Spyware / Malware / Virus Removal

[Resolved] Help please

10 min read

Looking for the outcome? Ask AI

xxsummer Topic Starter

Post #1September 22, 2008, 2:30 AM UTC last edited September 22, 2008, 2:51 AM UTC

Logfile of HijackThis v1.99.1
Scan saved at 7:51:30 PM, on 9/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5450.0004)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\svchost.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.5.0_11\bin\jucheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellTransferAgent] "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

Tomk

Post #2September 22, 2008, 3:46 AM UTC

Hi xxsummer,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Then

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).

Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

xxsummer

Post #3September 22, 2008, 5:02 AM UTC

Logfile of HijackThis v1.99.1
Scan saved at 9:55:57 PM, on 9/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5450.0004)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Java\jre1.5.0_11\bin\jucheck.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\GUARDGUI.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellTransferAgent] "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

the antivir keeps popping up saying that there's a trojan and won't stop. i still can't go into my C drive and the malware scan keeps freezing.

Tomk

Post #4September 22, 2008, 2:57 PM UTC

xxsummer,

You seem to have remnants of several Anti-virus products.

Click Start, then Settings, then click Control Panel.
In Control Panel, double-click Add or Remove Programs.
In Add or Remove Programs, Remove AVG components
Do the same for each AVAST component.

A. Please download ComboFix by sUBs from HERE or HERE directly to your Desktop.

Note: If you already have ComboFix on your machine, please DELETE it from your desktop before downloading the newest version.

B. Now we must disable some of your security programs so that they do not interfere with the running of our tools:

AVIRA ANTIVIR
Please navigate to the system tray on the bottom right hand corner and look for an open white umbrella on red background (looks to this: [external image: Posted Image] )

right click it-> untick the option AntiVir Guard enable.
You should now see a closed, white umbrella on a red background (looks to this: [external image: Posted Image] )

You succesfully disabled the AntiVir Guard.

C.Go to [external image: Posted Image] -> Run -> copy/paste the following single line command in the runbox & click OK

"%userprofile%\desktop\combofix.exe" /killall

[external image: Posted Image]

DO NOT USE your computer for any other purpose while ComboFix is running.
ComboFix may restart your computer, this is normal.
When finished, it will produce a log, ComboFix.txt.
Please post ComboFix.txt in your next reply along with a new HijackThis log.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

xxsummer

Post #5September 22, 2008, 11:02 PM UTC

Logfile of HijackThis v1.99.1
Scan saved at 16:02, on 2008-09-22
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5450.0004)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.5.0_11\bin\jucheck.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.5470\swg.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellTransferAgent] "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

________________________________________________________________________________
____________________

ComboFix 08-09-20.05 - brittaney 2008-09-22 15:42:17.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.281 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\desktop\combofix.exe
Command switches used :: /killall
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\096.bat
C:\1rfw8hjr.com
C:\1t6yxlxx.cmd
C:\1u0o8bnq.cmd
C:\2.cmd
C:\62oop0ak.bat
C:\a.bat
C:\a1.bat
C:\autorun.inf
C:\b3b9u.com
C:\ceqfqp.bat
C:\DOCUME~1\BRITTA~1\LOCALS~1\Temp\2.dll
C:\DOCUME~1\BRITTA~1\LOCALS~1\Temp\n.dll
C:\DOCUME~1\BRITTA~1\LOCALS~1\Temp\ozbcfvk.dll
C:\DOCUME~1\BRITTA~1\LOCALS~1\Temp\p.dll
C:\DOCUME~1\BRITTA~1\LOCALS~1\Temp\zb5ok.dll
C:\DOCUME~1\BRITTA~1\LOCALS~1\Temp\zzaho.dll
C:\Documents and Settings\brittaney\Local Settings\Temporary Internet Files\ijjistarter_verinfo.dat
C:\Documents and Settings\brittaney\Local Settings\Temporary Internet Files\img_0097.jpg
C:\Documents and Settings\brittaney\Local Settings\Temporary Internet Files\img_0099.jpg
C:\Documents and Settings\brittaney\Local Settings\Temporary Internet Files\img_0100.jpg
C:\Documents and Settings\brittaney\Local Settings\Temporary Internet Files\img_0102.jpg
C:\Documents and Settings\brittaney\Local Settings\Temporary Internet Files\img_0103.jpg
C:\Documents and Settings\brittaney\Local Settings\Temporary Internet Files\img_0105.jpg
C:\Documents and Settings\brittaney\Local Settings\Temporary Internet Files\img_0113.jpg
C:\Documents and Settings\brittaney\Local Settings\Temporary Internet Files\img_0114.jpg
C:\hgu.bat
C:\kaq86asx.bat
C:\kk3.bat
C:\kn6jhgc.cmd
C:\l1.cmd
C:\m9as2c.cmd
C:\n.com
C:\nqgcd.com
C:\ov.cmd
C:\ox.cmd
C:\pamn.exe
C:\r1y1.bat
C:\r813.bat
C:\svdioajm.cmd
C:\t.exe
C:\tyktjfww.exe
C:\u9dyi.exe
C:\v3pif.bat
C:\WINDOWS\scvhost.exe
C:\WINDOWS\system32\ckvo2.dll
C:\WINDOWS\system32\kavo2.dll
C:\x1.cmd
C:\xk2n.bat
C:\y.cmd
C:\yssjnngm.cmd
D:\096.bat
D:\1a0sr.cmd
D:\1rfw8hjr.com
D:\1t6yxlxx.cmd
D:\1u0o8bnq.cmd
D:\2.cmd
D:\6.bat
D:\62oop0ak.bat
D:\a1.bat
D:\Autorun.inf
D:\b3b9u.com
D:\c9hehpa.bat
D:\ceqfqp.bat
D:\dynrn6e.cmd
D:\e898.com
D:\f.bat
D:\f.exe
D:\feav9a2.cmd
D:\ffojc.com
D:\fi.cmd
D:\hgu.bat
D:\ivcvknr.bat
D:\kaq86asx.bat
D:\kk3.bat
D:\kn6jhgc.cmd
D:\l1.cmd
D:\m9as2c.cmd
D:\n.com
D:\nqgcd.com
D:\ov.cmd
D:\ox.cmd
D:\pamn.exe
D:\r1y1.bat
D:\r813.bat
D:\svdioajm.cmd
D:\tyktjfww.exe
D:\u9dyi.exe
D:\x1.cmd
D:\xk2n.bat
D:\y.cmd
D:\ylaua.cmd
D:\ypjq1.cmd
D:\yssjnngm.cmd

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_POWERMANAGER

((((((((((((((((((((((((( Files Created from 2008-08-22 to 2008-09-22 )))))))))))))))))))))))))))))))
.

2008-09-21 22:13 . 2008-09-21 22:14 d——– C:\Program Files\Google
2008-09-21 20:49 . 2008-09-21 20:49 50,688 –a—— C:\Program Files\ATF-Cleaner.exe
2008-09-21 19:19 . 2008-09-21 19:19 1,069 –a—— C:\updates.xml
2008-09-21 19:19 . 2008-09-21 19:19 1,069 –a—— C:\active-update.xml
2008-09-21 15:23 . 2008-09-21 15:23 d——– C:\Documents and Settings\brittaney\Application Data\Malwarebytes
2008-09-21 15:22 . 2008-09-21 20:52 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-09-21 15:22 . 2008-09-21 15:22 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-21 15:22 . 2008-09-10 00:04 38,528 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mbamswissarmy.sys
2008-09-21 15:22 . 2008-09-10 00:03 17,200 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys
2008-09-21 15:19 . 2008-09-21 15:19 d——– C:\Program Files\Alwil Software
2008-09-21 14:51 . 2008-09-21 14:51 d——– C:\Program Files\Avira
2008-09-21 14:51 . 2008-09-21 14:51 d——– C:\Documents and Settings\All Users\Application Data\Avira
2008-09-21 14:15 . 2008-09-20 21:53 118,322 -r-hs—- C:\sasyg1y8.com
2008-09-21 14:03 . 2008-09-21 14:03 d——– C:\Program Files\AVG
2008-09-21 14:03 . 2008-09-21 14:03 d——– C:\Documents and Settings\Daddy\Application Data\AVGTOOLBAR
2008-09-21 14:03 . 2008-09-21 14:05 d——– C:\Documents and Settings\All Users\Application Data\avg8
2008-09-20 16:13 . 2008-09-20 16:13 d——– C:\Documents and Settings\Daddy\Application Data\TmpRecentIcons
2008-09-20 15:42 . 2008-09-20 15:42 d——– C:\Program Files\Image-Line
2008-09-17 16:38 . 2008-09-17 16:38 d——– C:\Program Files\Musicnotes
2008-09-14 18:43 . 2008-09-19 16:59 9,704,960 –a—— C:\Documents and Settings\brittaney\xul.dll
2008-09-14 18:43 . 2008-09-19 16:58 710,144 –a—— C:\Documents and Settings\brittaney\mozcrt19.dll
2008-09-14 18:43 . 2008-09-19 16:58 697,856 –a—— C:\Documents and Settings\brittaney\nss3.dll
2008-09-14 18:43 . 2008-09-19 16:58 695,296 –a—— C:\Documents and Settings\brittaney\js3250.dll
2008-09-14 18:43 . 2008-09-19 16:58 395,776 –a—— C:\Documents and Settings\brittaney\sqlite3.dll
2008-09-14 18:43 . 2008-09-19 16:58 304,640 –a—— C:\Documents and Settings\brittaney\nssckbi.dll
2008-09-14 18:43 . 2008-09-19 16:58 278,016 –a—— C:\Documents and Settings\brittaney\updater.exe
2008-09-14 18:43 . 2008-09-19 16:58 233,472 –a—— C:\Documents and Settings\brittaney\freebl3.dll
2008-09-14 18:43 . 2008-09-19 16:58 222,208 –a—— C:\Documents and Settings\brittaney\crashreporter.exe
2008-09-14 18:43 . 2008-09-19 16:58 198,144 –a—— C:\Documents and Settings\brittaney\nspr4.dll
2008-09-14 18:43 . 2008-09-19 16:58 151,552 –a—— C:\Documents and Settings\brittaney\softokn3.dll
2008-09-14 18:43 . 2008-09-19 16:58 136,704 –a—— C:\Documents and Settings\brittaney\ssl3.dll
2008-09-14 18:43 . 2008-09-19 16:58 103,936 –a—— C:\Documents and Settings\brittaney\smime3.dll
2008-09-14 18:43 . 2008-09-19 16:58 103,936 –a—— C:\Documents and Settings\brittaney\nssdbm3.dll
2008-09-14 18:43 . 2008-09-19 16:58 87,552 –a—— C:\Documents and Settings\brittaney\nssutil3.dll
2008-09-14 18:43 . 2008-09-19 16:58 20,480 –a—— C:\Documents and Settings\brittaney\plc4.dll
2008-09-14 18:43 . 2008-09-19 16:58 17,920 –a—— C:\Documents and Settings\brittaney\xpcom.dll
2008-09-14 18:43 . 2008-09-19 16:58 17,408 –a—— C:\Documents and Settings\brittaney\plds4.dll
2008-09-13 19:54 . 2008-09-12 22:08 96,566 -r-hs—- C:\vxl.exe
2008-09-12 17:21 . 2008-09-19 16:59 d——– C:\Documents and Settings\brittaney\uninstall
2008-09-12 17:21 . 2008-09-19 16:59 d——– C:\Documents and Settings\brittaney\searchplugins
2008-09-12 17:21 . 2008-09-19 16:59 d——– C:\Documents and Settings\brittaney\res
2008-09-12 17:21 . 2008-09-19 16:59 d——– C:\Documents and Settings\brittaney\plugins
2008-09-12 17:21 . 2008-09-19 16:59 d——– C:\Documents and Settings\brittaney\modules
2008-09-12 17:21 . 2008-09-19 16:59 d——– C:\Documents and Settings\brittaney\greprefs
2008-09-12 17:21 . 2008-09-19 16:59 d——– C:\Documents and Settings\brittaney\dictionaries
2008-09-12 17:21 . 2008-09-12 17:21 d——– C:\Documents and Settings\brittaney\defaults
2008-09-12 17:21 . 2008-09-19 16:59 d——– C:\Documents and Settings\brittaney\components
2008-09-12 17:21 . 2008-09-19 16:59 d——– C:\Documents and Settings\brittaney\chrome
2008-09-12 17:21 . 2008-09-19 16:58 17,408 –a—— C:\Documents and Settings\brittaney\AccessibleMarshal.dll
2008-09-12 17:21 . 2008-09-19 16:58 0 –a—— C:\Documents and Settings\brittaney\.autoreg
2008-09-10 18:04 . 2008-09-10 16:42 115,992 -r-hs—- C:\iwjj.com
2008-09-09 20:18 . 2008-09-21 19:19 d——– C:\updates
2008-09-05 17:41 . 2008-09-05 17:41 84,992 -r-hs—- C:\WINDOWS\SYSTEM32\ckvo3.dll
2008-09-05 16:09 . 2008-09-05 16:23 92,932 -r-hs—- C:\ktnquo.exe
2008-09-02 12:01 . 2008-09-04 16:45 111,805 -r-hs—- C:\okhr.exe
2008-09-01 10:52 . 2008-09-01 12:47 109,992 -r-hs—- C:\rjx0.exe
2008-08-28 13:05 . 2008-08-29 10:50 109,215 -r-hs—- C:\6xdgw26.com
2008-08-27 11:00 . 2008-08-29 11:05 91,084 -r-hs—- C:\ph.com
2008-08-23 12:31 . 2008-08-23 12:45 92,661 -r-hs—- C:\mnl6on3.com
2008-08-22 19:10 . 2008-08-22 19:10 d——– C:\Documents and Settings\Daddy\Application Data\HotSync

