Brought to you by TQ! virus
Started by
chickmazta
, Jan 23 2008 08:45 AM
#1
Posted 23 January 2008 - 08:45 AM
#2
Posted 23 January 2008 - 11:53 AM
Hello chickmazta
Welcome to G2Go.
===================
* Click here to download HJTsetup.exe
Welcome to G2Go.
===================
* Click here to download HJTsetup.exe
- Save HJTsetup.exe to your desktop.
- Doubleclick on the HJTsetup.exe icon on your desktop.
- By default it will install to C:\Program Files\Trend Micro\Hijack This.
- Click on I agree
- Then Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
- Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
- Come back here to this thread and Paste the log in your next reply.
- DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
#3
Posted 24 January 2008 - 11:59 AM
Im sorry for the delay Sir ^_^
Here is the log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:53:35 AM, on 1/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\DAP\DAP.EXE
C:\WINDOWS\System32\WScript.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://blogtq.blogspot.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Brought to you by TQ!
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [winconfig] C:\WINDOWS\winconfig.dll.vbs
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games....GamesPlugin.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 4249 bytes
hope there's something in here tnx!
Here is the log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:53:35 AM, on 1/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\DAP\DAP.EXE
C:\WINDOWS\System32\WScript.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://blogtq.blogspot.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Brought to you by TQ!
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [winconfig] C:\WINDOWS\winconfig.dll.vbs
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games....GamesPlugin.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 4249 bytes
hope there's something in here tnx!
#4
Posted 24 January 2008 - 12:03 PM
No problem.
There is indeed something so let's get started.
=================================
Please download ComboFix from Here to your Desktop.
**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
There is indeed something so let's get started.
=================================
Please download ComboFix from Here to your Desktop.
**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
-----------------------------------------------------------
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
-----------------------------------------------------------
- Double click on combofix.exe & follow the prompts.
- When finished, it will produce a report for you.
- Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
#5
Posted 27 January 2008 - 11:53 PM
Sorry again for the delay sir^_^ The computer I was using needed a new PSU so i purchased a new one. I have already downloaded the combo fix and here is the log report.
Combofix log report:
ComboFix 08-01-23.1D - Nett'sCafe 2008-01-28 13:43:47.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.294 [GMT 8:00]
Running from: C:\Documents and Settings\Nett'sCafe\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
C:\winconfig.dll.vbs
C:\WINDOWS\winconfig.dll.vbs
D:\Autorun.inf
D:\winconfig.dll.vbs
.
((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-28 )))))))))))))))))))))))))))))))
.
2008-01-28 13:41 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-26 20:32 . 2008-01-26 20:32 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE
2008-01-26 16:15 . 2008-01-26 16:15 <DIR> d-------- C:\Program Files\Chikka Messenger
2008-01-26 16:15 . 2008-01-26 16:15 <DIR> d-------- C:\logs
2008-01-25 01:53 . 2008-01-25 01:53 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-18 21:06 . 2006-10-22 12:22 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-01-18 21:06 . 2008-01-28 13:36 88,566 --a------ C:\WINDOWS\system32\nvapps.xml
2008-01-18 21:06 . 2006-10-22 12:22 17,056 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-01-18 21:04 . 2006-10-22 15:06 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2008-01-18 21:03 . 2008-01-18 21:03 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-17 14:58 --------- d-----w C:\Program Files\Google
2007-12-12 12:22 --------- d-----w C:\Program Files\e-Games
2007-12-06 02:08 --------- d-----w C:\Program Files\Yahoo!
2007-12-05 15:36 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2007-12-05 15:36 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2007-12-05 15:21 --------- d-----w C:\Program Files\DAP
2007-12-05 15:18 50,688 ----a-w C:\WINDOWS\system32\wbhelp2.dll
2007-12-05 15:00 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-05 15:00 --------- d-----w C:\Program Files\AMD
2007-12-05 14:58 --------- d-----w C:\Program Files\Realtek Sound Manager
2007-12-05 14:58 --------- d-----w C:\Program Files\Realtek AC97
2007-12-05 14:58 --------- d-----w C:\Program Files\AvRack
2007-12-05 14:57 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-05 14:56 --------- d-----w C:\Program Files\VIA
2007-12-05 14:38 --------- d--h--w C:\Program Files\Uninstall Information
2007-12-05 14:33 --------- d-----w C:\Program Files\microsoft frontpage
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RaidTool"="C:\Program Files\VIA\RAID\raid_tool.exe" [2005-06-20 18:53 1056768]
"SoundMan"="SOUNDMAN.EXE" [2005-06-20 21:42 77824 C:\WINDOWS\SOUNDMAN.EXE]
"DownloadAccelerator"="C:\Program Files\DAP\DAP.exe" [2007-12-05 23:18 4376328]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-22 23:31 579072]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22 7700480]
"nwiz"="nwiz.exe" [2006-10-22 12:22 1622016 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2006-10-22 12:22 86016 C:\WINDOWS\system32\nvmctray.dll]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-05 23:41 219136]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)
"wscsvc"=2 (0x2)
"ERSvc"=2 (0x2)
R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys [2005-06-20 18:53]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{389989c2-a380-11dc-a2d7-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe
*Newly Created Service* - PROCEXP90
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-28 13:44:30
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-01-28 13:44:50
ComboFix-quarantined-files.txt 2008-01-28 05:44:42
*before doing this i receive a message saying: "Roughly 1/100 machines failed to make ti through the disinfection process !! are you sure want to do this? yes/no
Here's the new logfile for HiJack, Hope's everything is in right order
Hijack logfile:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:46:15 PM, on 1/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://blogtq.blogspot.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games....GamesPlugin.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 3820 bytes
I followed everything in the right order. I also quit any anti virus and malware programs during the process I hope this helps tnx sir!
