What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Smitfraud Trojan

40 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I am infected with Smitfraud. I went to the self-help forum and downloaded the two suggested programs (SmitfraudFix & Malwarebytes). I did the Malwarebytes Scan and I am posting the results; but when I did the SmitFraud Fix and selected option 1 "Search" I get an error message "AntiXPVSTFix.ex.exe has generated errors and will be shut down. You must restart the program"

Here are the two reports beginning with the HJT log.

PLEASE NOTE: I posted a different message the other day, but because one of the problems I am having is that ie generates an error when I try to post to message boards, I had three replies to my own message, so therefore I think the techs thought I was getting help because I didn't get any answers. I couldn't figure out how to delete my thread/post so I'm starting a new one here. Please forgive me.
Here are the logs:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:19:49, on 11/5/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\snmp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Intel\Intel® Active Monitor\imonnt.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Intel\Intel® Active Monitor\imontray.exe
C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb01.exe
C:\WINNT\system32\hpha2mon.exe
C:\Program Files\Labtec\Labtec Mouse Software\1.0\lwbwheel.exe
C:\Program Files\FarStone\RestoreIT!\RestoreIT!_2K\VBPTASK.EXE
C:\PROGRA~1\VISION~2\ONETOU~2.EXE
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINNT\system32\HPHipm08.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Microsoft Office\Office\1033\msoffice.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar5.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar5.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [IMONTRAY] C:\Program Files\Intel\Intel® Active Monitor\imontray.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb01.exe
O4 - HKLM\..\Run: [HPHA2MON] C:\WINNT\system32\hpha2mon.exe
O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Labtec\Labtec Mouse Software\1.0\lwbwheel.exe
O4 - HKLM\..\Run: [RestoreIT!] "C:\Program Files\FarStone\RestoreIT!\RestoreIT!_2K\VBPTASK.EXE" VBStart
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [OneTouch Monitor] C:\PROGRA~1\VISION~2\ONETOU~2.EXE
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\RunOnce: [SpybotDeletingA8391] command /c del "C:\WINNT\SchedLgU.Txt_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC859] cmd /c del "C:\WINNT\SchedLgU.Txt_tobedeleted"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB1992] command /c del "C:\WINNT\SchedLgU.Txt_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8871] cmd /c del "C:\WINNT\SchedLgU.Txt_tobedeleted"
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30985566-E01F-11D2-85DB-EA44DE000000} (IRTHMapDisplay Control) - https://irth.digsafelynewyork.com/IrthInter…HMapDisplay.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase6662.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - https://irth.digsafelynewyork.com/IrthInter…ry/mgaxctrl.cab
O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/…_2/axofupld.cab
O16 - DPF: {87BE3784-6977-4E84-AA08-55A96B9CEAC5} (Bl_camera Control) - http://catcam2.viewnetcam.com:4002/bl_camera.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A7207513-03D6-4CA7-9339-36869DC869BD}: NameServer = 206.231.8.2 206.231.8.3
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel® Active Monitor\imonnt.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

–
End of file - 6660 bytes


Malwarebytes' Anti-Malware 1.30
Database version: 1368
Windows 5.0.2195 Service Pack 4

11/5/2008 4:10:52 PM
mbam-log-2008-11-05 (16-10-52).txt

Scan type: Quick Scan
Objects scanned: 39616
Time elapsed: 2 minute(s), 9 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{87255c51-cd7d-4506-b9ad-97606daf53f3} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9522b3fb-7a2b-4646-8af6-36e7f593073c} (Adware.Coupons) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINNT\system32\gcomd32.dll (Trojan.BHO) -> Quarantined and deleted successfully.
Post #2
Download ComboFix from one of these locations:

Link 1
Link 2
Link 3


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
"copy/paste" a new HijackThis log file into this thread as well.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.