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-22 02:41 ——— d—–w C:\Program Files\iTunes
2008-09-21 21:26 ——— d—–w C:\Documents and Settings\brittaney\Application Data\U3
2008-09-20 19:08 ——— d—–w C:\Documents and Settings\brittaney\Application Data\AdobeUM
2008-09-14 05:13 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-09-09 02:39 ——— d—–w C:\Documents and Settings\brittaney\Application Data\Move Networks
2008-08-22 01:14 90,994 –sh–r C:\83fgj.com
2008-08-19 22:46 106,570 –sh–r C:\jv.exe
2008-08-15 16:10 90,256 –sh–r C:\t1ypkh.exe
2008-08-12 03:47 89,407 –sh–r C:\bpu.exe
2008-08-05 02:09 89,885 –sh–r C:\xqf.com
2008-08-04 22:40 103,318 –sh–r C:\1rexh.com
2008-08-01 02:19 ——— d–h–w C:\Documents and Settings\brittaney\Application Data\ijjigame
2008-07-26 06:01 100,582 –sh–r C:\lcmqm.exe
2008-07-22 03:05 131,629 –sh–r C:\m8wafly.com
2008-07-21 00:54 117,009 –sh–r C:\ybj8df.exe
2008-07-17 05:45 115,233 –sh–r C:\p83gjy.exe
2008-07-16 02:02 116,862 –sh–r C:\k.com
2008-07-11 02:46 117,255 –sh–r C:\0gjn3yw.exe
2008-07-10 03:02 132,540 –sh–r C:\lsfjg.com
2008-07-08 04:57 130,407 –sh–r C:\8uot.exe
2008-07-04 03:11 129,013 –sh–r C:\cm0.com
2008-06-27 01:16 124,333 –sh–r C:\p1f6b.exe
2008-06-25 03:11 125,654 –sh–r C:\tn0k.exe
2006-09-12 01:56 82,144 -c–a-w C:\Documents and Settings\brittaney\Application Data\GDIPFONTCACHEV1.DAT
2006-10-01 02:04 88 –sh–r C:\WINDOWS\SYSTEM32\26C163B7F6.sys
2005-12-27 18:42 152 -csh–r C:\WINDOWS\SYSTEM32\F6B763C126.sys
2006-10-06 03:18 7,520 -csha-w C:\WINDOWS\SYSTEM32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"DellTransferAgent"="C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" [2007-11-13 171520]
"AIM"="C:\Program Files\AIM\aim.exe" [2006-08-01 67112]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-21 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 145920]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-13 122939]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 114688]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-03-06 180269]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 267048]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 75520]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 360448]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2004-12-21 24576]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN\\MSNCoreFiles\\msn.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"D:\\LimeWire\\LimeWire.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 BsStor;InCD Storage Helper Driver;C:\WINDOWS\system32\DRIVERS\bsstor.sys [2002-06-05 9344]
R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2008-01-11 40832]
S4 BsUDF;InCD UDF Driver;C:\WINDOWS\system32\drivers\BsUDF.sys [2002-09-13 448640]
S4 cdawdm;CDAWDM;C:\WINDOWS\system32\DRIVERS\CDAWDM.sys [ ]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1aeeb968-5cd5-11dd-ae3d-00111197b9ab}]
\Shell\AutoRun\command - E:\1rfw8hjr.com
\Shell\explore\Command - E:\1rfw8hjr.com
\Shell\open\Command - E:\1rfw8hjr.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{35465f28-db44-11db-aa02-00111197b9ab}]
\Shell\AutoRun\command - E:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{35465f29-db44-11db-aa02-00111197b9ab}]
\Shell\AutoRun\command - F:\l1.cmd
\Shell\explore\Command - F:\l1.cmd
\Shell\open\Command - F:\l1.cmd
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-kamsoft - C:\WINDOWS\system32\ckvo.exe
HKLM-Run-PCMService - C:\Program Files\Dell\Media Experience\PCMService.exe
HKLM-Run-MMTray - C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
HKLM-Run-Microsoft Works Update Detection - C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
HKLM-Run-NeroCheck - C:\WINDOWS\system32\NeroCheck.exe

.
——- Supplementary Scan ——-
.
FireFox -: Profile - C:\Documents and Settings\brittaney\Application Data\Mozilla\Firefox\Profiles\2aixfy6a.default\
FF -: plugin - C:\plugins\npnul32.dll
FF -: plugin - C:\Program Files\Adobe\Acrobat 6.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_11\bin\NPJava11.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_11\bin\NPJava12.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_11\bin\NPJava13.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_11\bin\NPJava14.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_11\bin\NPJava32.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_11\bin\NPJPI150_11.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_11\bin\NPOJI610.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-22 15:49:59
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\SYSTEM32\snmp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\SYSTEM32\WSCNTFY.EXE
C:\WINDOWS\SYSTEM32\msiexec.exe
C:\Program Files\Java\jre1.5.0_11\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2008-09-22 16:01:14 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-22 23:00:28

Pre-Run: 2,683,228,160 bytes free
Post-Run: 4,952,498,176 bytes free

315 — E O F — 2008-09-17 22:40:46

Tomk

Post #6September 22, 2008, 11:59 PM UTC

xxsummer,

Your computer appears to have been infected by a backdoor trojan. These programs have the ability to steal passwords and other information from your system. If you use your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:

Use another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use.
Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account.
Consider what other private information could possibly have been taken from your computer and take appropriate steps

This infection can almost certainly be cleaned, but as the malware could be configured to run any program a remote attacker requires, it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting the system partition and reinstalling Windows as this is the only 100% sure answer.

If you wish to reformat then please let me know in your next response, I'll now continue with instructions for cleaning.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:

Download the latest version of Java Runtime Environment (JRE) 6 Update 7.
Scroll down to where it says "The Java SE Runtime Environment (JRE) allows end-users to run Java applications".
Click the "Download" button to the right.
In the pull down menu next to Platform select Windows
Check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement"
Click Continue
Click on the link to download Windows Offline Installation and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u7-windows-i586-p.exe to install the newest version.

Now to Clean out the Java cache:

Go into the Control Panel and double-click the Java Icon. [external image: Posted Image]

Under Temporary Internet Files, click the Settings… button
click the Delete Files button.
There are three options in the window to clear the cache - Leave all 3 Checked
- Downloaded Applets
  Downloaded Applications
  Other Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Settings
Click OK to leave the Java Control Panel.

Disable your protection programs as we did before.

Please open HijackThis and run Do a system scan only
Check the boxes next to ONLY the entries listed below(if present):
- O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
  O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
  O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
  O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
  O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL (file missing)
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL (file missing)
Close all programs except for HijackThis.
Click on Fix checked
A box will pop up asking you if you wish to fix the selected items. Please choose YES.
Once it has fixed them, please exit/close HijackThis.