Combofix log report:
ComboFix 08-01-23.1D - Nett'sCafe 2008-01-28 13:43:47.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.294 [GMT 8:00]
Running from: C:\Documents and Settings\Nett'sCafe\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
C:\winconfig.dll.vbs
C:\WINDOWS\winconfig.dll.vbs
D:\Autorun.inf
D:\winconfig.dll.vbs
.
((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-28 )))))))))))))))))))))))))))))))
.
2008-01-28 13:41 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-26 20:32 . 2008-01-26 20:32 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE
2008-01-26 16:15 . 2008-01-26 16:15 <DIR> d-------- C:\Program Files\Chikka Messenger
2008-01-26 16:15 . 2008-01-26 16:15 <DIR> d-------- C:\logs
2008-01-25 01:53 . 2008-01-25 01:53 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-18 21:06 . 2006-10-22 12:22 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-01-18 21:06 . 2008-01-28 13:36 88,566 --a------ C:\WINDOWS\system32\nvapps.xml
2008-01-18 21:06 . 2006-10-22 12:22 17,056 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-01-18 21:04 . 2006-10-22 15:06 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2008-01-18 21:03 . 2008-01-18 21:03 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-17 14:58 --------- d-----w C:\Program Files\Google
2007-12-12 12:22 --------- d-----w C:\Program Files\e-Games
2007-12-06 02:08 --------- d-----w C:\Program Files\Yahoo!
2007-12-05 15:36 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2007-12-05 15:36 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2007-12-05 15:21 --------- d-----w C:\Program Files\DAP
2007-12-05 15:18 50,688 ----a-w C:\WINDOWS\system32\wbhelp2.dll
2007-12-05 15:00 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-05 15:00 --------- d-----w C:\Program Files\AMD
2007-12-05 14:58 --------- d-----w C:\Program Files\Realtek Sound Manager
2007-12-05 14:58 --------- d-----w C:\Program Files\Realtek AC97
2007-12-05 14:58 --------- d-----w C:\Program Files\AvRack
2007-12-05 14:57 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-05 14:56 --------- d-----w C:\Program Files\VIA
2007-12-05 14:38 --------- d--h--w C:\Program Files\Uninstall Information
2007-12-05 14:33 --------- d-----w C:\Program Files\microsoft frontpage
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RaidTool"="C:\Program Files\VIA\RAID\raid_tool.exe" [2005-06-20 18:53 1056768]
"SoundMan"="SOUNDMAN.EXE" [2005-06-20 21:42 77824 C:\WINDOWS\SOUNDMAN.EXE]
"DownloadAccelerator"="C:\Program Files\DAP\DAP.exe" [2007-12-05 23:18 4376328]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-22 23:31 579072]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22 7700480]
"nwiz"="nwiz.exe" [2006-10-22 12:22 1622016 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2006-10-22 12:22 86016 C:\WINDOWS\system32\nvmctray.dll]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-05 23:41 219136]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)
"wscsvc"=2 (0x2)
"ERSvc"=2 (0x2)
R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys [2005-06-20 18:53]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{389989c2-a380-11dc-a2d7-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe
*Newly Created Service* - PROCEXP90
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-28 13:44:30
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-01-28 13:44:50
ComboFix-quarantined-files.txt 2008-01-28 05:44:42
*before doing this i receive a message saying: "Roughly 1/100 machines failed to make ti through the disinfection process !! are you sure want to do this? yes/no
Here's the new logfile for HiJack, Hope's everything is in right order
Hijack logfile:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:46:15 PM, on 1/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://blogtq.blogspot.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games....GamesPlugin.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 3820 bytes
I followed everything in the right order. I also quit any anti virus and malware programs during the process I hope this helps tnx sir!
