Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

smitfraud.c virus [CLOSED]

Started by tcevolution , Jun 21 2005 01:53 PM

  • This topic is locked This topic is locked

#1
tcevolution
Posted 21 June 2005 - 01:53 PM

tcevolution

    New Member

  • Member
  • Pip
  • 4 posts
Logfile of HijackThis v1.99.1
Scan saved at 2:46:42 PM, on 6/21/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\init32m.exe
C:\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.95.218.172/index.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://195.95.218.172/index.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.95.218.172/index.php
F2 - REG:system.ini: Shell=Explorer.exe init32m.exe
O2 - BHO: CeresObj Class - {00000049-8F91-4D9C-9573-F016E7626484} - C:\WINDOWS\ceres.dll
O2 - BHO: VBRunDLL Class - {197B8CA4-E215-46DD-8F33-E0544A80E5C4} - C:\WINDOWS\System32\vbrundll.dll
O2 - BHO: ohb - {9ADE0443-2AB2-4B23-A3F8-AC520773DE12} - C:\WINDOWS\System32\nsiF8.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Search Help - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - C:\Documents and Settings\Owner\Local Settings\Temp\qJiuS.dll
O2 - BHO: (no name) - {F9C9B83E-20FA-5B2C-884C-0FC54E0A459C} - C:\WINDOWS\System32\glhnar.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [PayTime] C:\WINDOWS\System32\paytime.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - Global Startup: winlogin.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.searchbarcash.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotch.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)
O15 - Trusted Zone: *.ysbweb.com (HKLM)
O15 - Trusted IP range: 195.95.218.170 (HKLM)
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup.../bridge-c17.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-downlo....cab?refid=2732
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O20 - AppInit_DLLs: u93rekv26hzl7.tlb
O20 - Winlogon Notify: drct16 - C:\WINDOWS\SYSTEM32\drct16.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: GEARSecurity_BackUp - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NetBiosExt32 - Unknown owner - C:\WINDOWS\services.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton AntiVirus\SAVScan.exe

Already downloaded smitfraud registry and Killbox and hoster and tried doing it myself but didnt work.

Thanks in advance
  • 0

Advertisements

#2
Guest_thatman_*
Posted 25 June 2005 - 09:53 AM

Guest_thatman_*
  • Guest
Hello

We are sorry for the delay in replying to your post, if your still need help please post a current HijackThis.log.

Thank you

Kc :tazz:
  • 0

#3
tcevolution
Posted 25 June 2005 - 07:14 PM

tcevolution

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
Logfile of HijackThis v1.99.1
Scan saved at 8:11:32 PM, on 6/25/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\init32m.exe
C:\HijackThis.exe

F2 - REG:system.ini: Shell=Explorer.exe init32m.exe
O2 - BHO: VBRunDLL Class - {197B8CA4-E215-46DD-8F33-E0544A80E5C4} - C:\WINDOWS\System32\vbrundll.dll
O2 - BHO: ohb - {9ADE0443-2AB2-4B23-A3F8-AC520773DE12} - C:\WINDOWS\System32\nsiF8.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {F9C9B83E-20FA-5B2C-884C-0FC54E0A459C} - C:\WINDOWS\System32\glhnar.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [secboot] C:\WINDOWS\System32\mszx23.exe !!
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - Global Startup: winlogin.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O15 - Trusted IP range: 195.95.218.170 (HKLM)
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup.../bridge-c17.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O20 - AppInit_DLLs: u93rekv26hzl7.tlb
O20 - Winlogon Notify: drct16 - C:\WINDOWS\SYSTEM32\drct16.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: GEARSecurity_BackUp - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NetBiosExt32 - Unknown owner - C:\WINDOWS\services.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton AntiVirus\SAVScan.exe
  • 0

#4
Guest_thatman_*
Posted 26 June 2005 - 03:15 AM

Guest_thatman_*
  • Guest
Hi tcevolution

Please read through the instructions before you start (you may want to print this out).

Please set your system to show all files; please see here if you're unsure how to do this.

Please download and install AD-Aware.
Check Here on how setup and use it - please make sure you update it first. Don't run yet.

Download Pocket Killbox and unzip it; save it to your Desktop. We may need it later.

Please download SpyBot V1.4 http://www.majorgeek...wnload2471.html Update the program then run it.

Download Ewido Trojan’s and malware remover http://www.ewido.net/en/download/
This setup contains the free as well as the plus-version of the ewido security suite. After the installation, a free 14-day test version containing all the extensions of the plus-version will be activated. At the end of the test phase, the extensions of the plus version are deactivated and the freeware version can be used unlimited times. The purchased license code of the plus version can be entered at any time.
Ewido will auto-udate. Don't run yet

Reboot into Safe Mode: please see here if you are not sure how to do this.