Next

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

KILLALL::

File::
C:\updates.xml
C:\active-update.xml
E:\1rfw8hjr.com
F:\l1.cmd

Folder::
C:\Program Files\AVG
C:\Documents and Settings\Daddy\Application Data\AVGTOOLBAR
C:\Documents and Settings\All Users\Application Data\avg8
C:\Documents and Settings\brittaney\Application Data\ijjigame

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1aeeb968-5cd5-11dd-ae3d-00111197b9ab}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{35465f29-db44-11db-aa02-00111197b9ab}]


Driver::
CDAWDM

Rootkit::
C:\sasyg1y8.com
C:\vxl.exe
C:\iwjj.com
C:\WINDOWS\SYSTEM32\ckvo3.dll
C:\ktnquo.exe
C:\okhr.exe
C:\rjx0.exe
C:\6xdgw26.com
C:\ph.com
C:\mnl6on3.com
C:\83fgj.com
C:\jv.exe
C:\t1ypkh.exe
C:\bpu.exe
C:\xqf.com
C:\1rexh.com
C:\lcmqm.exe
C:\m8wafly.com
C:\ybj8df.exe
C:\p83gjy.exe
C:\k.com
C:\0gjn3yw.exe
C:\lsfjg.com
C:\8uot.exe
C:\cm0.com
C:\p1f6b.exe
C:\tn0k.exe

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Then

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.

In your next reply please provide:

ComboFix.txt
Kaspersky report
New HijackThis log taken after everything else completed

xxsummer

Post #7September 24, 2008, 12:02 AM UTC

ComboFix 08-09-20.05 - brittaney 2008-09-22 15:42:17.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.281 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\desktop\combofix.exe
Command switches used :: /killall
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\096.bat
C:\1rfw8hjr.com
C:\1t6yxlxx.cmd
C:\1u0o8bnq.cmd
C:\2.cmd
C:\62oop0ak.bat
C:\a.bat
C:\a1.bat
C:\autorun.inf
C:\b3b9u.com
C:\ceqfqp.bat
C:\DOCUME~1\BRITTA~1\LOCALS~1\Temp\2.dll
C:\DOCUME~1\BRITTA~1\LOCALS~1\Temp\n.dll
C:\DOCUME~1\BRITTA~1\LOCALS~1\Temp\ozbcfvk.dll
C:\DOCUME~1\BRITTA~1\LOCALS~1\Temp\p.dll
C:\DOCUME~1\BRITTA~1\LOCALS~1\Temp\zb5ok.dll
C:\DOCUME~1\BRITTA~1\LOCALS~1\Temp\zzaho.dll
C:\Documents and Settings\brittaney\Local Settings\Temporary Internet Files\ijjistarter_verinfo.dat
C:\Documents and Settings\brittaney\Local Settings\Temporary Internet Files\img_0097.jpg
C:\Documents and Settings\brittaney\Local Settings\Temporary Internet Files\img_0099.jpg
C:\Documents and Settings\brittaney\Local Settings\Temporary Internet Files\img_0100.jpg
C:\Documents and Settings\brittaney\Local Settings\Temporary Internet Files\img_0102.jpg
C:\Documents and Settings\brittaney\Local Settings\Temporary Internet Files\img_0103.jpg
C:\Documents and Settings\brittaney\Local Settings\Temporary Internet Files\img_0105.jpg
C:\Documents and Settings\brittaney\Local Settings\Temporary Internet Files\img_0113.jpg
C:\Documents and Settings\brittaney\Local Settings\Temporary Internet Files\img_0114.jpg
C:\hgu.bat
C:\kaq86asx.bat
C:\kk3.bat
C:\kn6jhgc.cmd
C:\l1.cmd
C:\m9as2c.cmd
C:\n.com
C:\nqgcd.com
C:\ov.cmd
C:\ox.cmd
C:\pamn.exe
C:\r1y1.bat
C:\r813.bat
C:\svdioajm.cmd
C:\t.exe
C:\tyktjfww.exe
C:\u9dyi.exe
C:\v3pif.bat
C:\WINDOWS\scvhost.exe
C:\WINDOWS\system32\ckvo2.dll
C:\WINDOWS\system32\kavo2.dll
C:\x1.cmd
C:\xk2n.bat
C:\y.cmd
C:\yssjnngm.cmd
D:\096.bat
D:\1a0sr.cmd
D:\1rfw8hjr.com
D:\1t6yxlxx.cmd
D:\1u0o8bnq.cmd
D:\2.cmd
D:\6.bat
D:\62oop0ak.bat
D:\a1.bat
D:\Autorun.inf
D:\b3b9u.com
D:\c9hehpa.bat
D:\ceqfqp.bat
D:\dynrn6e.cmd
D:\e898.com
D:\f.bat
D:\f.exe
D:\feav9a2.cmd
D:\ffojc.com
D:\fi.cmd
D:\hgu.bat
D:\ivcvknr.bat
D:\kaq86asx.bat
D:\kk3.bat
D:\kn6jhgc.cmd
D:\l1.cmd
D:\m9as2c.cmd
D:\n.com
D:\nqgcd.com
D:\ov.cmd
D:\ox.cmd
D:\pamn.exe
D:\r1y1.bat
D:\r813.bat
D:\svdioajm.cmd
D:\tyktjfww.exe
D:\u9dyi.exe
D:\x1.cmd
D:\xk2n.bat
D:\y.cmd
D:\ylaua.cmd
D:\ypjq1.cmd
D:\yssjnngm.cmd

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_POWERMANAGER

((((((((((((((((((((((((( Files Created from 2008-08-22 to 2008-09-22 )))))))))))))))))))))))))))))))
.

2008-09-21 22:13 . 2008-09-21 22:14 d——– C:\Program Files\Google
2008-09-21 20:49 . 2008-09-21 20:49 50,688 –a—— C:\Program Files\ATF-Cleaner.exe
2008-09-21 19:19 . 2008-09-21 19:19 1,069 –a—— C:\updates.xml
2008-09-21 19:19 . 2008-09-21 19:19 1,069 –a—— C:\active-update.xml
2008-09-21 15:23 . 2008-09-21 15:23 d——– C:\Documents and Settings\brittaney\Application Data\Malwarebytes
2008-09-21 15:22 . 2008-09-21 20:52 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-09-21 15:22 . 2008-09-21 15:22 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-21 15:22 . 2008-09-10 00:04 38,528 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mbamswissarmy.sys
2008-09-21 15:22 . 2008-09-10 00:03 17,200 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys
2008-09-21 15:19 . 2008-09-21 15:19 d——– C:\Program Files\Alwil Software
2008-09-21 14:51 . 2008-09-21 14:51 d——– C:\Program Files\Avira
2008-09-21 14:51 . 2008-09-21 14:51 d——– C:\Documents and Settings\All Users\Application Data\Avira
2008-09-21 14:15 . 2008-09-20 21:53 118,322 -r-hs—- C:\sasyg1y8.com
2008-09-21 14:03 . 2008-09-21 14:03 d——– C:\Program Files\AVG
2008-09-21 14:03 . 2008-09-21 14:03 d——– C:\Documents and Settings\Daddy\Application Data\AVGTOOLBAR
2008-09-21 14:03 . 2008-09-21 14:05 d——– C:\Documents and Settings\All Users\Application Data\avg8
2008-09-20 16:13 . 2008-09-20 16:13 d——– C:\Documents and Settings\Daddy\Application Data\TmpRecentIcons
2008-09-20 15:42 . 2008-09-20 15:42 d——– C:\Program Files\Image-Line
2008-09-17 16:38 . 2008-09-17 16:38 d——– C:\Program Files\Musicnotes
2008-09-14 18:43 . 2008-09-19 16:59 9,704,960 –a—— C:\Documents and Settings\brittaney\xul.dll
2008-09-14 18:43 . 2008-09-19 16:58 710,144 –a—— C:\Documents and Settings\brittaney\mozcrt19.dll
2008-09-14 18:43 . 2008-09-19 16:58 697,856 –a—— C:\Documents and Settings\brittaney\nss3.dll
2008-09-14 18:43 . 2008-09-19 16:58 695,296 –a—— C:\Documents and Settings\brittaney\js3250.dll
2008-09-14 18:43 . 2008-09-19 16:58 395,776 –a—— C:\Documents and Settings\brittaney\sqlite3.dll
2008-09-14 18:43 . 2008-09-19 16:58 304,640 –a—— C:\Documents and Settings\brittaney\nssckbi.dll
2008-09-14 18:43 . 2008-09-19 16:58 278,016 –a—— C:\Documents and Settings\brittaney\updater.exe
2008-09-14 18:43 . 2008-09-19 16:58 233,472 –a—— C:\Documents and Settings\brittaney\freebl3.dll
2008-09-14 18:43 . 2008-09-19 16:58 222,208 –a—— C:\Documents and Settings\brittaney\crashreporter.exe
2008-09-14 18:43 . 2008-09-19 16:58 198,144 –a—— C:\Documents and Settings\brittaney\nspr4.dll
2008-09-14 18:43 . 2008-09-19 16:58 151,552 –a—— C:\Documents and Settings\brittaney\softokn3.dll
2008-09-14 18:43 . 2008-09-19 16:58 136,704 –a—— C:\Documents and Settings\brittaney\ssl3.dll
2008-09-14 18:43 . 2008-09-19 16:58 103,936 –a—— C:\Documents and Settings\brittaney\smime3.dll
2008-09-14 18:43 . 2008-09-19 16:58 103,936 –a—— C:\Documents and Settings\brittaney\nssdbm3.dll
2008-09-14 18:43 . 2008-09-19 16:58 87,552 –a—— C:\Documents and Settings\brittaney\nssutil3.dll
2008-09-14 18:43 . 2008-09-19 16:58 20,480 –a—— C:\Documents and Settings\brittaney\plc4.dll
2008-09-14 18:43 . 2008-09-19 16:58 17,920 –a—— C:\Documents and Settings\brittaney\xpcom.dll
2008-09-14 18:43 . 2008-09-19 16:58 17,408 –a—— C:\Documents and Settings\brittaney\plds4.dll
2008-09-13 19:54 . 2008-09-12 22:08 96,566 -r-hs—- C:\vxl.exe
2008-09-12 17:21 . 2008-09-19 16:59 d——– C:\Documents and Settings\brittaney\uninstall
2008-09-12 17:21 . 2008-09-19 16:59 d——– C:\Documents and Settings\brittaney\searchplugins
2008-09-12 17:21 . 2008-09-19 16:59 d——– C:\Documents and Settings\brittaney\res
2008-09-12 17:21 . 2008-09-19 16:59 d——– C:\Documents and Settings\brittaney\plugins
2008-09-12 17:21 . 2008-09-19 16:59 d——– C:\Documents and Settings\brittaney\modules
2008-09-12 17:21 . 2008-09-19 16:59 d——– C:\Documents and Settings\brittaney\greprefs
2008-09-12 17:21 . 2008-09-19 16:59 d——– C:\Documents and Settings\brittaney\dictionaries
2008-09-12 17:21 . 2008-09-12 17:21 d——– C:\Documents and Settings\brittaney\defaults
2008-09-12 17:21 . 2008-09-19 16:59 d——– C:\Documents and Settings\brittaney\components
2008-09-12 17:21 . 2008-09-19 16:59 d——– C:\Documents and Settings\brittaney\chrome
2008-09-12 17:21 . 2008-09-19 16:58 17,408 –a—— C:\Documents and Settings\brittaney\AccessibleMarshal.dll
2008-09-12 17:21 . 2008-09-19 16:58 0 –a—— C:\Documents and Settings\brittaney\.autoreg
2008-09-10 18:04 . 2008-09-10 16:42 115,992 -r-hs—- C:\iwjj.com
2008-09-09 20:18 . 2008-09-21 19:19 d——– C:\updates
2008-09-05 17:41 . 2008-09-05 17:41 84,992 -r-hs—- C:\WINDOWS\SYSTEM32\ckvo3.dll
2008-09-05 16:09 . 2008-09-05 16:23 92,932 -r-hs—- C:\ktnquo.exe
2008-09-02 12:01 . 2008-09-04 16:45 111,805 -r-hs—- C:\okhr.exe
2008-09-01 10:52 . 2008-09-01 12:47 109,992 -r-hs—- C:\rjx0.exe
2008-08-28 13:05 . 2008-08-29 10:50 109,215 -r-hs—- C:\6xdgw26.com
2008-08-27 11:00 . 2008-08-29 11:05 91,084 -r-hs—- C:\ph.com
2008-08-23 12:31 . 2008-08-23 12:45 92,661 -r-hs—- C:\mnl6on3.com
2008-08-22 19:10 . 2008-08-22 19:10 d——– C:\Documents and Settings\Daddy\Application Data\HotSync