#6
Posted 28 January 2008 - 03:09 AM
You are welcome
Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
Rename it to .txt and you will be able to open it)
Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
- Doubleclick the drweb-cureit.exe file and Allow to run the express scan
- This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
- Once the short scan has finished, mark the drives that you want to scan.
- Select all drives. A red dot shows which drives have been chosen.
- Click the green arrow at the right, and the scan will start.
- Click 'Yes to all' if it asks if you want to cure/move the file.
- When the scan has finished, in the menu, click file and choose save report list
- Save the report to your desktop. The report will be called DrWeb.csv
- Close Dr.Web Cureit.
- Post that log in your next reply.
Rename it to .txt and you will be able to open it)
#7
Posted 31 January 2008 - 04:13 AM
Sir I have done what you instructed me to do here are the log file including Hijack logfile
Dr.Web cureit logfile:
winconfig.dll.vbs.vir;C:\QooBox\Quarantine\C;Modification of VBS.Generic.544;Moved.;
winconfig.dll.vbs.vir;C:\QooBox\Quarantine\C\WINDOWS;Modification of VBS.Generic.544;Moved.;
winconfig.dll.vbs.vir;C:\QooBox\Quarantine\D;Modification of VBS.Generic.544;Moved.;
A0062988.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0062989.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0062998.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0062999.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0063019.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0063020.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0063035.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0063036.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0064035.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0064036.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0065035.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0065036.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0065050.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0065051.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0065068.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0065069.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0065091.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0065092.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0066091.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0066092.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0066101.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0066102.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0066110.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0066111.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0066122.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0066123.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0067122.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0067123.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0068122.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0068123.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0068135.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0068136.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0069122.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0069123.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0069133.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0069134.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0070133.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0070134.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0071133.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0071134.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0072133.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0072134.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0073138.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0073147.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0073148.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0074147.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0074148.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0074160.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0074161.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075160.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075161.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075182.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075183.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075193.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075194.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075205.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075206.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075218.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075219.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075225.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075226.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075236.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075237.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075251.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075252.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075274.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075275.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075287.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075288.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075297.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075298.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075306.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075307.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075316.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075317.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0076316.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0076317.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0076333.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0076334.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0077333.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0077334.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0078333.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0078334.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0078350.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0078351.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079350.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079351.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079366.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079367.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079380.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079381.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079394.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079395.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079409.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079410.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079460.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079461.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079469.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079470.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079506.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079507.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080506.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080507.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080517.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080518.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080527.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080528.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080540.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080541.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080556.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080557.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0081575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0081576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0082575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0082576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0083575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0083576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0084575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0084576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0085575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0085576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0086575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0086576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0087575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0087576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0088575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0088576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0090575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0090576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0091575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0091576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0092575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0092576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0093575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0093576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0095575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0095576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0097575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0097576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0098575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0098576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0099575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0099576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0100575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0100576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0100584.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0100585.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101584.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101585.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101647.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101648.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101661.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101662.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101689.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101690.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101702.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101703.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0102702.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0102703.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0102714.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0102715.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0102724.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0102725.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103724.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103725.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103737.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103738.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103750.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103751.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103770.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103771.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103779.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103780.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103790.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103791.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103802.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103803.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104802.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104803.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104811.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104812.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104822.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104823.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104839.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104840.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104849.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104850.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0105849.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0105850.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0106849.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0106850.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107849.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107850.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107858.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107859.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107872.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107873.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107885.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107886.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107898.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107899.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0108898.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0108899.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0108915.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0108916.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0108923.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108924.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108935.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108936.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108950.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108951.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108962.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108963.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108972.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108973.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109074.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109075.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109094.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109095.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109110.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109111.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109121.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109122.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109144.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109145.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109153.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109154.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0110153.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0110154.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0110166.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0110167.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0111166.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0111167.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0111176.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111177.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111194.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111195.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111203.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111204.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111235.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111236.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111256.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111257.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0112256.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0112257.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0113256.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0113257.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0113266.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0113267.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114266.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114267.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114290.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114291.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114302.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114303.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114311.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114312.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114320.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP16;Modification of VBS.Generic.544;Moved.;
A0114321.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP16;Modification of VBS.Generic.544;Moved.;
A0114330.bat;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP16;Probably BATCH.Virus;;
nmcogame.dll;D:\Nexon\KartRider;Probably DLOADER.Trojan;;
A0040398.dll;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP10;Probably DLOADER.Trojan;;