Also please describe how your computer behaves at the moment.
Post #3
Thank You. Here are the two logs. PLEASE NOTE: Although the beginning of the ComboFix log says that this machine does not have the recovery console installed, ComboFix did not stop and ask to install it. ComboFix just kept going; and the screen did not show the windows that you showed, but rather the black window you see when doing a registry change. Just an FYI.
Also, you asked how the computer was acting. Actually, it is acting fine, other than when I try to post a reply to a forum board (I only post to one other board - HGTV - I get an ie error and ie shuts down and re-opens. It did it on this board too when I posted my first query. It allowed the original post, but when I tried to edit the post to add additional information, I got the error. When I follow the "more information" link to microsoft, it just says that updates are important and to download updates. But it won't let me download the updates, it says there is an error on the page. It then tells you that you can bypass the problem by turning on automatic updates, which I did. HOWEVER I already had the SP4 and the ie updates to ie6. The only way I knew I had the Smitfraud was because it showed up on the Spytbot scan and spybot wasn't cleaning it out even though it said it did. The Smitfraud trojan wasn't acting like it's description that I read i.e. - changing my desktop and giving me a virus warning. I just knew it was there because of Spybot. I just assumed that the Smitfraud was what was causing the "posting" problem that I was having. I havn't tried to go back to the HGTV board to see if it is continuing to happen - I just want the bug out. I haven't had the problem on this board since that first time.
BTW - my desktop background is now gone since the ComboFix program ran. Not a problem, but I thought I would let you know.
Here is the ComboFix log:

ComboFix 08-11-05.02 - Doris 11/06/2008 8:52:21.1 - NTFSx86
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.154 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\winnt\system32\lm.dat
c:\winnt\system32\tb.dr
c:\winnt\Web\default.htt

.
((((((((((((((((((((((((( Files Created from 2008-10-06 to 2008-11-06 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-06 13:18 ——— d—–w c:\documents and settings\Doris\Application Data\AVG7
2008-11-05 21:27 2,518 —-a-w c:\winnt\system32\tmp.reg
2008-11-05 21:03 ——— d—–w c:\program files\Malwarebytes' Anti-Malware
2008-11-05 21:03 ——— d—–w c:\documents and settings\Doris\Application Data\Malwarebytes
2008-11-05 21:03 ——— d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-05 19:38 ——— d—–w c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2008-11-05 19:38 ——— d—–w c:\program files\File Scanner Library (Spybot - Search & Destroy)
2008-11-05 17:51 ——— d—–w c:\program files\Windows Live Safety Center
2008-11-04 20:47 4,287 —-a-w C:\_skey_04-11-2008__15-47-51.zip
2008-11-04 18:38 4,287 —-a-w C:\_skey_04-11-2008__13-38-18.zip
2008-11-03 13:43 4,287 —-a-w C:\_skey_03-11-2008__08-43-08.zip
2008-10-31 15:30 ——— d—–w c:\program files\Coupons
2008-10-28 19:09 270 —-a-w C:\_skey_28-10-2008__14-09-39.zip
2008-10-28 13:38 ——— d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-27 20:05 270 —-a-w C:\_skey_27-10-2008__15-05-52.zip
2008-10-27 15:54 ——— d—–w c:\program files\TeaTimer (Spybot - Search & Destroy)
2008-10-27 15:54 ——— d—–w c:\program files\SDHelper (Spybot - Search & Destroy)
2008-10-22 21:10 38,496 —-a-w c:\winnt\system32\drivers\mbamswissarmy.sys
2008-10-22 21:10 15,504 —-a-w c:\winnt\system32\drivers\mbam.sys
2008-10-10 12:58 82,944 —-a-w c:\winnt\system32\o4Patch.exe
2008-10-10 12:58 82,944 —-a-w c:\winnt\system32\IEDFix.C.exe
2008-10-01 19:51 87,552 —-a-w c:\winnt\system32\VACFix.exe
2008-09-15 05:13 1,644,432 —-a-w c:\winnt\system32\WIN32K.SYS
2008-09-12 15:41 ——— d—–w c:\program files\Punch! 5 in 1
2008-09-09 03:38 88,576 —-a-w c:\winnt\system32\AntiXPVSTFix.exe
2008-08-20 14:51 575,488 —-a-w c:\winnt\system32\WININET.DLL
2008-08-18 16:19 82,432 —-a-w c:\winnt\system32\404Fix.exe
2005-09-09 01:28 271 —h–w c:\program files\desktop.ini
2005-09-09 01:28 21,952 -c-h–w c:\program files\folder.htt