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-22 02:41 ——— d—–w C:\Program Files\iTunes
2008-09-21 21:26 ——— d—–w C:\Documents and Settings\brittaney\Application Data\U3
2008-09-20 19:08 ——— d—–w C:\Documents and Settings\brittaney\Application Data\AdobeUM
2008-09-14 05:13 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-09-09 02:39 ——— d—–w C:\Documents and Settings\brittaney\Application Data\Move Networks
2008-08-22 01:14 90,994 –sh–r C:\83fgj.com
2008-08-19 22:46 106,570 –sh–r C:\jv.exe
2008-08-15 16:10 90,256 –sh–r C:\t1ypkh.exe
2008-08-12 03:47 89,407 –sh–r C:\bpu.exe
2008-08-05 02:09 89,885 –sh–r C:\xqf.com
2008-08-04 22:40 103,318 –sh–r C:\1rexh.com
2008-08-01 02:19 ——— d–h–w C:\Documents and Settings\brittaney\Application Data\ijjigame
2008-07-26 06:01 100,582 –sh–r C:\lcmqm.exe
2008-07-22 03:05 131,629 –sh–r C:\m8wafly.com
2008-07-21 00:54 117,009 –sh–r C:\ybj8df.exe
2008-07-17 05:45 115,233 –sh–r C:\p83gjy.exe
2008-07-16 02:02 116,862 –sh–r C:\k.com
2008-07-11 02:46 117,255 –sh–r C:\0gjn3yw.exe
2008-07-10 03:02 132,540 –sh–r C:\lsfjg.com
2008-07-08 04:57 130,407 –sh–r C:\8uot.exe
2008-07-04 03:11 129,013 –sh–r C:\cm0.com
2008-06-27 01:16 124,333 –sh–r C:\p1f6b.exe
2008-06-25 03:11 125,654 –sh–r C:\tn0k.exe
2006-09-12 01:56 82,144 -c–a-w C:\Documents and Settings\brittaney\Application Data\GDIPFONTCACHEV1.DAT
2006-10-01 02:04 88 –sh–r C:\WINDOWS\SYSTEM32\26C163B7F6.sys
2005-12-27 18:42 152 -csh–r C:\WINDOWS\SYSTEM32\F6B763C126.sys
2006-10-06 03:18 7,520 -csha-w C:\WINDOWS\SYSTEM32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"DellTransferAgent"="C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" [2007-11-13 171520]
"AIM"="C:\Program Files\AIM\aim.exe" [2006-08-01 67112]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-21 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 145920]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-13 122939]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 114688]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-03-06 180269]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 267048]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 75520]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 360448]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2004-12-21 24576]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN\\MSNCoreFiles\\msn.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"D:\\LimeWire\\LimeWire.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 BsStor;InCD Storage Helper Driver;C:\WINDOWS\system32\DRIVERS\bsstor.sys [2002-06-05 9344]
R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2008-01-11 40832]
S4 BsUDF;InCD UDF Driver;C:\WINDOWS\system32\drivers\BsUDF.sys [2002-09-13 448640]
S4 cdawdm;CDAWDM;C:\WINDOWS\system32\DRIVERS\CDAWDM.sys [ ]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1aeeb968-5cd5-11dd-ae3d-00111197b9ab}]
\Shell\AutoRun\command - E:\1rfw8hjr.com
\Shell\explore\Command - E:\1rfw8hjr.com
\Shell\open\Command - E:\1rfw8hjr.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{35465f28-db44-11db-aa02-00111197b9ab}]
\Shell\AutoRun\command - E:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{35465f29-db44-11db-aa02-00111197b9ab}]
\Shell\AutoRun\command - F:\l1.cmd
\Shell\explore\Command - F:\l1.cmd
\Shell\open\Command - F:\l1.cmd
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-kamsoft - C:\WINDOWS\system32\ckvo.exe
HKLM-Run-PCMService - C:\Program Files\Dell\Media Experience\PCMService.exe
HKLM-Run-MMTray - C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
HKLM-Run-Microsoft Works Update Detection - C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
HKLM-Run-NeroCheck - C:\WINDOWS\system32\NeroCheck.exe

.
——- Supplementary Scan ——-
.
FireFox -: Profile - C:\Documents and Settings\brittaney\Application Data\Mozilla\Firefox\Profiles\2aixfy6a.default\
FF -: plugin - C:\plugins\npnul32.dll
FF -: plugin - C:\Program Files\Adobe\Acrobat 6.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_11\bin\NPJava11.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_11\bin\NPJava12.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_11\bin\NPJava13.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_11\bin\NPJava14.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_11\bin\NPJava32.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_11\bin\NPJPI150_11.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_11\bin\NPOJI610.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-22 15:49:59
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\SYSTEM32\snmp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\SYSTEM32\WSCNTFY.EXE
C:\WINDOWS\SYSTEM32\msiexec.exe
C:\Program Files\Java\jre1.5.0_11\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2008-09-22 16:01:14 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-22 23:00:28

Pre-Run: 2,683,228,160 bytes free
Post-Run: 4,952,498,176 bytes free

315 — E O F — 2008-09-17 22:40:46

——————————————————————————–
KASPERSKY ONLINE SCANNER 7 REPORT
Tuesday, September 23, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Tuesday, September 23, 2008 22:47:58
Records in database: 1252342
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
X:\

Scan statistics:
Files scanned: 62444
Threat name: 112
Infected objects: 1013
Suspicious objects: 0
Duration of the scan: 01:29:14