A0062991.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0063001.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0063022.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0063038.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0064038.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0065038.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0065053.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0065071.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0065094.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0066094.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0066104.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0066113.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0066125.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0067125.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0068125.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0068138.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0069125.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0069136.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0070136.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0071136.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0072136.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0073140.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0073150.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0074150.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0074163.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075163.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075185.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075196.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075208.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075221.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075228.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075239.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075254.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075277.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075290.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075300.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075309.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075319.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0076319.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0076336.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0077336.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0078336.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0078353.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079353.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079369.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079383.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079397.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079412.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079463.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079472.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079509.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080509.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080520.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080530.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080543.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080559.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0081578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0082578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0083578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0085578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0086578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0087578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0090578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0091578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0092578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0093578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0095578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0097578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0098578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0099578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0100578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0100587.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101587.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101650.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101664.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101692.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101705.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0102705.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0102717.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0102727.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103727.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103740.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103753.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103773.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103782.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103793.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103805.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104805.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104814.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104825.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104842.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104852.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0105852.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0106852.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107852.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107861.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107875.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107888.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107901.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0108901.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0108918.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0108926.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108938.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108953.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108965.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108975.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109077.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109097.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109113.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109124.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109147.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109156.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0110156.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0110169.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0111169.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0111179.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111197.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111206.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111238.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111259.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0112259.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0113269.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114269.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114293.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114305.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114314.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114323.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP16;Modification of VBS.Generic.544;Moved.;
A0008726.dll;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP5;Probably DLOADER.Trojan;;
Hijack logfile:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:11:34 PM, on 1/31/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\DAP\DAP.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48884C41-EFAC-433D-958
Dr.Web cureit logfile:
winconfig.dll.vbs.vir;C:\QooBox\Quarantine\C;Modification of VBS.Generic.544;Moved.;
winconfig.dll.vbs.vir;C:\QooBox\Quarantine\C\WINDOWS;Modification of VBS.Generic.544;Moved.;
winconfig.dll.vbs.vir;C:\QooBox\Quarantine\D;Modification of VBS.Generic.544;Moved.;
A0062988.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0062989.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0062998.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0062999.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0063019.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0063020.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0063035.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0063036.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0064035.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0064036.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0065035.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0065036.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0065050.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0065051.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0065068.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0065069.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0065091.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0065092.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0066091.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0066092.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0066101.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0066102.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0066110.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0066111.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0066122.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0066123.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0067122.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0067123.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0068122.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0068123.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0068135.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0068136.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0069122.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0069123.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0069133.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0069134.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0070133.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0070134.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0071133.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0071134.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0072133.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0072134.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0073138.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0073147.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0073148.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0074147.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0074148.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0074160.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0074161.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075160.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075161.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075182.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075183.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075193.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075194.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075205.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075206.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075218.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075219.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075225.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075226.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075236.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075237.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075251.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075252.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075274.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075275.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075287.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075288.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075297.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075298.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075306.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075307.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075316.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075317.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0076316.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0076317.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0076333.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0076334.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0077333.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0077334.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0078333.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0078334.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0078350.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0078351.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079350.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079351.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079366.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079367.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079380.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079381.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079394.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079395.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079409.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079410.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079460.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079461.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079469.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079470.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079506.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079507.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080506.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080507.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080517.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080518.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080527.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080528.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080540.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080541.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080556.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080557.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0081575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0081576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0082575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0082576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0083575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0083576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0084575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0084576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0085575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0085576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0086575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0086576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0087575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0087576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0088575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0088576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0090575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0090576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0091575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0091576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0092575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0092576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0093575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0093576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0095575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0095576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0097575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0097576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0098575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0098576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0099575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0099576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0100575.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0100576.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0100584.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0100585.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101584.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101585.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101647.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101648.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101661.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101662.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101689.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101690.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101702.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101703.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0102702.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0102703.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0102714.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0102715.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0102724.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0102725.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103724.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103725.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103737.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103738.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103750.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103751.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103770.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103771.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103779.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103780.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103790.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103791.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103802.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103803.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104802.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104803.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104811.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104812.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104822.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104823.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104839.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104840.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104849.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104850.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0105849.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0105850.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0106849.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0106850.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107849.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107850.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107858.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107859.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107872.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107873.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107885.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107886.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107898.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107899.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0108898.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0108899.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0108915.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0108916.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0108923.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108924.