Run Ewido full scan. Save the scan.log.

Clear out the files in the Prefetch folder. Go to start> run> type into the box Prefetch and delete all the files in that folder.

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items:
F2 - REG:system.ini: Shell=Explorer.exe init32m.exe
O2 - BHO: VBRunDLL Class - {197B8CA4-E215-46DD-8F33-E0544A80E5C4} - C:\WINDOWS\System32\vbrundll.dll
O2 - BHO: ohb - {9ADE0443-2AB2-4B23-A3F8-AC520773DE12} - C:\WINDOWS\System32\nsiF8.dll
O2 - BHO: (no name) - {F9C9B83E-20FA-5B2C-884C-0FC54E0A459C} - C:\WINDOWS\System32\glhnar.dll (file missing)
O4 - HKLM\..\Run: [secboot] C:\WINDOWS\System32\mszx23.exe !!
O4 - Global Startup: winlogin.exe
O15 - Trusted IP range: 195.95.218.170 (HKLM)
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup.../bridge-c17.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O20 - Winlogon Notify: drct16 - C:\WINDOWS\SYSTEM32\drct16.dll
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
Click on Fix Checked when finished and exit HijackThis.

Run Ad-aware se let remove all it finds

Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure all are checked and then press *ok* to remove:

Run killbox and click the radio button that says Delete a file on reboot. For each of the files you could not delete, paste them one at a time into the full path of file to delete box and click the red circle with a white cross in it.
The program will ask you if you want to reboot; say No each time until the last one has been pasted in whereupon you should answer Yes.
C:\WINDOWS\system32\init32m.exe
C:\WINDOWS\System32\vbrundll.dll
C:\WINDOWS\System32\nsiF8.dll
C:\WINDOWS\System32\mszx23.exe !!
C:\WINDOWS\SYSTEM32\drct16.dll
C:\WINDOWS\SYSTEM32\rpcapd.ini
Let the system reboot.

Please download, install and run this disk cleanup utility called Cleanup version 4.0!: http://downloads.ste...p/CleanUp40.exe
It will get rid of any malware which may be hiding in your temp folders ( a common hiding place). You will also regain a massive amount of disk space. Here is a tutorial which describes its usage: http://www.bleepingc...tutorial93.html
Check the custom settings to your liking under options, but be sure to delete temporary files and temporary internet files for all user profiles. Also, cleanout the prefetch folder and the recycle bin.When the scan has finnished click the close button
When prompted the system will log off to let it clean out the remaining files. when the log screen shows log back on and continue the fix.

Please run the following free, online virus scans.
http://www.pandasoft...n_principal.htm
Please post the logs From Panda, Ewido and HJT.logWe will need them to remove previous infections that have left files on your system.

Kc :tazz:
  • 0

#5
tcevolution
Posted 26 June 2005 - 05:26 PM

tcevolution

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
+ Created on: 6:22:48 PM, 6/26/2005
+ Report-Checksum: 6294A311

+ Date of database: 6/26/2005
+ Version of scan engine: v3.0

+ Duration: 17 min
+ Scanned Files: 62361
+ Speed: 60.10 Files/Second
+ Infected files: 746
+ Removed files: 746
+ Files put in quarantine: 0
+ Files that could not be opened: 0
+ Files that could not be cleaned: 0

+ Binder: Yes
+ Crypter: Yes
+ Archives: Yes

+ Scanned items:
C:\

+ Scan result:
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0082641.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0085641.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0085659.exe -> Not-A-Virus.PornWare.Downloader.Tibsystems -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0087641.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0087661.exe -> Not-A-Virus.PornWare.Downloader.Tibsystems -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0181640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0182640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0182657.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0183640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0183657.exe -> Not-A-Virus.PornWare.Downloader.Tibsystems -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0184640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0185640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0186640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0186659.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0187640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0187653.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0188640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0188657.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0188658.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0189640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0189658.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0190640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0191640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0191654.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0192640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0193640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0194640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0195640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0195656.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0196640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0196653.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0197640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0197657.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0198640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0198652.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0199641.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0200640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0200659.exe -> Not-A-Virus.PornWare.Downloader.Tibsystems -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0201640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0201654.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0202640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0203640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0203656.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0204640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0205640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0205656.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0206640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0207640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0207657.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0208640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0208656.exe -> Not-A-Virus.PornWare.Downloader.Tibsystems -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0209640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0209657.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0210640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0211640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0211657.exe -> Not-A-Virus.PornWare.Downloader.Tibsystems -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0212640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0213640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0213652.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0213655.exe -> Not-A-Virus.PornWare.Downloader.Tibsystems -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0214640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0215640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0216640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0217640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0217657.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0218640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0219640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0220641.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0221640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0222640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0222657.exe -> Not-A-Virus.PornWare.Downloader.Tibsystems -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0223640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0223656.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0224640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0225640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0225658.exe -> Not-A-Virus.PornWare.Downloader.Tibsystems -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0226640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0226654.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0227640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0227655.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0228640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0229640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0229658.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0229662.exe -> Not-A-Virus.PornWare.Downloader.Tibsystems -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0230641.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0231640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0232641.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0232652.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0233640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0234640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0234656.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0235640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0236640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0236655.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0237640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0238640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0238655.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0239640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0240640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0240653.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0241640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0241657.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0242640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0242659.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0243640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0244640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0245640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0245657.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0246640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0247640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0248640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0248657.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0249640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0249656.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0250640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0250657.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0251640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0252640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0253640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0254640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0255640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0256641.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0257641.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0258640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0258654.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0259640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0259657.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0260640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0261640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0262640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0263641.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0263656.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0263660.exe -> Not-A-Virus.PornWare.Downloader.Tibsystems -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0264640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0265640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0265659.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0265663.exe -> Not-A-Virus.PornWare.Downloader.Tibsystems -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0266641.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0267640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0268640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0269640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0269655.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0269659.exe -> Not-A-Virus.PornWare.Downloader.Tibsystems -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0270640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0271640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0271652.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0272640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0273640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0274640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0274655.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0274659.exe -> Not-A-Virus.PornWare.Downloader.Tibsystems -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0275640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0276640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0276654.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0277640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0278640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0278658.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0279640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0280641.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0281640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0281660.exe -> Not-A-Virus.PornWare.Downloader.Tibsystems -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0282640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0283640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0284640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0285640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0286640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0286655.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0287640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0288640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0289640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0290640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0291640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0292640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0293640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0293657.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0293661.exe -> Not-A-Virus.PornWare.Downloader.Tibsystems -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0294640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0294656.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0295640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0296640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0296656.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0297640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0297659.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0298640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0298655.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0299640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0300640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0301640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0301658.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0302640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0303640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0304640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0305640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0306640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0306657.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0307640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0308640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0309640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0309655.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0310640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0310655.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0310656.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0311640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0312640.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0312643.sys -> Backdoor.Haxdoor -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0312648.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0312660.exe -> Not-A-Virus.PornWare.Downloader.Tibsystems -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0313648.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0313661.exe -> Not-A-Virus.PornWare.Downloader.Tibsystems -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0314648.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0314653.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0314664.exe -> Not-A-Virus.PornWare.Downloader.Tibsystems -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0315653.