File name / Threat name / Threats count
C:\WINDOWS\svchost.exe/C:\WINDOWS\svchost.exe Infected: Virus.Win32.Hidrag.a 1
C:\0.com Infected: Trojan.Win32.Pakes.cum 1
C:\6g3.com Infected: Trojan-PSW.Win32.OnLineGames.aeai 1
C:\8e.com Infected: Trojan-GameThief.Win32.OnLineGames.rxty 1
C:\93vx0c.com Infected: Trojan-PSW.Win32.OnLineGames.ahvd 1
C:\9f3np.bat Infected: Trojan.Win32.Vaklik.ajx 1
C:\b.bat Infected: Trojan-PSW.Win32.OnLineGames.ambe 1
C:\c.com Infected: Trojan-PSW.Win32.OnLineGames.aayq 1
C:\c9.com Infected: Trojan.Win32.Vaklik.aeg 1
C:\crashreporter.exe Infected: Virus.Win32.Hidrag.a 1
C:\cubp.bat Infected: Trojan.Win32.Vaklik.anw 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\AIMinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\AIMLang.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\ampx.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\iphinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\muinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\ocpinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\plxoinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\prodpckr.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\setup.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\SLinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\SLinstLP.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\tbsetup.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\toolbar.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\vwpt.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\AIMinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\AIMLang.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\ampx.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\iphinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\muinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\ocpinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\plxoinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\prodpckr.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\setup.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\SLinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\SLinstLP.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\tbsetup.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\toolbar.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\vwpt.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.7.1\AIMinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.7.1\AIMLang.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.7.1\ampx.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.7.1\iphinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.7.1\muinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.7.1\ocpinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.7.1\plxoinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.7.1\prodpckr.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.7.1\setup.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.7.1\SLinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.7.1\SLinstLP.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.7.1\tbsetup.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.7.1\toolbar.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.7.1\vwpt.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\AIMinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\AIMLang.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\alsetup.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\ampx.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\inst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\migrator.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\muinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\ocpinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\setup.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\tbsetup.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\toolbar.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\vwpt.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\AIMinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\AIMLang.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\alsetup.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\ampx.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\inst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\migrator.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\muinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\ocpinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\setup.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\tbsetup.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\toolbar.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\vwpt.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4194.13.4\radioupd.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\brittaney\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u1\CIP\TransferAgentSetup.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\brittaney\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u1\HTML\MakeDesktopShortcut.EXE Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\brittaney\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\brittaney\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\brittaney\Application Data\Move Networks\MoveMediaPlayer_win_mozilla_07076007.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\brittaney\Application Data\Real\Update\setup\data\firefoxgoogletoolbarsetup.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\brittaney\Application Data\Real\Update\setup\data\GOOGLE_TOOLBAR\googletoolbarinstaller.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\brittaney\Application Data\Real\Update\setup\setup.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\brittaney\Application Data\U3\temp\cleanup.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\brittaney\crashreporter.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\brittaney\Desktop\antivir_workstation_winu_en_h.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\brittaney\Desktop\ComboFix.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\brittaney\Desktop\GoogleToolbarInstaller_download_signed.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\brittaney\Desktop\mbam-setup.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\brittaney\Local Settings\Application Data\Wildtangent\Cdacache\6095B9CF-DD6F-4F94-91A3-156A8D9006A1\groove_multiplayer.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\brittaney\Local Settings\Application Data\Wildtangent\Cdacache\6095B9CF-DD6F-4F94-91A3-156A8D9006A1\_6095B9CF-DD6F-4F94-91A3-156A8D9006A1.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\brittaney\My Documents\download\downloads\powerpup.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\brittaney\My Documents\filelib\LimeWireWin.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\brittaney\My Documents\filelib\LTRM_WWEFG_win.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\brittaney\My Documents\Firefox Setup 3.0.1.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\brittaney\My Documents\Fonts\ANIMATER9\Animator9.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\brittaney\My Documents\Install_AIM.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\brittaney\My Documents\my music\coffee shop soundtrack acousti.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1
C:\Documents and Settings\brittaney\Start Menu\Programs\coffee shop soundtrack acousti.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1
C:\Documents and Settings\brittaney\uninstall\helper.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\brittaney\updater.exe Infected: Virus.Win32.Hidrag.a 1
C:\Documents and Settings\Daddy\Desktop\avg_avwt_stf_en_8_169a1359.exe Infected: Virus.Win32.Hidrag.a 1
C:\DRIVERS\MODEM\ADDON\HXFSETUP.EXE Infected: Virus.Win32.Hidrag.a 1
C:\DRIVERS\NETWORK\ONBOARD\PROUNSTL.EXE Infected: Virus.Win32.Hidrag.a 1
C:\DRIVERS\NETWORK\ONBOARD\SETUP.EXE Infected: Virus.Win32.Hidrag.a 1
C:\DRIVERS\VIDEO\HKCMD.EXE Infected: Virus.Win32.Hidrag.a 1
C:\DRIVERS\VIDEO\IGFXCFG.EXE Infected: Virus.Win32.Hidrag.a 1
C:\DRIVERS\VIDEO\IGFXDIAG.EXE Infected: Virus.Win32.Hidrag.a 1
C:\DRIVERS\VIDEO\IGFXTRAY.EXE Infected: Virus.Win32.Hidrag.a 1
C:\gsxlexd.cmd Infected: Worm.Win32.AutoRun.dny 1
C:\h3hi1k3.exe Infected: Worm.Win32.AutoRun.dox 1
C:\hovrflst.bat Infected: Trojan.Win32.Vaklik.apk 1
C:\i0.cmd Infected: Trojan.Win32.Vaklik.yp 1
C:\I386\ACCWIZ.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\AGENTSVR.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\CALC.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\CLIPBRD.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\CONF.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\DRW\DWWIN.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\DWWIN.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\FSQUIRT.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\FXSCLNT.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\FXSCOVER.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\hkcmd.exe Infected: Virus.Win32.Hidrag.a 1
C:\I386\ICWCONN1.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\IEXPRESS.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\igfxcfg.exe Infected: Virus.Win32.Hidrag.a 1
C:\I386\igfxdiag.exe Infected: Virus.Win32.Hidrag.a 1
C:\I386\igfxtray.exe Infected: Virus.Win32.Hidrag.a 1
C:\I386\LOGONUI.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\MIGLOAD.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\migrate.exe Infected: Virus.Win32.Hidrag.a 1
C:\I386\MIGWIZ.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\MIGWIZ_A.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\MMC.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\MOBSYNC.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\MPLAY32.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\MSHEARTS.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\MSPAINT.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\MSTSC.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\NETSETUP.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\ORUN32.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\OSK.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\ounins32_s.exe Infected: Virus.Win32.Hidrag.a 1
C:\I386\PINBALL.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\PROGMAN.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\Prounstl.exe Infected: Virus.Win32.Hidrag.a 1
C:\I386\QTPluginInstaller.exe Infected: Virus.Win32.Hidrag.a 1
C:\I386\REGEDIT.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\RSTRUI.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\SNDREC32.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\SNDVOL32.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\SPIDER.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\SYSOCMGR.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\SYSPARSE.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\TASKMGR.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\tfswcmd.exe Infected: Virus.Win32.Hidrag.a 1
C:\I386\tfswctrl.exe Infected: Virus.Win32.Hidrag.a 1
C:\I386\TOUR.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\tourstart.exe Infected: Virus.Win32.Hidrag.a 1
C:\I386\unregmp2.exe Infected: Virus.Win32.Hidrag.a 1
C:\I386\vzNetDetectEx.exe Infected: Virus.Win32.Hidrag.a 1
C:\I386\WBEMTEST.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\WIAACMGR.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\WINMINE.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\WMIADAP.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\WMIPRVSE.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\wmlaunch.exe Infected: Virus.Win32.Hidrag.a 1
C:\I386\wmsetsdk.exe Infected: Virus.Win32.Hidrag.a 1
C:\I386\WSCRIPT.EXE Infected: Virus.Win32.Hidrag.a 1
C:\I386\wuauclt.exe Infected: Virus.Win32.Hidrag.a 1
C:\I386\wuauclt1.exe Infected: Virus.Win32.Hidrag.a 1
C:\ilpg9ejd.com Infected: Worm.Win32.AutoRun.eep 1
C:\j.cmd Infected: Trojan-PSW.Win32.OnLineGames.aejw 1
C:\l9dwu8.bat Infected: Trojan-PSW.Win32.OnLineGames.yop 1
C:\lp3c.bat Infected: Trojan-PSW.Win32.OnLineGames.aiqm 1
C:\mayyuk9g.bat Infected: Trojan-PSW.Win32.OnLineGames.ajvr 1
C:\mrsne.bat Infected: Trojan.Win32.Vaklik.alp 1
C:\nl.com Infected: Trojan.Win32.Vaklik.yt 1
C:\np.exe Infected: Worm.Win32.AutoRun.ddx 1
C:\nsv.bat Infected: Trojan-PSW.Win32.OnLineGames.acbi 1
C:\o9o2u.bat Infected: Trojan-PSW.Win32.OnLineGames.acpf 1
C:\pnc.exe Infected: Trojan-PSW.Win32.OnLineGames.ztb 1
C:\Program Files\Ahead\InCD\InCD.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\AIM\aimauto.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\AIM\Sysfiles\AOLToolbar.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\AIM\Sysfiles\viewpoint.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\AIM\uninstll.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\AIM\unwise32.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avconfig.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avnotify.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avscan.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Avira\AntiVir PersonalEdition Classic\fact.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Avira\AntiVir PersonalEdition Classic\licmgr.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Avira\AntiVir PersonalEdition Classic\setup.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Avira\AntiVir PersonalEdition Classic\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Avira\AntiVir PersonalEdition Classic\wsctool.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\Borland Shared\BDE\bdeadmin.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\Hewlett-Packard\Scanjet\bin\hpsjrreg.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriver.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriver2.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriver.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriver2.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\InstallShield\Driver\7\Intel 32\IDriver.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver2.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\InstallShield\UpdateService\ISDM.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\Microsoft Shared\MODI\11.0\MSPVIEW.EXE Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\Microsoft Shared\MSInfo\OINFOP11.EXE Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\Microsoft Shared\web server extensions\50\bin\CFGWIZ.EXE Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\Nullsoft\ActiveX\2.0\AOLMediaPlaybackControl.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\Nullsoft\ActiveX\2.4\AOLMediaPlaybackControl.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\Nullsoft\ActiveX\AOLMediaPlaybackControl.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\Real\GToolbar\GDSSetup.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\Real\GToolbar\GoogleToolbarInstaller.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\Real\GToolbar\GoogleToolbarInstaller98.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\Verizon Online\SFP\vzNetSvc.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\Verizon Online\SFP\vzSFPWin.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Common Files\Verizon Online\VOLMSN\vzMsnIns.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1\HXFSetup.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\DellSupport\DellAutomatedPCTuneUp.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\DellSupport\DellFix.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\DellSupport\Direct.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\DellSupport\DSBrws.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\DellSupport\DSHelp.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\DellSupport\GTCoach\AdpBrowser.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\DellSupport\GTCoach\GTNY.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Hijackthis\unins000.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\HP\Digital Imaging\bin\hpofxs08.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\HP\Digital Imaging\bin\hpospd08.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\HP\Digital Imaging\bin\hpqacdse.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\HP\Digital Imaging\bin\hpqcsaha.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\HP\Digital Imaging\bin\hpqdirec.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\HP\Digital Imaging\bin\hpqdstcp.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\HP\Digital Imaging\bin\hpqEmlsz.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\HP\Digital Imaging\bin\hpqisc01.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\HP\Digital Imaging\bin\hpqise01.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\HP\Digital Imaging\bin\hpqpanos.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\HP\Digital Imaging\bin\HPQPSXP.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\HP\Digital Imaging\bin\hpqqpawp.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\HP\Digital Imaging\bin\hpqtbx01.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\HP\Digital Imaging\bin\hpqvpswp.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\HP\Digital Imaging\bin\hpsjrreg.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprbui.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Image-Line\FL Studio 8\Plugins\Fruity\Generators\Chrome\GraphicsTester.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Image-Line\FL Studio 8\Plugins\Fruity\Generators\Chrome\TunnelProfiler.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\InstallShield Installation Information\{D3161124-2B4D-478F-901A-D21BCAD72C7E}\setup.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\InstallShield Installation Information\{E646DCF0-5A68-11D5-B229-002078017FBF}\Setup.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\setup.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Intel\PROSetWired\NCS\PROSet\PROSet.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Intel\PROSetWired\NCS\WMIProv\8023\CDM\NcsDiag.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Intel\PROSetWired\NCS\WMIProv\8023\NcsWmiEv.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Intel\PROSetWired\NCS\WMIProv\8023\NcsWmiIm.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Intel\PROSetWired\NCS\WMIProv\NcsWmiCo.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Microsoft Office\OFFICE11\GRAPH.EXE Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Microsoft Office\OFFICE11\MSTORDB.EXE Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Microsoft Office\OFFICE11\MSTORE.EXE Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Microsoft Office\OFFICE11\OIS.EXE Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Microsoft Office\OFFICE11\POWERPNT.EXE Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Microsoft Office\OFFICE11\PPTVIEW.EXE Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Microsoft Office\OFFICE11\PROFLWIZ.EXE Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\MSN\MsnInstaller\msninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\MSN Messenger\dw.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\MSN Messenger\msnmsgr.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\QuickTime\PictureViewer.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\QuickTime\QTInfo.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\QuickTime\QTSystem\ExportController.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\QuickTime\QTSystem\QuickTimeUpdateHelper.exe Infected: Virus.Win32.Hidrag.a 1
C:\Program Files\Windows Media Player\wmlaunch.exe Infected: Virus.Win32.Hidrag.a 1
C:\QooBox\Quarantine\C\096.bat.vir Infected: Trojan-GameThief.Win32.Magania.ztm 1
C:\QooBox\Quarantine\C\1rfw8hjr.com.vir Infected: Trojan.Win32.Vaklik.cla 1
C:\QooBox\Quarantine\C\1t6yxlxx.cmd.vir Infected: Worm.Win32.AutoRun.mug 1
C:\QooBox\Quarantine\C\1u0o8bnq.cmd.vir Infected: Worm.Win32.AutoRun.nns 1
C:\QooBox\Quarantine\C\2.cmd.vir Infected: Trojan-GameThief.Win32.OnLineGames.suxq 1
C:\QooBox\Quarantine\C\62oop0ak.bat.vir Infected: Trojan.Win32.Vaklik.bwk 1
C:\QooBox\Quarantine\C\a.bat.vir Infected: Trojan-PSW.Win32.OnLineGames.acez 1
C:\QooBox\Quarantine\C\a1.bat.vir Infected: Worm.Win32.AutoRun.ndh 1