And here is the HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:59:07, on 11/6/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\snmp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Intel\Intel® Active Monitor\imonnt.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Intel\Intel® Active Monitor\imontray.exe
C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb01.exe
C:\WINNT\system32\hpha2mon.exe
C:\Program Files\Labtec\Labtec Mouse Software\1.0\lwbwheel.exe
C:\Program Files\FarStone\RestoreIT!\RestoreIT!_2K\VBPTASK.EXE
C:\WINNT\system32\HPHipm08.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Microsoft Office\Office\1033\msoffice.exe
C:\WINNT\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar5.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar5.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [IMONTRAY] C:\Program Files\Intel\Intel® Active Monitor\imontray.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb01.exe
O4 - HKLM\..\Run: [HPHA2MON] C:\WINNT\system32\hpha2mon.exe
O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Labtec\Labtec Mouse Software\1.0\lwbwheel.exe
O4 - HKLM\..\Run: [RestoreIT!] "C:\Program Files\FarStone\RestoreIT!\RestoreIT!_2K\VBPTASK.EXE" VBStart
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [OneTouch Monitor] C:\PROGRA~1\VISION~2\ONETOU~2.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30985566-E01F-11D2-85DB-EA44DE000000} (IRTHMapDisplay Control) - https://irth.digsafelynewyork.com/IrthInter…HMapDisplay.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase6662.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - https://irth.digsafelynewyork.com/IrthInter…ry/mgaxctrl.cab
O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/…_2/axofupld.cab
O16 - DPF: {87BE3784-6977-4E84-AA08-55A96B9CEAC5} (Bl_camera Control) - http://catcam2.viewnetcam.com:4002/bl_camera.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A7207513-03D6-4CA7-9339-36869DC869BD}: NameServer = 206.231.8.2 206.231.8.3
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel® Active Monitor\imonnt.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

–
End of file - 6318 bytes
Post #4
Do you know what these zip files are? C:\_skey_04-11-2008__15-47-51.zip C:\_skey_04-11-2008__13-38-18.zip C:\_skey_03-11-2008__08-43-08.zip
Post #5
No, I don't have a clue what they are. I see them when I go to My Computer/C: - when I click on properties it says they were created on 11/3/08 and 11/4/08 (contrary to the way they appear in the title). I also checked my "unzipped" folder, and they are not in there. Possibly they are the two programs I tried to download to get rid of the smitfraud trojan before I posted on WhattheTech. In the scans, I noticed references to catcam2.view net and also one for Kodak galleries. Both of them can be removed, if you tell me how - they aren't listed in the add/remove programs so I don't want to do anything wrong. Also, any reference to "coupons" or "coupon printer" can be removed also. I removed the program using add/remove programs the same day that I downloaded it, but there is still a folder showing when I go to My Computer/C:/Programs; I wasn't sure if I could just delete from that window or not.
Post #6
Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text. 