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108935.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108936.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108950.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108951.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108962.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108963.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108972.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108973.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109074.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109075.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109094.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109095.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109110.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109111.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109121.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109122.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109144.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109145.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109153.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109154.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0110153.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0110154.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0110166.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0110167.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0111166.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0111167.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0111176.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111177.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111194.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111195.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111203.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111204.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111235.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111236.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111256.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111257.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0112256.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0112257.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0113256.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0113257.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0113266.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0113267.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114266.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114267.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114290.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114291.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114302.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114303.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114311.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114312.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114320.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP16;Modification of VBS.Generic.544;Moved.;
A0114321.vbs;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP16;Modification of VBS.Generic.544;Moved.;
A0114330.bat;C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP16;Probably BATCH.Virus;;
nmcogame.dll;D:\Nexon\KartRider;Probably DLOADER.Trojan;;
A0040398.dll;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP10;Probably DLOADER.Trojan;;
A0062991.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0063001.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0063022.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0063038.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0064038.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0065038.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0065053.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0065071.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0065094.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0066094.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0066104.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0066113.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0066125.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0067125.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0068125.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP11;Modification of VBS.Generic.544;Moved.;
A0068138.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0069125.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0069136.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0070136.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0071136.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0072136.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0073140.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0073150.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0074150.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0074163.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075163.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075185.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075196.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075208.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075221.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP12;Modification of VBS.Generic.544;Moved.;
A0075228.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075239.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075254.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075277.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075290.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075300.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075309.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0075319.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0076319.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0076336.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0077336.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0078336.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0078353.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079353.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079369.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079383.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079397.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079412.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079463.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079472.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0079509.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080509.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080520.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080530.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080543.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080559.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0080578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0081578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0082578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0083578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0085578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0086578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0087578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0090578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0091578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0092578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0093578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0095578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0097578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0098578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0099578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0100578.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0100587.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101587.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101650.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101664.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101692.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0101705.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0102705.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0102717.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0102727.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103727.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103740.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103753.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103773.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103782.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103793.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0103805.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104805.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104814.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104825.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104842.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0104852.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0105852.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0106852.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107852.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107861.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107875.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107888.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0107901.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0108901.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0108918.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP13;Modification of VBS.Generic.544;Moved.;
A0108926.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108938.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108953.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108965.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0108975.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109077.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109097.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109113.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109124.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109147.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0109156.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0110156.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0110169.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0111169.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP14;Modification of VBS.Generic.544;Moved.;
A0111179.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111197.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111206.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111238.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0111259.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0112259.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0113269.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114269.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114293.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114305.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114314.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP15;Modification of VBS.Generic.544;Moved.;
A0114323.vbs;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP16;Modification of VBS.Generic.544;Moved.;
A0008726.dll;D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP5;Probably DLOADER.Trojan;;
Hijack logfile:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:11:34 PM, on 1/31/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\DAP\DAP.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48884C41-EFAC-433D-958
#8
Posted 31 January 2008 - 06:27 PM
Please do an online scan with Kaspersky WebScanner
(This scanner is for use with internet explorer only)
Click on "Accept"
You will be promted to install an ActiveX component from Kaspersky, Click Yes.
(This scanner is for use with internet explorer only)
Click on "Accept"
You will be promted to install an ActiveX component from Kaspersky, Click Yes.
- The program will launch and then begin downloading the latest definition files:
- Once the files have been downloaded click on NEXT
- Now click on Scan Settings
- In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
- Scan Options:
Scan Mail Bases - Click OK
- Now under select a target to scan:Select My Computer
- This will program will start and scan your system.
- The scan will take a while so be patient and let it run.
- Once the scan is complete it will display if your system has been infected.
- Now click on the Save as Text button:
- Save the file to your desktop.
- Copy and paste that information in your next post.
#9
Posted 04 February 2008 - 01:36 AM
Here is the log file for Kaspersky scan
Kaspersky logfile:
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, February 04, 2008 3:31:07 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 4/02/2008
Kaspersky Anti-Virus database records: 546598
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
C:\
D:\
Scan Statistics:
Total number of scanned objects: 57480
Number of viruses found: 2
Number of infected objects: 394
Number of suspicious objects: 0
Duration of the scan process: 00:22:33
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Nett'sCafe\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0062988.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0062989.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0062991.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0062998.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0062999.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0063001.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0063019.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0063020.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0063022.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0063035.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0063036.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0063038.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0064035.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0064036.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0064038.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0065035.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0065036.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0065038.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0065050.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0065051.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0065053.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0065068.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0065069.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0065071.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0065091.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0065092.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0065094.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0066091.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0066092.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0066094.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0066101.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0066102.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0066104.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0066110.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0066111.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0066113.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0066122.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0066123.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0066125.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0067122.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0067123.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0067125.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0068122.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0068123.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0068125.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0068135.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0068136.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0068138.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0069122.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0069123.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0069125.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0069133.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0069134.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0069136.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0070133.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0070134.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0070136.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0071133.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0071134.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0071136.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0072133.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0072134.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0072136.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0073138.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0073140.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0073147.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0073148.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0073150.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0074147.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0074148.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0074150.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0074160.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0074161.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0074163.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075160.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075161.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075163.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075182.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075183.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075185.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075193.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075194.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075196.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075205.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075206.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075208.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075218.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075219.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075221.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075225.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075226.