C:\QooBox\Quarantine\C\b3b9u.com.vir Infected: Trojan-GameThief.Win32.OnLineGames.sqnb 1
C:\QooBox\Quarantine\C\ceqfqp.bat.vir Infected: Worm.Win32.AutoRun.eor 1
C:\QooBox\Quarantine\C\Documents and Settings\brittaney\Application Data\ijjigame\ijjistarter2.exe.vir Infected: Virus.Win32.Hidrag.a 1
C:\QooBox\Quarantine\C\Documents and Settings\brittaney\Application Data\ijjigame\ijjistarter2FxB.exe.vir Infected: Virus.Win32.Hidrag.a 1
C:\QooBox\Quarantine\C\DOCUME~1\BRITTA~1\LOCALS~1\Temp\n.dll.vir Infected: Trojan-GameThief.Win32.OnLineGames.sgbk 1
C:\QooBox\Quarantine\C\DOCUME~1\BRITTA~1\LOCALS~1\Temp\ozbcfvk.dll.vir Infected: Trojan-GameThief.Win32.Magania.yyx 1
C:\QooBox\Quarantine\C\DOCUME~1\BRITTA~1\LOCALS~1\Temp\p.dll.vir Infected: Trojan-GameThief.Win32.OnLineGames.sjas 1
C:\QooBox\Quarantine\C\DOCUME~1\BRITTA~1\LOCALS~1\Temp\zb5ok.dll.vir Infected: Trojan-GameThief.Win32.OnLineGames.sghp 1
C:\QooBox\Quarantine\C\DOCUME~1\BRITTA~1\LOCALS~1\Temp\zzaho.dll.vir Infected: Trojan-GameThief.Win32.Magania.yza 1
C:\QooBox\Quarantine\C\hgu.bat.vir Infected: Trojan-GameThief.Win32.Magania.vzi 1
C:\QooBox\Quarantine\C\kaq86asx.bat.vir Infected: Worm.Win32.AutoRun.eeu 1
C:\QooBox\Quarantine\C\kk3.bat.vir Infected: Trojan-GameThief.Win32.OnLineGames.arwx 1
C:\QooBox\Quarantine\C\kn6jhgc.cmd.vir Infected: Trojan.Win32.Vaklik.cms 1
C:\QooBox\Quarantine\C\l1.cmd.vir Infected: Trojan-GameThief.Win32.Magania.zmx 1
C:\QooBox\Quarantine\C\m9as2c.cmd.vir Infected: Trojan-GameThief.Win32.OnLineGames.tazo 1
C:\QooBox\Quarantine\C\n.com.vir Infected: Trojan-GameThief.Win32.OnLineGames.sm 1
C:\QooBox\Quarantine\C\nqgcd.com.vir Infected: Trojan.Win32.Vaklik.buv 1
C:\QooBox\Quarantine\C\ov.cmd.vir Infected: Worm.Win32.AutoRun.mmk 1
C:\QooBox\Quarantine\C\ox.cmd.vir Infected: Trojan.Win32.Vaklik.bhh 1
C:\QooBox\Quarantine\C\pamn.exe.vir Infected: Worm.Win32.AutoRun.mhv 1
C:\QooBox\Quarantine\C\r1y1.bat.vir Infected: Trojan-GameThief.Win32.OnLineGames.tdqz 1
C:\QooBox\Quarantine\C\r813.bat.vir Infected: Trojan.Win32.Vaklik.cpe 1
C:\QooBox\Quarantine\C\svdioajm.cmd.vir Infected: Trojan-GameThief.Win32.OnLineGames.sovk 1
C:\QooBox\Quarantine\C\t.exe.vir Infected: Trojan-GameThief.Win32.Magania.zsg 1
C:\QooBox\Quarantine\C\tyktjfww.exe.vir Infected: Worm.Win32.AutoRun.lnv 1
C:\QooBox\Quarantine\C\u9dyi.exe.vir Infected: Trojan-GameThief.Win32.Magania.aayk 1
C:\QooBox\Quarantine\C\v3pif.bat.vir Infected: Trojan-PSW.Win32.OnLineGames.ailg 1
C:\QooBox\Quarantine\C\WINDOWS\scvhost.exe.vir Infected: Backdoor.Win32.SdBot.ajw 1
C:\QooBox\Quarantine\C\WINDOWS\svchost.exe.vir Infected: Virus.Win32.Hidrag.a 1
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\ckvo2.dll.vir Infected: Trojan-GameThief.Win32.OnLineGames.tdtz 1
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\kavo2.dll.vir Infected: Worm.Win32.AutoRun.eqn 1
C:\QooBox\Quarantine\C\x1.cmd.vir Infected: Trojan.Win32.Vaklik.bpd 1
C:\QooBox\Quarantine\C\xk2n.bat.vir Infected: Trojan.Win32.Vaklik.doy 1
C:\QooBox\Quarantine\C\y.cmd.vir Infected: Trojan-GameThief.Win32.OnLineGames.rzrz 1
C:\QooBox\Quarantine\C\yssjnngm.cmd.vir Infected: Worm.Win32.AutoRun.lsz 1
C:\QooBox\Quarantine\catchme2008-09-22_182618.39.zip Infected: Trojan.Win32.Vaklik.bop 1
C:\QooBox\Quarantine\catchme2008-09-22_182618.39.zip Infected: Worm.Win32.AutoRun.lpy 1
C:\QooBox\Quarantine\catchme2008-09-22_182618.39.zip Infected: Trojan-GameThief.Win32.OnLineGames.svyu 1
C:\QooBox\Quarantine\catchme2008-09-22_182618.39.zip Infected: Trojan.Win32.Vaklik.bln 1
C:\QooBox\Quarantine\catchme2008-09-22_182618.39.zip Infected: Trojan-GameThief.Win32.Magania.zis 1
C:\QooBox\Quarantine\catchme2008-09-22_182618.39.zip Infected: Trojan.Win32.Vaklik.bim 1
C:\QooBox\Quarantine\catchme2008-09-22_182618.39.zip Infected: Trojan-GameThief.Win32.OnLineGames.arxl 1
C:\QooBox\Quarantine\catchme2008-09-22_182618.39.zip Infected: Worm.Win32.AutoRun.lsb 1
C:\QooBox\Quarantine\catchme2008-09-22_182618.39.zip Infected: Worm.Win32.AutoRun.ekz 1
C:\QooBox\Quarantine\catchme2008-09-22_182618.39.zip Infected: Worm.Win32.AutoRun.mrx 2
C:\QooBox\Quarantine\catchme2008-09-22_182618.39.zip Infected: Trojan-GameThief.Win32.Magania.zpq 1
C:\QooBox\Quarantine\catchme2008-09-22_182618.39.zip Infected: Trojan.Win32.Vaklik.bnz 1
C:\QooBox\Quarantine\catchme2008-09-22_182618.39.zip Infected: Trojan.Win32.Vaklik.cen 1
C:\QooBox\Quarantine\catchme2008-09-22_182618.39.zip Infected: Worm.Win32.AutoRun.ltt 1
C:\QooBox\Quarantine\catchme2008-09-22_182618.39.zip Infected: Trojan-GameThief.Win32.Magania.achy 1
C:\QooBox\Quarantine\catchme2008-09-22_182618.39.zip Infected: Trojan.Win32.Vaklik.bcy 1
C:\QooBox\Quarantine\catchme2008-09-22_182618.39.zip Infected: Trojan.Win32.Vaklik.bwc 1
C:\QooBox\Quarantine\catchme2008-09-22_182618.39.zip Infected: Trojan-GameThief.Win32.Magania.abgx 1
C:\QooBox\Quarantine\catchme2008-09-22_182618.39.zip Infected: Worm.Win32.AutoRun.ntl 1
C:\QooBox\Quarantine\catchme2008-09-22_182618.39.zip Infected: Trojan.Win32.Pakes.knl 1
C:\QooBox\Quarantine\catchme2008-09-22_182618.39.zip Infected: Worm.Win32.AutoRun.lqa 1
C:\QooBox\Quarantine\catchme2008-09-22_182618.39.zip Infected: Worm.Win32.AutoRun.efp 1
C:\QooBox\Quarantine\catchme2008-09-22_182618.39.zip Infected: Trojan-GameThief.Win32.Magania.acqa 1
C:\QooBox\Quarantine\catchme2008-09-22_182618.39.zip Infected: Trojan-GameThief.Win32.Magania.ytx 1
C:\QooBox\Quarantine\catchme2008-09-22_182618.39.zip Infected: Trojan.Win32.Vaklik.cba 1
C:\rjiybg.exe Infected: Trojan-PSW.Win32.OnLineGames.yxb 1
C:\StubInstaller.exe Infected: Virus.Win32.Hidrag.a 1
C:\stwi.com Infected: Trojan-PSW.Win32.OnLineGames.aijl 1
C:\v2h3.exe Infected: Trojan-PSW.Win32.OnLineGames.abts 1
C:\WINDOWS\$hf_mig$\KB834707\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB834707\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB867282\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB867282\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB873333\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB873333\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB873339\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB873339\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB883939\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB883939\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB885250\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB885250\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB885835\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB885835\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB885836\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB885836\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB886185\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB886185\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB887472\SP2QFE\msmsgs.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB887472\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB887472\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB887742\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB887742\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB888113\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB888113\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB888302\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB888302\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB890046\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB890046\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB890047\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB890047\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB890175\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB890175\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB890859\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB890859\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB890923\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB890923\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB891781\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB891781\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB893066\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB893066\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB893086\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB893086\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB893756\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB893756\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB894391\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB894391\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB896358\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB896358\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB896422\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB896422\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB896423\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB896423\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB896424\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB896424\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB896428\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB896428\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB896688\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB896688\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB896727\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB896727\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB898461\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB898461\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB899587\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB899587\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB899588\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB899588\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB899591\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB899591\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB900485\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB900485\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB900725\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB900725\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB901017\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB901017\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB901190\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB901190\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB901214\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB901214\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB902400\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB902400\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB904706\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB904706\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB904942\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB904942\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB905414\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB905414\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB905749\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB905749\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB905915\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB905915\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB908519\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB908519\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB908531\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB908531\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB910437\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB910437\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB911280\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB911280\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB911562\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB911562\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB911567\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB911567\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB911927\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB911927\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB912812\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB912812\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB912919\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB912919\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB913446\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB913446\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB913580\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB913580\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB914388\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB914388\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB914389\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB914389\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB916281\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB916281\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB916595\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB916595\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB917159\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB917159\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB917344\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB917344\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB917422\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB917422\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB917953\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB917953\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB918118\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB918118\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB918439\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB918439\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB918899\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB918899\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB919007\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB919007\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB920214\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB920214\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB920670\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB920670\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB920683\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB920683\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB920685\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB920685\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB920872\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB920872\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB921398\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB921398\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB921503\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB921503\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB921883\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB921883\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB922582\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB922582\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB922616\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB922616\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB922819\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB922819\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB923414\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB923414\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB923694\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB923694\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB923980\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB923980\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB924191\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB924191\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB924270\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB924270\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB925902\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB925902\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB926247\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB926247\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB926255\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB926255\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB926436\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB926436\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB927779\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB927779\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB927802\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB927802\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB927891\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB927891\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB928255\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB928255\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB928843\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB928843\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB929123\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB929123\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB929338\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB929338\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB930178\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB930178\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB930916\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB930916\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB931261\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB931261\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB931784\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB931784\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB931836\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB931836\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB932823-v3\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB932823-v3\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB933360\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB933360\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB935839\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB935839\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB935840\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB935840\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB936021\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB936021\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB936357\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB936357\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB938464\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB938464\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB938828\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB938828\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB938829\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB938829\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB941202\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB941202\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB941568\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB941568\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB941644\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB941644\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB941693\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB941693\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB942763\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB942763\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB943055\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB943055\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB943485\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB943485\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB944338-v2\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB944338-v2\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB944653\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB944653\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB945553\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB945553\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB946026\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB946026\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB948590\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB948590\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB948881\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB948881\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB950749\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB950749\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB950760\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB950760\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB950762\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB950762\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB950974\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB950974\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB951066\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB951066\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB951072-v2\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB951072-v2\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB951376\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB951376\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB951376-v2\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB951376-v2\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB951698\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB951698\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB951748\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB951748\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB952287\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB952287\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB952954\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB952954\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB953839\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$hf_mig$\KB953839\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$MSI31Uninstall_KB893803$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB834707$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB867282$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB873333$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB873339$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB883939$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB885250$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB885884$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB887472$\msmsgs.