File::
C:\_skey_04-11-2008__15-47-51.zip
C:\_skey_04-11-2008__13-38-18.zip
C:\_skey_03-11-2008__08-43-08.zip
C:\_skey_28-10-2008__14-09-39.zip
C:\_skey_27-10-2008__15-05-52.zip

Folder::
c:\program files\Coupons

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.
Post #7
Here is the new HJT log; and also the new ComboFix log. The computer seems to be working okay, but I haven't run Spybot again yet, and I haven't gone to any message boards other than this one to see if i.e. shows me a warning. I have not gotten the warning when I post to this board. I will do that now and reply back - so there might be two reply's from me. Thank you.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:03:00, on 11/7/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\snmp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Intel\Intel® Active Monitor\imonnt.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Intel\Intel® Active Monitor\imontray.exe
C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb01.exe
C:\WINNT\system32\hpha2mon.exe
C:\Program Files\Labtec\Labtec Mouse Software\1.0\lwbwheel.exe
C:\Program Files\FarStone\RestoreIT!\RestoreIT!_2K\VBPTASK.EXE
C:\WINNT\system32\HPHipm08.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Microsoft Office\Office\1033\msoffice.exe
C:\WINNT\explorer.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar5.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar5.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [IMONTRAY] C:\Program Files\Intel\Intel® Active Monitor\imontray.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb01.exe
O4 - HKLM\..\Run: [HPHA2MON] C:\WINNT\system32\hpha2mon.exe
O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Labtec\Labtec Mouse Software\1.0\lwbwheel.exe
O4 - HKLM\..\Run: [RestoreIT!] "C:\Program Files\FarStone\RestoreIT!\RestoreIT!_2K\VBPTASK.EXE" VBStart
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [OneTouch Monitor] C:\PROGRA~1\VISION~2\ONETOU~2.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30985566-E01F-11D2-85DB-EA44DE000000} (IRTHMapDisplay Control) - https://irth.digsafelynewyork.com/IrthInter…HMapDisplay.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase6662.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - https://irth.digsafelynewyork.com/IrthInter…ry/mgaxctrl.cab
O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/…_2/axofupld.cab
O16 - DPF: {87BE3784-6977-4E84-AA08-55A96B9CEAC5} (Bl_camera Control) - http://catcam2.viewnetcam.com:4002/bl_camera.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A7207513-03D6-4CA7-9339-36869DC869BD}: NameServer = 206.231.8.2 206.231.8.3
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel® Active Monitor\imonnt.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

–
End of file - 6346 bytes

ComboFix 08-11-07.01 - Doris 11/07/2008 15:58:27.2 - NTFSx86
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.206 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Doris\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\_skey_03-11-2008__08-43-08.zip
C:\_skey_04-11-2008__13-38-18.zip
C:\_skey_04-11-2008__15-47-51.zip
C:\_skey_27-10-2008__15-05-52.zip
C:\_skey_28-10-2008__14-09-39.zip
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\_skey_03-11-2008__08-43-08.zip
C:\_skey_04-11-2008__13-38-18.zip
C:\_skey_04-11-2008__15-47-51.zip
C:\_skey_27-10-2008__15-05-52.zip
C:\_skey_28-10-2008__14-09-39.zip
c:\program files\Coupons
c:\program files\Coupons\uninstall.exe