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075228.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075236.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075237.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075239.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075251.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075252.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075254.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075274.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075275.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075277.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075287.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075288.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075290.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075297.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075298.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075300.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075306.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075307.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075309.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075316.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075317.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075319.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0076316.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0076317.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0076319.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0076333.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0076334.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0076336.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0077333.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0077334.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0077336.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0078333.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0078334.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0078336.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0078350.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0078351.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0078353.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079350.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079351.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079353.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079366.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079367.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079369.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079380.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079381.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079383.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079394.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079395.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079397.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079409.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079410.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079412.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079460.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079461.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079463.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079469.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079470.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079472.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079506.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079507.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079509.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080506.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080507.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080509.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080517.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080518.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080520.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080527.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080528.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080530.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080540.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080541.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080543.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080556.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080557.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080559.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0081575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0081576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0081578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0082575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0082576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0082578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0083575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0083576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0083578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0084575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0084576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0085575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0085576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0085578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0086575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0086576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0086578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0087575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0087576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0087578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0088575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0088576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0090575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0090576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0090578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0091575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0091576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0091578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0092575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0092576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0092578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0093575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0093576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0093578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0095575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0095576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0095578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0097575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0097576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0097578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0098575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0098576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0098578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0099575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0099576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0099578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0100575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0100576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0100578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0100584.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0100585.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0100587.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101584.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101585.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101587.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101647.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101648.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101650.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101661.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101662.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101664.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101689.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101690.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101692.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101702.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101703.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101705.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0102702.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0102703.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0102705.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0102714.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0102715.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0102717.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0102724.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0102725.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0102727.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103724.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103725.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103727.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103737.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103738.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103740.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103750.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103751.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103753.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103770.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103771.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103773.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103779.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103780.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103782.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103790.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103791.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103793.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103802.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103803.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103805.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104802.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104803.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104805.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104811.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104812.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104814.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104822.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104823.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104825.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104839.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104840.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104842.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104849.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104850.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104852.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0105849.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0105850.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0105852.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0106849.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0106850.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0106852.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107849.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107850.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107852.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107858.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107859.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107861.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107872.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107873.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107875.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107885.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107886.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107888.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107898.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107899.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107901.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108898.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108899.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108901.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108915.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108916.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108918.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108923.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108924.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108926.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108935.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108936.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108938.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108950.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108951.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108953.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108962.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108963.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108965.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108972.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108973.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108975.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109074.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109075.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109077.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109094.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109095.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109097.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109110.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109111.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109113.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109121.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109122.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109124.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109144.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109145.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109147.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109153.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109154.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109156.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0110153.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0110154.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0110156.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0110166.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0110167.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0110169.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111166.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111167.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111169.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111176.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111177.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111179.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111194.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111195.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111197.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111203.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111204.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111206.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111235.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111236.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111238.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111256.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111257.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111259.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0112256.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0112257.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0112259.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0113256.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0113257.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0113266.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0113267.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0113269.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114266.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114267.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114269.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114290.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114291.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114293.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114302.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114303.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114305.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114311.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114312.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114314.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114320.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114321.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114323.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\winconfig.dll.vb0.vir Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\winconfig.dll.vb1.vir Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\winconfig.dll.vbs.vir Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Nett'sCafe\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Nett'sCafe\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Nett'sCafe\Local Settings\Temp\~DF3E66.tmp Object is locked skipped
C:\Documents and Settings\Nett'sCafe\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Nett'sCafe\Local Settings\Temporary Internet Files\Content.IE5\Z0JT3456\install459[1].cab/setup.exe Infected: Trojan-Downloader.Win32.Agent.hst skipped
C:\Documents and Settings\Nett'sCafe\Local Settings\Temporary Internet Files\Content.IE5\Z0JT3456\install459[1].cab CAB: infected - 1 skipped
C:\Documents and Settings\Nett'sCafe\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Nett'sCafe\NTUSER.DAT.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP17\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP17\change.log Object is locked skipped
Scan process completed.
Here is the Hijack logfile:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:35:10 PM, on 2/4/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.
Kaspersky logfile:
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, February 04, 2008 3:31:07 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 4/02/2008
Kaspersky Anti-Virus database records: 546598
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
C:\
D:\
Scan Statistics:
Total number of scanned objects: 57480
Number of viruses found: 2
Number of infected objects: 394
Number of suspicious objects: 0
Duration of the scan process: 00:22:33
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Nett'sCafe\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0062988.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0062989.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0062991.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0062998.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0062999.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0063001.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0063019.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0063020.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0063022.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0063035.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0063036.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0063038.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0064035.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0064036.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0064038.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0065035.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0065036.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0065038.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0065050.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0065051.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0065053.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0065068.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0065069.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0065071.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0065091.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0065092.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0065094.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0066091.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0066092.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0066094.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0066101.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0066102.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0066104.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0066110.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0066111.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0066113.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0066122.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0066123.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0066125.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0067122.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0067123.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0067125.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0068122.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0068123.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0068125.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0068135.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0068136.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0068138.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0069122.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0069123.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0069125.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0069133.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0069134.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0069136.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0070133.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0070134.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0070136.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0071133.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0071134.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0071136.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0072133.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0072134.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0072136.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0073138.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0073140.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0073147.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0073148.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0073150.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0074147.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0074148.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0074150.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0074160.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0074161.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0074163.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075160.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075161.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075163.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075182.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075183.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075185.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075193.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075194.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075196.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075205.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075206.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075208.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075218.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075219.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075221.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075225.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075226.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075228.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075236.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075237.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075239.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075251.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075252.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075254.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075274.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075275.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075277.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075287.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075288.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075290.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075297.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075298.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075300.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075306.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075307.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075309.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075316.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075317.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0075319.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0076316.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0076317.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0076319.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0076333.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0076334.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0076336.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0077333.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0077334.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0077336.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0078333.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0078334.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0078336.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0078350.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0078351.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0078353.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079350.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079351.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079353.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079366.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079367.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079369.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079380.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079381.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079383.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079394.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079395.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079397.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079409.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079410.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079412.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079460.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079461.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079463.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079469.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079470.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079472.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079506.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079507.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0079509.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080506.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080507.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080509.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080517.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080518.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080520.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080527.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080528.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080530.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080540.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080541.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080543.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080556.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080557.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080559.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0080578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0081575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0081576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0081578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0082575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0082576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0082578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0083575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0083576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0083578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0084575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0084576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0085575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0085576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0085578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0086575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0086576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0086578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0087575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0087576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0087578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0088575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0088576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0090575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0090576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0090578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0091575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0091576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0091578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0092575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0092576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0092578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0093575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0093576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0093578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0095575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0095576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0095578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0097575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0097576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0097578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0098575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0098576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0098578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0099575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0099576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0099578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0100575.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0100576.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0100578.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0100584.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0100585.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0100587.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101584.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101585.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101587.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101647.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101648.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101650.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101661.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101662.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101664.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101689.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101690.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101692.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101702.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101703.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0101705.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0102702.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0102703.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0102705.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0102714.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0102715.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0102717.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0102724.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0102725.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0102727.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103724.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103725.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103727.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103737.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103738.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103740.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103750.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103751.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103753.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103770.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103771.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103773.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103779.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103780.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103782.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103790.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103791.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103793.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103802.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103803.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0103805.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104802.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104803.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104805.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104811.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104812.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104814.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104822.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104823.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104825.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104839.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104840.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104842.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104849.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104850.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0104852.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0105849.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0105850.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0105852.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0106849.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0106850.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0106852.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107849.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107850.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107852.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107858.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107859.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107861.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107872.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107873.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107875.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107885.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107886.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107888.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107898.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107899.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0107901.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108898.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108899.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108901.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108915.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108916.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108918.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108923.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108924.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108926.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108935.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108936.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108938.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108950.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108951.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108953.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108962.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108963.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108965.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108972.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108973.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0108975.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109074.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109075.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109077.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109094.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109095.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109097.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109110.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109111.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109113.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109121.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109122.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109124.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109144.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109145.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109147.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109153.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109154.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0109156.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0110153.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0110154.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0110156.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0110166.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0110167.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0110169.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111166.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111167.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111169.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111176.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111177.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111179.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111194.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111195.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111197.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111203.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111204.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111206.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111235.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111236.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111238.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111256.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111257.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0111259.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0112256.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0112257.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0112259.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0113256.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0113257.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0113266.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0113267.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0113269.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114266.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114267.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114269.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114290.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114291.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114293.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114302.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114303.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114305.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114311.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114312.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114314.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114320.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114321.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\A0114323.vbs Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\winconfig.dll.vb0.vir Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\winconfig.dll.vb1.vir Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\DoctorWeb\Quarantine\winconfig.dll.vbs.vir Infected: Worm.VBS.Solow.b skipped
C:\Documents and Settings\Nett'sCafe\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Nett'sCafe\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Nett'sCafe\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Nett'sCafe\Local Settings\Temp\~DF3E66.tmp Object is locked skipped
C:\Documents and Settings\Nett'sCafe\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Nett'sCafe\Local Settings\Temporary Internet Files\Content.IE5\Z0JT3456\install459[1].cab/setup.exe Infected: Trojan-Downloader.Win32.Agent.hst skipped
C:\Documents and Settings\Nett'sCafe\Local Settings\Temporary Internet Files\Content.IE5\Z0JT3456\install459[1].cab CAB: infected - 1 skipped
C:\Documents and Settings\Nett'sCafe\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Nett'sCafe\NTUSER.DAT.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP17\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\System Volume Information\_restore{25890BEC-CA86-454A-A4B2-5FFAFEE4C82B}\RP17\change.log Object is locked skipped
Scan process completed.
Here is the Hijack logfile:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:35:10 PM, on 2/4/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.
#10
Posted 04 February 2008 - 01:47 AM
PLease delete C:\Documents and Settings\Nett'sCafe\DoctorWeb < that folder.
Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.
You may delete that after yo use it.
=========================
Time for some housekeeping
Also delete anything that we used that is left over.
===================================
After that the last Hijackthis log was cut off can you please post a final Hijackthis log.
Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.
You may delete that after yo use it.
=========================
Time for some housekeeping
- Click START then RUN
- Now type Combofix /u in the runbox and click OK
The above procedure will:
- Delete the following:
- ComboFix and its associated files and folders.
- VundoFix backups, if present
- The C:\Deckard folder, if present
- The C:_OtMoveIt folder, if present
- Reset the clock settings.
- Hide file extensions, if required.
- Hide System/Hidden files, if required.
- Clean System Restore points.
Also delete anything that we used that is left over.
===================================
After that the last Hijackthis log was cut off can you please post a final Hijackthis log.
#11
Posted 12 February 2008 - 05:03 AM
This is the logfile you have been rquesting sir, by the way it seems that there's a lot of improvements in the performance of my PC but in the network the name of my PC still displays TQ on it. But everything is like normal.
Hikack logfile:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:11:04 PM, on 2/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\DAP\DAP.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games....GamesPlugin.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.co.../sysreqlab2.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 4279 bytes
Hope everythings coming to and end here TNX in advance...
Hikack logfile:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:11:04 PM, on 2/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\DAP\DAP.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games....GamesPlugin.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.co.../sysreqlab2.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 4279 bytes
Hope everythings coming to and end here TNX in advance...
#12
Posted 12 February 2008 - 07:26 PM
Okay go to Start and then right click on the My Computer icon and choose properties.but in the network the name of my PC still displays TQ on it
Then on the tab that says Computer name then change it to the name you want it to be then click on ok and reboot if asked.
Let me know if that fixes the issue.
Other than that we are done.
#13
Posted 13 February 2008 - 09:43 PM
Hello Sir, I did what you suggested me do, but it still displays TQ on it, Whenever I restart my computer a windows system error popsup on the system tray icon saying "Windows System Error! a duplicate name exist on the network" I know my other PC is also infected with this virus so I put a stop on its sharing and accessibility so that I may no longer obtain virus through the network. But is seems odd that the PC1 and this PC is named TQ. I went to the My computer properties>Computer Name Tab>Computer Description is ok, computer name is ok, and even the workgroup name is fine when I click the button Change... that displays the "Computer Name Changes" and click the button More... I see the word TQ below the "NetBIOS computer name:" and it is unchangeable. Is it bad? or Its just a little issue. Tnx in advance!!!
One more thing Sir, Is there any other way I can send my donation, without going through the bank accounts etc. I dont have any accounts yet till I'm 18 ^_^ But I'll let my brother do the FedEx he's a web developer in Vegas ^_^ Tnx again and more power to you guys!
for the record my donation is voluntary!!! ^_-
One more thing Sir, Is there any other way I can send my donation, without going through the bank accounts etc. I dont have any accounts yet till I'm 18 ^_^ But I'll let my brother do the FedEx he's a web developer in Vegas ^_^ Tnx again and more power to you guys!
for the record my donation is voluntary!!! ^_-
#14
Posted 13 February 2008 - 09:57 PM
Thanks for the donation but paypal is how I do it.
I don't like to give out personal info (No offense )
But it is not necessary to donate.
Thanks though.
======================================
Is your workgroup name the same as your computer name?
If so change it.
If you would like me to clean up the other computer because it might be preventing you changing anything until both are cleaned up.
* Click here to download HJTsetup.exe
I don't like to give out personal info (No offense )
But it is not necessary to donate.
Thanks though.
======================================
Is your workgroup name the same as your computer name?
If so change it.
If you would like me to clean up the other computer because it might be preventing you changing anything until both are cleaned up.
* Click here to download HJTsetup.exe
- Save HJTsetup.exe to your desktop on the infected computer.
- Doubleclick on the HJTsetup.exe icon on your desktop.
- By default it will install to C:\Program Files\Trend Micro\Hijack This.
- Click on I agree
- Then Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
- Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
- Come back here to this thread and Paste the log in your next reply.
- DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
Similar Topics
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users