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB887472$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB887742$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB888113$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB890047$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB890175$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB890923$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB891781$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB893066$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB893086$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB896422$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB896424$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB896688$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB896727$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB898458$\orun32.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB899588$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB901190$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB903235$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB904942$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB905915$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB911564$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB911565$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB911567$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB912812$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB912919$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB913446$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB914440$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB915865$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB916281$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB917159$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB917344$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB917422$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB918899$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB918899_0$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB920213$\agentsvr.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB920214$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB921398$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB921503$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB921883$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB922616$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB923694$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB923723$\orun32.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB924191$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB926239$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB926247$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB929338$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB932823-v3$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB933360$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB936021$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB936357$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB938828$\explorer.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB938828$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB938829$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB941568$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB941644$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB941693$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB943055$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB943460$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB943485$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB944338-v2$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB945553$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB946026$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB948590$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB948881$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB950749$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallWMFDist11$\wmsetsdk.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\Help\SBSI\Training\orun32.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\Help\SBSI\Training\ounins32_s.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\ie7beta3\spuninst\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\IsUninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\network diagnostic\xpnetdiag.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\NuNinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\RegisteredPackages\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}\setup_wm.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\RegisteredPackages\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}$BACKUP$\System\setup_wm.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\logagent.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}\migrate.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}\unregmp2.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}\wmlaunch.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\migrate.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\unregmp2.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\wmlaunch.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\accwiz.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\cfgwiz.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\clipbrd.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\conf.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\dfrgntfs.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\dialer.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\dwwin.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\eudcedit.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\fp98swin.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\fsquirt.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\fxsclnt.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\fxscover.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\helpctr.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\icwconn1.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\iexpress.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\irftp.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\logonui.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\migload.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\migwiz.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\mmc.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\mobsync.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\moviemk.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\mplay32.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\msconfig.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\msmsgs.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\mspaint.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\netsetup.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\osk.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\pinball.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\progman.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\regedit.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\rstrui.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\sndrec32.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\spider.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\sysocmgr.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\taskmgr.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\tourstrt.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\wbemtest.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\wiaacmgr.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\winhlp32.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\wmiadap.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\wmiprvse.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\wordpad.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\wscript.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\digcore.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\lang\cintsetp.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\lang\imjpdct.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\lang\imjpdsvr.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\lang\imjpinst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\lang\imjpmig.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\lang\imjprw.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\lang\imjputy.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\lang\tintsetp.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\f3174104a45ae9b1276d8609df91dcb9\spuninst.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SoftwareDistribution\Download\f3174104a45ae9b1276d8609df91dcb9\update\update.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\svchost.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SYSTEM32\dla\tfswcmd.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SYSTEM32\drmupgds.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SYSTEM32\FinePointLib\vzNetDetectEx.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SYSTEM32\ialmudlg.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SYSTEM32\igfxcfg.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SYSTEM32\igfxzoom.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SYSTEM32\Macromed\Flash\FlashUtil9e.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SYSTEM32\Macromed\Flash\NPSWF32_FlashUtil.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SYSTEM32\Macromed\Shockwave 10\UNWISE.EXE Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SYSTEM32\Prounstl.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SYSTEM32\ReinstallBackups\0009\DriverFiles\hkcmd.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SYSTEM32\ReinstallBackups\0009\DriverFiles\igfxcfg.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SYSTEM32\ReinstallBackups\0009\DriverFiles\igfxdiag.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SYSTEM32\ReinstallBackups\0009\DriverFiles\igfxtray.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SYSTEM32\UNWISE.EXE Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SYSTEM32\WinFXDocObj.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\SYSTEM32\WudfHost.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\uninstall-temp.exe Infected: Virus.Win32.Hidrag.a 1
C:\WINDOWS\UninstallFirefox.exe Infected: Virus.Win32.Hidrag.a 1
C:\xj.bat Infected: Trojan-PSW.Win32.OnLineGames.abiq 1
D:\0.com Infected: Trojan.Win32.Pakes.cum 1
D:\0gjn3yw.exe Infected: Trojan.Win32.Vaklik.bop 1
D:\0qx0sc6.bat Infected: Trojan-PSW.Win32.OnLineGames.adsy 1
D:\1f29aa54b6025b3137c9e8c067436610\Setup.EXE Infected: Virus.Win32.Hidrag.a 1
D:\1rexh.com Infected: Worm.Win32.AutoRun.lpy 1
D:\2fe397b0b589bb544d307b8d24ca78c3\Setup.EXE Infected: Virus.Win32.Hidrag.a 1
D:\2y8la.exe Infected: Trojan-PSW.Win32.OnLineGames.abfk 1
D:\30ed3.exe Infected: Trojan-PSW.Win32.OnLineGames.aasa 1
D:\39lpji.com Infected: Worm.Win32.AutoRun.nan 1
D:\3jkkdo.exe Infected: Worm.Win32.AutoRun.mvk 1
D:\606b9d1c7be2b19cbe\Setup.EXE Infected: Virus.Win32.Hidrag.a 1
D:\6g3.com Infected: Trojan-PSW.Win32.OnLineGames.aeai 1
D:\7-Zip\7zFM.exe Infected: Virus.Win32.Hidrag.a 1
D:\7-Zip\7zG.exe Infected: Virus.Win32.Hidrag.a 1
D:\83fgj.com Infected: Trojan-GameThief.Win32.OnLineGames.svyu 1
D:\8e.com Infected: Trojan-GameThief.Win32.OnLineGames.rxty 1
D:\8uot.exe Infected: Trojan.Win32.Vaklik.bln 1
D:\93vx0c.com Infected: Trojan-PSW.Win32.OnLineGames.ahvd 1
D:\9f3np.bat Infected: Trojan.Win32.Vaklik.ajx 1
D:\a.bat Infected: Trojan-PSW.Win32.OnLineGames.acez 1
D:\b.bat Infected: Trojan-PSW.Win32.OnLineGames.ambe 1
D:\bpu.exe Infected: Trojan-GameThief.Win32.Magania.zis 1
D:\c.com Infected: Trojan-PSW.Win32.OnLineGames.aayq 1
D:\c0f78391f3c18de841\Setup.EXE Infected: Virus.Win32.Hidrag.a 1
D:\c9.com Infected: Trojan.Win32.Vaklik.aeg 1
D:\cm0.com Infected: Trojan.Win32.Vaklik.bim 1
D:\Copy of setup.exe Infected: Virus.Win32.Hidrag.a 1
D:\cubp.bat Infected: Trojan.Win32.Vaklik.anw 1
D:\DELL\drivers\R94481\setup.exe Infected: Virus.Win32.Hidrag.a 1
D:\DELL\MEDIAEXE\ODM.EXE Infected: Virus.Win32.Hidrag.a 1
D:\DELL\PREODM.EXE Infected: Virus.Win32.Hidrag.a 1
D:\DELL\Utilities\DSR\DSRIRRemv2.exe Infected: Virus.Win32.Hidrag.a 1
D:\dh66ln.cmd Infected: Trojan-PSW.Win32.OnLineGames.abnh 1
D:\Downloads\Firefox Setup 1.5.0.1.exe Infected: Virus.Win32.Hidrag.a 1
D:\Downloads\MSSetup.exe Infected: Virus.Win32.Hidrag.a 1
D:\Downloads\wbsamp.exe Infected: Virus.Win32.Hidrag.a 1
D:\dpu1.exe Infected: Worm.Win32.AutoRun.mhu 1
D:\e.com Infected: Trojan.Win32.Vaklik.cpb 1
D:\e6.com Infected: Trojan.Win32.Vaklik.bxf 1
D:\e9ehn1m8.com Infected: Trojan.Win32.Vaklik.cdj 1
D:\f2ir.com Infected: Trojan-PSW.Win32.OnLineGames.acct 1
D:\Firefox Setup 3.0.1.exe Infected: Virus.Win32.Hidrag.a 1
D:\Firefox Setup 3.0.exe Infected: Virus.Win32.Hidrag.a 1
D:\fortec\AL7BAR Downloading Tool v1.31.exe Infected: Virus.Win32.Hidrag.a 1
D:\fortec\al7bar.exe Infected: Virus.Win32.Hidrag.a 1
D:\fortec\albar.exe Infected: Virus.Win32.Hidrag.a 1
D:\fortec\Blacklist STB UPDATER 1.3.exe Infected: Virus.Win32.Hidrag.a 1
D:\fortec\Forecstar STB Updater v3.21.exe Infected: Virus.Win32.Hidrag.a 1
D:\fortec\stb.exe Infected: Virus.Win32.Hidrag.a 1
D:\fortec\updater.exe Infected: Virus.Win32.Hidrag.a 1
D:\fortec\vary\b75_m\Fortecstar STB Updater v3.31.exe Infected: Virus.Win32.Hidrag.a 1
D:\fortec\vary\Blacklist Updater.exe Infected: Virus.Win32.Hidrag.a 1
D:\fortec\vary\CS 251T Lightening 100 T Serial Feb 19 2008\Blacklist Updater.exe Infected: Virus.Win32.Hidrag.a 1
D:\fortec\vary\FLU, 2500, to 2700 & back to FLU, 2500\2700 to 2500 Loader Converter.exe Infected: Virus.Win32.Hidrag.a 1
D:\fortec\vary\FLU, 2500, to 2700 & back to FLU, 2500\BL-Updater.exe Infected: Virus.Win32.Hidrag.a 1
D:\fortec\vary\FLU, 2500, to 2700 & back to FLU, 2500\FLU, 2500, to 2700 & back to FLU, 2500\2700 to 2500 Loader Converter.exe Infected: Virus.Win32.Hidrag.a 1
D:\fortec\vary\FLU, 2500, to 2700 & back to FLU, 2500\FLU, 2500, to 2700 & back to FLU, 2500\BL-Updater.exe Infected: Virus.Win32.Hidrag.a 1
D:\fortec\vary\fortech\b75_m\Fortecstar STB Updater v3.31.exe Infected: Virus.Win32.Hidrag.a 1
D:\fortec\vary\fortech\Blacklist Updater.exe Infected: Virus.Win32.Hidrag.a 1
D:\fortec\vary\fortech\FortecStarUploader\Fortecstar STB Updater v3.31.exe Infected: Virus.Win32.Hidrag.a 1
D:\fortec\vary\fortech\Ultra boot repair kit\Ultra boot repair kit\updater.exe Infected: Virus.Win32.Hidrag.a 1
D:\fortec\vary\fortech\Ultra boot repair kit\updater.exe Infected: Virus.Win32.Hidrag.a 1
D:\fortec\vary\FortecStarUploader\Fortecstar STB Updater v3.31.exe Infected: Virus.Win32.Hidrag.a 1
D:\fortec\vary\Ultra boot repair kit\Ultra boot repair kit\updater.exe Infected: Virus.Win32.Hidrag.a 1
D:\fortec\vary\Ultra boot repair kit\updater.exe Infected: Virus.Win32.Hidrag.a 1
D:\fortec\wrar351.exe Infected: Virus.Win32.Hidrag.a 1
D:\g2pfnid.com Infected: Trojan.Win32.Vaklik.chp 1
D:\gabptk6d.bat Infected: Trojan-PSW.Win32.Magania.raa 1
D:\gsxlexd.cmd Infected: Worm.Win32.AutoRun.dny 1
D:\h3hi1k3.exe Infected: Worm.Win32.AutoRun.dox 1
D:\hovrflst.bat Infected: Trojan.Win32.Vaklik.apk 1
D:\i0.cmd Infected: Trojan.Win32.Vaklik.yp 1
D:\ilpg9ejd.com Infected: Worm.Win32.AutoRun.eep 1
D:\iwjj.com Infected: Trojan-GameThief.Win32.OnLineGames.arxl 1
D:\j.cmd Infected: Trojan-PSW.Win32.OnLineGames.aejw 1
D:\jv.exe Infected: Worm.Win32.AutoRun.lsb 1
D:\k.com Infected: Worm.Win32.AutoRun.ekz 1
D:\ktnquo.exe Infected: Worm.Win32.AutoRun.mrx 1
D:\l9dwu8.bat Infected: Trojan-PSW.Win32.OnLineGames.yop 1
D:\lcmqm.exe Infected: Trojan-GameThief.Win32.Magania.zpq 1
D:\LimeWire\uninstall.exe Infected: Virus.Win32.Hidrag.a 1
D:\LimeWire Songs\already in love passion.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1
D:\LimeWire Songs\Fruity Loops v8\Install.exe Infected: Trojan.Win32.Buzus.ryd 1
D:\LimeWire Songs\heart of life.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1
D:\LimeWire Songs\if youre lucky no one will ge 192kb.mp3 Infected: Trojan-Downloader.WMA.GetCodec.f 1
D:\lp3c.bat Infected: Trojan-PSW.Win32.OnLineGames.aiqm 1
D:\lsfjg.com Infected: Trojan.Win32.Vaklik.bnz 1
D:\m8wafly.com Infected: Trojan.Win32.Vaklik.cen 1
D:\mayyuk9g.bat Infected: Trojan-PSW.Win32.OnLineGames.ajvr 1
D:\mnl6on3.com Infected: Worm.Win32.AutoRun.ltt 1
D:\Movie Maker\moviemk.exe Infected: Virus.Win32.Hidrag.a 1
D:\mrsne.bat Infected: Trojan.Win32.Vaklik.alp 1
D:\nl.com Infected: Trojan.Win32.Vaklik.yt 1
D:\np.exe Infected: Worm.Win32.AutoRun.ddx 1
D:\nsv.bat Infected: Trojan-PSW.Win32.OnLineGames.acbi 1
D:\o9o2u.bat Infected: Trojan-PSW.Win32.OnLineGames.acpf 1
D:\okhr.exe Infected: Trojan-GameThief.Win32.Magania.achy 1
D:\p1f6b.exe Infected: Trojan.Win32.Vaklik.bcy 1
D:\p83gjy.exe Infected: Trojan.Win32.Vaklik.bwc 1
D:\palmOne\AddItManager.exe Infected: Virus.Win32.Hidrag.a 1
D:\ph.com Infected: Trojan-GameThief.Win32.Magania.abgx 1
D:\pnc.exe Infected: Trojan-PSW.Win32.OnLineGames.ztb 1
D:\rjiybg.exe Infected: Trojan-PSW.Win32.OnLineGames.yxb 1
D:\rjx0.exe Infected: Worm.Win32.AutoRun.ntl 1
D:\sasyg1y8.com Infected: Trojan.Win32.Pakes.knl 1
D:\SMAXWDM\GunboundRV_setup(2).exe Infected: Virus.Win32.Hidrag.a 1
D:\stwi.com Infected: Trojan-PSW.Win32.OnLineGames.aijl 1
D:\t.exe Infected: Trojan-GameThief.Win32.Magania.zsg 1
D:\t1ypkh.exe Infected: Worm.Win32.AutoRun.lqa 1
D:\tigi.cmd Infected: Trojan-PSW.Win32.OnLineGames.ajuj 1
D:\tn0k.exe Infected: Worm.Win32.AutoRun.efp 1
D:\u.exe Infected: Trojan.Win32.Vaklik.cel 1
D:\v2h3.exe Infected: Trojan-PSW.Win32.OnLineGames.abts 1
D:\v3pif.bat Infected: Trojan-PSW.Win32.OnLineGames.ailg 1
D:\vxl.exe Infected: Trojan-GameThief.Win32.Magania.acqa 1
D:\xj.bat Infected: Trojan-PSW.Win32.OnLineGames.abiq 1
D:\xqf.com Infected: Trojan-GameThief.Win32.Magania.ytx 1
D:\ybj8df.exe Infected: Trojan.Win32.Vaklik.cba 1