.
((((((((((((((((((((((((( Files Created from 2008-10-07 to 2008-11-07 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-07 13:18 ——— d—–w c:\documents and settings\Doris\Application Data\AVG7
2008-11-05 21:27 2,518 —-a-w c:\winnt\system32\tmp.reg
2008-11-05 21:03 ——— d—–w c:\program files\Malwarebytes' Anti-Malware
2008-11-05 21:03 ——— d—–w c:\documents and settings\Doris\Application Data\Malwarebytes
2008-11-05 21:03 ——— d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-05 19:38 ——— d—–w c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2008-11-05 19:38 ——— d—–w c:\program files\File Scanner Library (Spybot - Search & Destroy)
2008-11-05 17:51 ——— d—–w c:\program files\Windows Live Safety Center
2008-10-28 13:38 ——— d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-27 15:54 ——— d—–w c:\program files\TeaTimer (Spybot - Search & Destroy)
2008-10-27 15:54 ——— d—–w c:\program files\SDHelper (Spybot - Search & Destroy)
2008-10-22 21:10 38,496 —-a-w c:\winnt\system32\drivers\mbamswissarmy.sys
2008-10-22 21:10 15,504 —-a-w c:\winnt\system32\drivers\mbam.sys
2008-10-10 12:58 82,944 —-a-w c:\winnt\system32\o4Patch.exe
2008-10-10 12:58 82,944 —-a-w c:\winnt\system32\IEDFix.C.exe
2008-10-01 19:51 87,552 —-a-w c:\winnt\system32\VACFix.exe
2008-09-15 05:13 1,644,432 —-a-w c:\winnt\system32\WIN32K.SYS
2008-09-12 15:41 ——— d—–w c:\program files\Punch! 5 in 1
2008-09-09 03:38 88,576 —-a-w c:\winnt\system32\AntiXPVSTFix.exe
2008-08-20 14:51 575,488 —-a-w c:\winnt\system32\WININET.DLL
2008-08-18 16:19 82,432 —-a-w c:\winnt\system32\404Fix.exe
2005-09-09 01:28 271 —h–w c:\program files\desktop.ini
2005-09-09 01:28 21,952 -c-h–w c:\program files\folder.htt
2001-05-08 12:00 32,528 -c–a-w c:\winnt\inf\wbfirdma.sys
2001-05-08 12:00 94,784 -csha-w c:\winnt\twain.dll
2001-05-08 12:00 44,816 –sh–w c:\winnt\twain_32.dll
2003-06-19 19:05 1,015,859 –sha-w c:\winnt\system32\mfc42.dll
2001-05-08 12:00 77,878 –sh–w c:\winnt\system32\msvcirt.dll
2003-06-19 19:05 286,773 –sh–w c:\winnt\system32\msvcrt.dll
.

((((((((((((((((((((((((((((( snapshot@Thu 11-06-2008_ 8.53.34.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-11-07 20:58:07 16,384 —-atw c:\winnt\system32\Perflib_Perfdata_348.dat
+ 2008-11-07 13:18:46 16,384 —-atw c:\winnt\system32\Perflib_Perfdata_57c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [06/26/07 08:39a 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [05/29/03 03:28p 790528]
"IMONTRAY"="c:\program files\Intel\Intel® Active Monitor\imontray.exe" [01/10/03 11:08a 32768]
"HPDJ Taskbar Utility"="c:\winnt\system32\spool\drivers\w32x86\3\hpztsb01.exe" [08/18/00 10:38a 192512]
"HPHA2MON"="c:\winnt\system32\hpha2mon.exe" [08/18/00 10:38a 69632]
"LWBMOUSE"="c:\program files\Labtec\Labtec Mouse Software\1.0\lwbwheel.exe" [07/09/01 11:12a 429568]
"RestoreIT!"="c:\program files\FarStone\RestoreIT!\RestoreIT!_2K\VBPTASK.EXE" [07/02/03 09:26a 122880]
"OneTouch Monitor"="c:\progra~1\VISION~2\ONETOU~2.EXE" [07/10/00 08:58p 73728]
"AVG7_CC"="c:\progra~1\Grisoft\AVG7\avgcc.exe" [10/17/08 08:42a 590848]
"Synchronization Manager"="mobsync.exe" [06/19/03 02:05p 111376 c:\winnt\system32\mobsync.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [10/24/07 08:44a 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="c:\program files\Internet Explorer\Connection Wizard\icwconn1.exe" [06/19/03 02:05p 186640]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-01-21 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= mmdrv.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"PPWebCap"=c:\program files\Visioneer\PaperPort\PPWebCap.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
"farstone"=NULL
"Synchronization Manager"=mobsync.exe /logon
"SoundMAX"="c:\program files\Analog Devices\SoundMAX\Smax4.exe" /tray
"FastTVSync"="c:\program files\Common Files\InterVideo\FastTVSync\FastTVSync.exe"
"hpfsched"=c:\winnt\hpfsched.exe
"IgfxTray"=c:\winnt\System32\igfxtray.exe
"OneTouch Monitor"=c:\progra~1\VISION~2\ONETOU~2.EXE
"SonicFocus"="c:\program files\Sonic Focus\SFIGUI\SFIGUI.EXE" BOOT
"HotKeysCmds"=c:\winnt\System32\hkcmd.exe