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0315665.exe -> Not-A-Virus.PornWare.Downloader.Tibsystems -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0316656.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0316665.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0316667.exe -> Not-A-Virus.PornWare.Downloader.Tibsystems -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0317653.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0317664.exe -> Not-A-Virus.PornWare.Downloader.Tibsystems -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0318653.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0318657.sys -> Backdoor.Haxdoor -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0318660.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0319659.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0319670.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0319673.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0319677.sys -> Backdoor.Haxdoor -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0319680.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0319684.sys -> Backdoor.Haxdoor -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0319686.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0319698.exe -> Not-A-Virus.PornWare.Downloader.Tibsystems -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0319701.exe -> Trojan.PdPinch -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0320686.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0320688.sys -> Backdoor.Haxdoor -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0321686.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0321690.sys -> Backdoor.Haxdoor -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0321695.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0322695.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0322697.sys -> Backdoor.Haxdoor -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0322702.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0322708.sys -> Backdoor.Haxdoor -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0322710.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0322714.sys -> Backdoor.Haxdoor -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0322717.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0323717.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0324716.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0324720.sys -> Backdoor.Haxdoor -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0324725.exe -> Not-A-Virus.PornWare.Downloader.Tibsystems -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0324728.exe -> Trojan.Qhost.n -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0324730.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0324744.exe -> Trojan.PdPinch -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0325730.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0325734.sys -> Backdoor.Haxdoor -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0325739.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0325743.sys -> Backdoor.Haxdoor -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0325746.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0325757.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0326746.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0326756.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0327745.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0328745.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0329745.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0329749.sys -> Backdoor.Haxdoor -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0329751.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0329756.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0329762.sys -> Backdoor.Haxdoor -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0329763.exe -> Not-A-Virus.PornWare.Downloader.Tibsystems -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0329764.dll -> Spyware.SafeSurfing -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0329784.vxd -> Spyware.MediaPass -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0329794.exe -> TrojanDownloader.Agent.ho -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0329797.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0329804.exe -> Spyware.Hijacker.Generic -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0329807.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0329809.sys -> Backdoor.Haxdoor -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0329810.dll -> TrojanDownloader.WebP2PInstaller -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0329811.dll -> Spyware.SafeSurfing -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0329813.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0329818.exe -> Trojan.PdPinch -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0330813.dll -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0330815.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0331012.exe -> TrojanDownloader.Small.my -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0331020.exe -> TrojanProxy.Lager.j -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0331021.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0331027.exe -> TrojanDownloader.Agent.ho -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0331028.exe -> TrojanProxy.Mitglieder.dm -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0331029.exe -> Backdoor.Haxdoor.cn -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0331030.exe -> Trojan.Crypt.c -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0331031.exe -> Trojan.Crypt.c -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0331032.exe -> Trojan.Crypt.c -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0331035.exe -> Trojan.Regger.d -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0331036.exe -> Trojan.Regger.d -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0331037.exe -> TrojanDropper.Agent.my -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0331039.exe -> TrojanProxy.Mitglieder.dm -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0331041.dll -> TrojanSpy.Delf.hb -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0331043.dll -> TrojanSpy.Delf.hb -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0331052.dll -> Spyware.HotBar -> Cleaned without backup
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP286\A0331053.exe -> TrojanDownloader.Small.aod -> Cleaned without backup
C:\WINDOWS\6tfh9pmn1b.exe -> TrojanDropper.Small.ju -> Cleaned without backup
C:\WINDOWS\ceres.dll -> Spyware.BetterInternet.d -> Cleaned without backup
C:\WINDOWS\gko6dv3gy7.exe -> TrojanDropper.Small.ju -> Cleaned without backup
C:\WINDOWS\hwin32.dll -> Trojan.HideProc.b -> Cleaned without backup
C:\WINDOWS\hwinsys32.dll -> Trojan.HideProc.b -> Cleaned without backup
C:\WINDOWS\sys32.exe -> Backdoor.Small.et -> Cleaned without backup
C:\WINDOWS\syshost.exe -> TrojanSpy.Banker.pv -> Cleaned without backup
C:\WINDOWS\system32\COMMCOS2.DLL -> Spyware.SafeSurfing -> Cleaned without backup
C:\WINDOWS\system32\hwin32.dll -> Trojan.HideProc.b -> Cleaned without backup
C:\WINDOWS\system32\newdial.exe -> Dialer.Generic -> Cleaned without backup
C:\WINDOWS\system32\nsa172.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsa1DF.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsa22.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsa3E.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsa47.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsa48.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsaA.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsaA8.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsaB.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsaD.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsaE0.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsaF3.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsb117.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsb151.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsb15C.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsb1E.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsb235.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsb242.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsb2F1.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsb52.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsb55.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsb74.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsb79.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsb94.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsbA.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsbAC.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsbC2.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsbF.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsbF3.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsbF7.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsbF9.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsbFB.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsc102.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsc10C.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsc187.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsc1A0.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsc1A2.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsc1B3.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsc201.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsc227.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsc247.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsc63.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsc91.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nscA.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nscBB.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nscBF.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nscD1.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nscE4.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nscF8.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsd100.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsd122.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsd133.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsd144.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsd1A6.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsd1C6.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsd1DB.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsd1E.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsd8B.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsdBD.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsdC.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsdD0.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsdFA.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nse10F.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nse12.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nse186.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nse36.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nse61.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nse92.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nseA.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nseA9.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nseAB.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nseB.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nseB8.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nseC3.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nseCB.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nseF.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsf101.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsf11.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsf110.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsf116.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsf137.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsf15.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsf1D0.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsf1E8.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsf1F8.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsf250.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsf31.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsf3A.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsf83.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsf97.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsfA.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsfB.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsfB4.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsfC.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsfD.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsfEA.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsfF.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsfF4.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsfF7.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsg10E.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsg152.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsg17.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsg18F.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsg1C.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsg1C5.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsg1D.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsg83.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsg95.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsg98.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsg9B.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsgA.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsgC.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsgC0.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsgCF.dll -> Spyware.HotBar -> Cleaned without backup
C:\WINDOWS\system32\nsgEE.dll -> Spyware.HotBar -> Cleaned witho
  • 0

#6
tcevolution
Posted 26 June 2005 - 05:32 PM

tcevolution

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
Logfile of HijackThis v1.99.1
Scan saved at 6:27:34 PM, on 6/26/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\system32\gearsec.exe
C:\WINDOWS\system32\gearsec.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ps2.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.95.218.172/index.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us10.hpwis.com/
R3 - Default URLSearchHook is missing
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [dB44RTJqR] ntmredir.exe
O4 - HKCU\..\Run: [Spyware Begone] C:\Program Files\freescan.exe -FastScan
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [Notn] C:\Documents and Settings\Owner\Application Data\wtta.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - Global Startup: winlogin.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O15 - Trusted Zone: *.bestcounter.biz
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted IP range: 195.95.218.170
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O20 - AppInit_DLLs: u93rekv26hzl7.tlb
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: GEARSecurity_BackUp - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NetBiosExt32 - Unknown owner - C:\WINDOWS\services.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton AntiVirus\SAVScan.exe

I noticed my hijack this log has even more stuff than it did before I downloaded all those programs you told me to use. I tried deleting some of the stuff but it keeps coming back, even if I use killbox. I can at least use my computer now but I still have the blue screensaver saying im infected w/ smitfraud.c. Thanx for the help Thatman, I can finally use my computer again!
  • 0

#7
Guest_thatman_*
Posted 27 June 2005 - 02:42 AM

Guest_thatman_*
  • Guest
Hi tcevolution

Please read through the instructions before you start (you may want to print this out).

Please set your system to show all files; please see here if you're unsure how to do this.

Please download and install AD-Aware.
Check Here on how setup and use it - please make sure you update it first. Don't run yet.

Download Pocket Killbox and unzip it; save it to your Desktop. We may need it later.

Please download SpyBot V1.4 http://www.majorgeek...wnload2471.html Update the program then run it.

Download Ewido Trojan’s and malware remover http://www.ewido.net/en/download/
This setup contains the free as well as the plus-version of the ewido security suite. After the installation, a free 14-day test version containing all the extensions of the plus-version will be activated. At the end of the test phase, the extensions of the plus version are deactivated and the freeware version can be used unlimited times. The purchased license code of the plus version can be entered at any time.
Ewido will auto-udate. Don't run yet

Turn of system restore leave it off.

Reboot into Safe Mode: please see here if you are not sure how to do this.

a.) Copy the contents of the Code Box below to Notepad.
b.) Save the file as RemoveTrustedZone.reg
c.) Change the Save as Type to All Files.
d.) Save this file to the desktop.

Quote:
REGEDIT4

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
--
e.) Double-click on RemoveTrustedZone.reg.
f.) When it asks you to merge the information to the registry click Yes.[/b]

Run Ewido full scan. Save the scan.log.

Clear out the files in the Prefetch folder. Go to start> run> type into the box Prefetch and delete all the files in that folder.

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.95.218.172/index.php
R3 - Default URLSearchHook is missing
O4 - HKCU\..\Run: [dB44RTJqR] ntmredir.exe
O4 - HKCU\..\Run: [Notn] C:\Documents and Settings\Owner\Application Data\wtta.exe
O15 - Trusted Zone: *.bestcounter.biz
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted IP range: 195.95.218.170
Click on Fix Checked when finished and exit HijackThis.

Run Ad-aware se let remove all it finds

Use windows explorer find and delete the following file: ntmredir.exe

Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure all are checked and then press *ok* to remove:

Turn system restore back on and create a new restore point.

Reboot as normal

Please download, install and run this disk cleanup utility called Cleanup version 4.0!: http://downloads.ste...p/CleanUp40.exe
It will get rid of any malware which may be hiding in your temp folders ( a common hiding place). You will also regain a massive amount of disk space. Here is a tutorial which describes its usage: http://www.bleepingc...tutorial93.html
Check the custom settings to your liking under options, but be sure to delete temporary files and temporary internet files for all user profiles. Also, cleanout the prefetch folder and the recycle bin.When the scan has finnished click the close button
When prompted the system will log off to let it clean out the remaining files. when the log screen shows log back on and continue the fix.

This part is a Important Step don't use norton it has been disable by the malware on your system this scan will remove the problem.
Please run the following free, online virus scans.
http://www.pandasoft...n_principal.htm
Please post the logs From Panda, Ewido and HJT.logWe will need them to remove previous infections that have left files on your system.

Kc :tazz:
  • 0

#8
Guest_thatman_*
Posted 02 July 2005 - 12:42 PM

Guest_thatman_*
  • Guest
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member with address of this thread. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP