAGE\My Documents\Downloads\Magic_DVD_Ripper_v5.3-build-4+Keygen_tested.rar/Magic_DVD_Ripper_v5.3-build-4+Keygen_tested/MagicDVDRipper53.exe Infected: Trojan-Dropper.Win32.Agent.rub skipped C:\Documents and Settings\Owner.SWAGE\My Documents\Downloads\Magic_DVD_Ripper_v5.3-build-4+Keygen_tested.rar RAR: infected - 3 skipped C:\Documents and Settings\Owner.SWAGE\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Owner.SWAGE\ntuser.dat.LOG Object is locked skipped C:\Program Files\BigFix\__Data\Gateway\__Local\Tmp\Gateway_Specific.dat Object is locked skipped C:\Program Files\BigFix\__Data\Gateway\__Local\Tmp\Gateway_Specific_UK.dat Object is locked skipped C:\Program Files\BigFix\__Data\Gateway\__Local\Tmp\Gateway_Specific_Vista.dat Object is locked skipped C:\Program Files\BigFix\__Data\Gateway\__Local\Tmp\Microsoft_Security.dat Object is locked skipped C:\Program Files\BigFix\__Data\Gateway\__Local\Tmp\Microsoft_Security_UK.dat Object is locked skipped C:\Program Files\BigFix\__Data\Gateway\__Local\Tmp\Other.dat Object is locked skipped C:\Program Files\BigFix\__Data\Gateway\__Local\Tmp\Urgent.dat Object is locked skipped C:\Program Files\BigFix\__Data\Gateway\__Local\Tmp\Welcome.dat Object is locked skipped C:\Program Files\Common Files\Microsoft Shared\MSInfo\Network.exe Infected: Backdoor.Win32.Hupigon.dtj skipped C:\SDFix\backups\backups.zip/backups/cftmon.exe Infected: Worm.Win32.Socks.agj skipped C:\SDFix\backups\backups.zip/backups/jfiehayd.dll Infected: Trojan-Downloader.Win32.Agent.lxt skipped C:\SDFix\backups\backups.zip ZIP: infected - 2 skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP323\A0037876.exe Infected: not-a-virus:AdWare.Win32.RK.n skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP323\A0037877.dll Infected: not-a-virus:AdWare.Win32.RK.o skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP323\A0037878.exe Infected: not-a-virus:AdWare.Win32.Relevant.d skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP326\A0037891.exe/stream/data0006 Infected: not-a-virus:AdWare.Win32.Shopper.r skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP326\A0037891.exe/stream/data0008 Infected: not-a-virus:AdWare.Win32.Relevant.a skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP326\A0037891.exe/stream Infected: not-a-virus:AdWare.Win32.Relevant.a skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP326\A0037891.exe NSIS: infected - 3 skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP354\A0041481.exe Infected: Backdoor.Win32.Hupigon.dtj skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP354\A0041490.exe Infected: Backdoor.Win32.Rbot.bll skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP354\A0041491.exe Infected: Backdoor.Win32.Rbot.bll skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP357\A0041505.dll Infected: Trojan.Win32.Monder.ya skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP357\A0042521.exe Infected: Worm.Win32.Socks.agj skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP358\A0043518.dll Infected: Trojan.Win32.Monder.ya skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP358\A0043519.dll Infected: Trojan.Win32.Monder.yc skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP358\A0044521.exe Infected: Worm.Win32.Socks.agj skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP358\A0044526.exe Infected: Trojan.Win32.Monder.gen skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP358\A0044528.dll Infected: Trojan-Downloader.Win32.Agent.lxt skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP358\A0044529.exe Infected: Worm.Win32.Socks.agj skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP358\A0044530.exe Infected: Worm.Win32.Socks.agj skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP358\A0044544.exe Infected: Worm.Win32.Socks.agj skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP358\A0044545.dll Infected: Trojan-Downloader.Win32.Agent.lxt skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP359\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\ModemLog_AC97 Soft Data Fax Modem with SmartCP.txt Object is locked skipped C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{C327FC94-CC4D-4DA0-8B61-DDB763DBD4EB}.crmlog Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{B74E10F5-FFBA-4F93-858D-8D776C9ACA26}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\SLEvtLog.evt Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed.

OK, still some removals to do.

• Double-click OTMoveIt2.exe to run it.
• Copy the lines in the codebox below.

C:\Documents and Settings\Owner.SWAGE\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\class%2560.class-1168912c-19632770.class
C:\Documents and Settings\Owner.SWAGE\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\class%2560.class-70ebe39c-78ca0209.class
C:\Documents and Settings\Owner.SWAGE\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-3ad601a5-4afde81b.zip
C:\Documents and Settings\Owner.SWAGE\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-51fad18-3ec60652.zip
C:\Documents and Settings\Owner.SWAGE\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-5efd1945-10ea8384.zip
C:\Documents and Settings\Owner.SWAGE\Desktop\Installation Files\Magic.DVD.Ripper.v5.0.1.Incl.Keymaker-ARN\crack.rar
C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\MPSampleSubmit\r81213.exe.xor
C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\~os5A.tmp\rkupginstaller.exe"
C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\H0DO1CEW\css4[2]
C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\H0DO1CEW\kb456456[1]
C:\Documents and Settings\Owner.SWAGE\My Documents\Downloads\Magic_DVD_Ripper_v5.3-build-4+Keygen_tested\keygen.exe
C:\Documents and Settings\Owner.SWAGE\My Documents\Downloads\Magic_DVD_Ripper_v5.3-build-4+Keygen_tested\MagicDVDRipper53.exe
C:\Documents and Settings\Owner.SWAGE\My Documents\Downloads\Magic_DVD_Ripper_v5.3-build-4+Keygen_tested.rar
C:\Program Files\Common Files\Microsoft Shared\MSInfo\Network.exe

• Return to OTMoveIt2, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.

• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar), and paste it in your next reply.
• Close OTMoveIt2

Now Reboot your computer.

Run a new scan with Kaspersky and post me the log please.

Summary of the logs I need from you in your next post:

• OTMoveIt log
• New Kaspersky log

Please post each log separately to prevent them being cut off by the forum post size limiter.

< C:\Documents and Settings\Owner.SWAGE\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\class%2560.class-1168912c-19632770.class > C:\Documents and Settings\Owner.SWAGE\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\class%2560.class-1168912c-19632770.class moved successfully. < C:\Documents and Settings\Owner.SWAGE\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\class%2560.class-70ebe39c-78ca0209.class > C:\Documents and Settings\Owner.SWAGE\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\class%2560.class-70ebe39c-78ca0209.class moved successfully. C:\Documents and Settings\Owner.SWAGE\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-3ad601a5-4afde81b.zip moved successfully. C:\Documents and Settings\Owner.SWAGE\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-51fad18-3ec60652.zip moved successfully. C:\Documents and Settings\Owner.SWAGE\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-5efd1945-10ea8384.zip moved successfully. C:\Documents and Settings\Owner.SWAGE\Desktop\Installation Files\Magic.DVD.Ripper.v5.0.1.Incl.Keymaker-ARN\crack.rar moved successfully. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\MPSampleSubmit\r81213.exe.xor moved successfully. File/Folder C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\~os5A.tmp\rkupginstaller.exe" not found. < C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\H0DO1CEW\css4[2] > C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\H0DO1CEW\css4[2] moved successfully. < C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\H0DO1CEW\kb456456[1] > C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\H0DO1CEW\kb456456[1] moved successfully. C:\Documents and Settings\Owner.SWAGE\My Documents\Downloads\Magic_DVD_Ripper_v5.3-build-4+Keygen_tested\keygen.exe moved successfully. C:\Documents and Settings\Owner.SWAGE\My Documents\Downloads\Magic_DVD_Ripper_v5.3-build-4+Keygen_tested\MagicDVDRipper53.exe moved successfully. C:\Documents and Settings\Owner.SWAGE\My Documents\Downloads\Magic_DVD_Ripper_v5.3-build-4+Keygen_tested.rar moved successfully. C:\Program Files\Common Files\Microsoft Shared\MSInfo\Network.exe moved successfully. OTMoveIt2 by OldTimer - Version 1.0.4.2 log created on 06222008_210308