R0 VVBackd5;VVBackd5;c:\winnt\system32\drivers\VVBackd5.sys [01/19/03 09:21p 180074]
R1 Avg7RsNT;AVG7 Resident Driver NT;c:\winnt\system32\Drivers\avg7rsnt.sys [05/14/07 07:26a 26944]
R2 ppsio2;PPDevice;c:\winnt\system32\drivers\ppsio2.sys [06/30/99 01:49a 23200]
R3 pmxscan;Visioneer USB Kernel;c:\winnt\system32\DRIVERS\usbscan.sys [06/19/03 02:05p 12592]
R3 usbhub20;USB 2.0 Root Hub Support;c:\winnt\system32\DRIVERS\usbhub20.sys [06/19/03 02:05p 49776]
R3 Winacpci;Winacpci;c:\winnt\system32\DRIVERS\winacpci.sys [09/24/99 06:55p 602128]
S3 WMP11;Instant Wireless PCI Card Driver;c:\winnt\system32\DRIVERS\WMP11NDS.sys [05/16/02 03:41p 54083]

*Newly Created Service* - IPNAT
*Newly Created Service* - RASAUTO
*Newly Created Service* - SHAREDACCESS
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-07 16:00:01
Windows 5.0.2195 Service Pack 4 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 11/07/2008 16:00:26
ComboFix-quarantined-files.txt 2008-11-07 21:00:23
ComboFix2.txt 2008-11-06 13:53:55