The selected area was scanned.

Logfile of HijackThis v1.99.1
Scan saved at 17:02, on 2008-09-23
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5450.0004)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellTransferAgent] "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O11 - Options group: [INTERNATIONAL] International*
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

xxsummer

Post #8September 24, 2008, 12:13 AM UTC

and yes please. i would like to reformat.

Tomk

Post #9September 24, 2008, 1:27 AM UTC

xxsummer,

That may be best. Sorry it turned out this way.

Something to think about. Many of the trojans that show on the Kaspersky report say Trojan-PSW. These are password stealers. Here is a definition of these beasties from Viruslist.com:

PSW Trojans

This family of Trojans steals passwords, normally system passwords from victim machines. They search for system files which contain confidential information such as passwords and Internet access telephone numbers and then send this information to an email address coded into the body of the Trojan. It will then be retrieved by the 'master' or user of the illegal program.

Some PSW Trojans steal other types of information such as:

* System details (memory, disk space, operating system details)
* Local email client
* IP-address
* Registration details
* Passwords for on-line games

If you do online gaming they will take your username and password. Sometimes they will even steal your authentication number. Even after reformatting, if someone has your information, they still have your information. You will need to change all passwords and information.

See here for a guide to formatting/re-installing, including backups and preparation:
http://www.geekstogo.com/forum/Reformat-In…ws-t173729.html

There are a few different ways to backup your data/documents, so be sure to research what would be best for you.

If you need more help, I suggest that you post a thread in the windows forum here. A member of the Tech Team that know way more about this than I do will help guide you.

Is there anything more that I can help you with? If not, I will reluctantly close this thread Resolved.

Tomk

Post #10September 28, 2008, 3:27 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Help please

✨ Ask AI

Ask AI