Pre-Run: 72,259,342,336 bytes free
Post-Run: 72,277,528,576 bytes free

128 — E O F — 2008-11-03 14:22:50
Post #9
First, let me tell you that at this minute, I am not at the computer that has/had the problem. I am at home, but I wanted to give you the results, and get back to you with some type of response. I did as you said, and as soon as I did the drag and drop, ComboFix opened a very small (2" x 2" sq.) window and looked like it was loading something. Then the larger black window opened up and told me that there were updates, so I downloaded the updates. As soon as the updates were done, ComboFix ran the scan and then I posted the results for you. Then I went to the message board that I had the problem on and I didn't have any trouble posting a reply, so I think the IE problem is fixed/gone. I ran the Spybot check and didn't fair so well. It didn't finish the scan until after 5:00 and I had to leave the office (the problem is on the office computer). Early on in the scan, It found "Fraud.XP Antivirus" . During the scan, I got four messages, all saying the same thing: "There were problems in the include file C:\ProgramFiles \Spybot- Search_Destroy\Includes\Malware.sbi See 'Include errors log for details'. This happend before too, but when I go to the Include errors log, I can't make heads or tails of it. I can copy and paste that Spybot log if you wish. Spybot also found another one, but I forgot to write it down - Media something. It didn't pop up until the end of the scan. I clicked on "Fix" for all the items, and Spybot said it took care of them, but I didn't have time to run another scan to see if they were gone. I can go into the office tomorrow to do whatever you suggest, I am afraid that if I wait until Monday to get back to you, the thread will be locked; and I still need your help to finish things. Thank You.
Post #10
We can keep this thread open until there's now replies for 5 days. My guess is SpyBot is picking up the ones we cleaned as they are still on the computer. Combofix puts them in a folder. C:\QooBox You can wait until Monday and we'll continue on.
Post #11
LDTate:
First thing this morning, I ran SpyBot - AVG runs automatically when I turn on the computer, so they were both running at the same time. Neither SpyBot nor AVG found any virus or trojan. But I still got the same error message during SpyBot, again four different times.
Before doing a new HJT scan and log, I also ran the ATF and also CCleaner. Then I did the HJT and here is the log; I saved the CCleaner registry backup before I did the clean, let me know if you want me to post that. I will also post the SpyBot report if you want me to, but it appears to ve extreamly long. I'm ready for your next directive!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:53:31, on 11/10/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\snmp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Intel\Intel® Active Monitor\imonnt.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Intel\Intel® Active Monitor\imontray.exe
C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb01.exe
C:\WINNT\system32\hpha2mon.exe
C:\Program Files\Labtec\Labtec Mouse Software\1.0\lwbwheel.exe
C:\Program Files\FarStone\RestoreIT!\RestoreIT!_2K\VBPTASK.EXE
C:\PROGRA~1\VISION~2\ONETOU~2.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINNT\system32\HPHipm08.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Microsoft Office\Office\1033\msoffice.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar5.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar5.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [IMONTRAY] C:\Program Files\Intel\Intel® Active Monitor\imontray.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb01.exe
O4 - HKLM\..\Run: [HPHA2MON] C:\WINNT\system32\hpha2mon.exe
O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Labtec\Labtec Mouse Software\1.0\lwbwheel.exe
O4 - HKLM\..\Run: [RestoreIT!] "C:\Program Files\FarStone\RestoreIT!\RestoreIT!_2K\VBPTASK.EXE" VBStart
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [OneTouch Monitor] C:\PROGRA~1\VISION~2\ONETOU~2.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30985566-E01F-11D2-85DB-EA44DE000000} (IRTHMapDisplay Control) - https://irth.digsafelynewyork.com/IrthInter…HMapDisplay.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase6662.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - https://irth.digsafelynewyork.com/IrthInter…ry/mgaxctrl.cab
O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/…_2/axofupld.cab
O16 - DPF: {87BE3784-6977-4E84-AA08-55A96B9CEAC5} (Bl_camera Control) - http://catcam2.viewnetcam.com:4002/bl_camera.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A7207513-03D6-4CA7-9339-36869DC869BD}: NameServer = 206.231.8.2 206.231.8.3
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel® Active Monitor\imonnt.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

–
End of file - 6170 bytes
Post #13
Okay, let me just verify that you want thw whole report - I go to "Tools"/"View Report" then copy and paste the whole thing? It's really, really lengthy. Do yo want me to just copy and paste a certain portion of it?
Post #14

Okay, let me just verify that you want thw whole report - I go to "Tools"/"View Report" then copy and paste the whole thing? It's really, really lengthy. Do yo want me to just copy and paste a certain portion of it?

I only need this part,

But I still got the same error message during SpyBot, again four different times.

Post #15
Okay, I couldn't find it in the SpyBot program, so I did a Start/search and put in "Include Errors.log" and this is what came up. I couldn't find any dates, so I copied the whole thing. This turned out to be quite long too. I apologize. In the "Help" file of Spybot, it says that the error message usually means that the updates aren't all there, but I have check numerous times, and it says I have all the updates, so I don't understand the error message. C:\Program Files\Spybot - Search & Destroy\Includes\Malware.sbi | Win32.Agent.pz | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C.ul | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Delf.Spool.cn | <$SYSDIR>\ntdoss04.sys C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | FakeUPSInvoice | <$SYSDIR>\userini.exe C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | FlashExploit | <$WINDIR>\Tasks\SysFile.brk C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Agent.frl | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Agent.frl | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.jl | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.jl | <$PROGRAMFILES>\Internet Explorer\msvcrt.bak C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | ProGroup.ProRat | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | ProGroup.ProRat | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | ProGroup.ProRat | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | ProGroup.ProRat | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | ProGroup.ProRat | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | ProGroup.ProRat | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | ProGroup.ProRat | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.WPA_Kill.AK | <$SYSDIR>\winlogon.bak C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.DNSChanger | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.DNSChanger | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.DNSChanger.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Malware.sbi | Win32.Agent.pz | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C.ul | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Delf.Spool.cn | <$SYSDIR>\ntdoss04.sys C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | FakeUPSInvoice | <$SYSDIR>\userini.exe C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | FlashExploit | <$WINDIR>\Tasks\SysFile.brk C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Agent.frl | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Agent.frl | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.jl | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.jl | <$PROGRAMFILES>\Internet Explorer\msvcrt.bak C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Malware.sbi | Win32.Agent.pz | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C.ul | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Delf.Spool.cn | <$SYSDIR>\ntdoss04.sys C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | FakeUPSInvoice | <$SYSDIR>\userini.exe C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | FlashExploit | <$WINDIR>\Tasks\SysFile.brk C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Agent.frl | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Agent.frl | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.jl | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.jl | <$PROGRAMFILES>\Internet Explorer\msvcrt.bak C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.WPA_Kill.AK | <$SYSDIR>\winlogon.bak C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.DNSChanger | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.DNSChanger | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.DNSChanger.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Malware.sbi | Win32.Agent.pz | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C.ul | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Delf.Spool.cn | <$SYSDIR>\ntdoss04.sys C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | FakeUPSInvoice | <$SYSDIR>\userini.exe C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | FlashExploit | <$WINDIR>\Tasks\SysFile.brk C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Agent.frl | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Agent.frl | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.jl | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.jl | <$PROGRAMFILES>\Internet Explorer\msvcrt.bak C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.WPA_Kill.AK | <$SYSDIR>\winlogon.bak C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.DNSChanger | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.DNSChanger | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.DNSChanger.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Malware.sbi | Win32.Agent.pz | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C.ul | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Delf.Spool.cn | <$SYSDIR>\ntdoss04.sys C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | FakeUPSInvoice | <$SYSDIR>\userini.exe C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | FlashExploit | <$WINDIR>\Tasks\SysFile.brk C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Agent.frl | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Agent.frl | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.jl | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.jl | <$PROGRAMFILES>\Internet Explorer\msvcrt.bak C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.WPA_Kill.AK | <$SYSDIR>\winlogon.bak C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Agent.jg | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Agent.jg | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Agent.jg | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.DNSChanger | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.DNSChanger | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.DNSChanger.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Malware.sbi | Win32.Agent.pz | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C.ul | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Delf.Spool.cn | <$SYSDIR>\ntdoss04.sys C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | FakeUPSInvoice | <$SYSDIR>\userini.exe C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | FlashExploit | <$WINDIR>\Tasks\SysFile.brk C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Agent.frl | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Agent.frl | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.jl | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.jl | <$PROGRAMFILES>\Internet Explorer\msvcrt.bak C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.WPA_Kill.AK | <$SYSDIR>\winlogon.bak C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Agent.jg | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Agent.jg | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Agent.jg | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.DNSChanger | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.DNSChanger | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.DNSChanger.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Malware.sbi | Win32.Agent.pz | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C. | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\MalwareC.sbi | Smitfraud-C.ul | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Delf.Spool.cn | <$SYSDIR>\ntdoss04.sys C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | FakeUPSInvoice | <$SYSDIR>\userini.exe C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | FlashExploit | <$WINDIR>\Tasks\SysFile.brk C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Haxdoor.hm | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | ProGroup.ProRat | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Agent.frl | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Agent.frl | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.jl | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.jl | <$PROGRAMFILES>\Internet Explorer\msvcrt.bak C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_LIBRARY> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_SYSTEM> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Delf.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.WPA_Kill.AK | <$SYSDIR>\winlogon.bak C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Agent.jg | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Agent.jg | <$FILE_DATA> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Win32.Agent.jg | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.DNSChanger | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.DNSChanger | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.DNSChanger.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.rtk | <$FILE_EXE> C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.rtk | <$FILE_EXE>

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI