it wont let me merge the rem file error says " cannot import Error opening file. There may be a disk or file system error.... but here is the other logs
WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding.
If you see a message in the titlebar saying "Not responding..." you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly.
»»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Product Name: Microsoft Windows XP Current Build: Service Pack 2 Current Build Number: 2600
Internet Explorer Version: 6.0.2900.2180
»»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»»
Checking %SystemDrive% folder...
Checking %ProgramFilesDir% folder...
Checking %WinDir% folder...
Checking %System% folder...
PEC2 8/18/2001 8:00:00 AM 41397 C:\WINDOWS\SYSTEM32\dfrg.msc
UPX! 11/24/2001 2:31:48 PM 65536 C:\WINDOWS\SYSTEM32\DVDAudio.ax
UPX! 11/24/2001 2:28:14 PM 86528 C:\WINDOWS\SYSTEM32\DVDVideo.ax
PTech 7/12/2005 6:04:22 PM 520456 C:\WINDOWS\SYSTEM32\LegitCheckControl.dll
PECompact2 8/4/2005 9:31:38 PM 1449304 C:\WINDOWS\SYSTEM32\MRT.exe
aspack 8/4/2005 9:31:38 PM 1449304 C:\WINDOWS\SYSTEM32\MRT.exe
aspack 8/4/2004 3:56:36 AM 708096 C:\WINDOWS\SYSTEM32\ntdll.dll
Umonitor 8/4/2004 3:56:44 AM 657920 C:\WINDOWS\SYSTEM32\rasdlg.dll
winsync 8/18/2001 8:00:00 AM 1309184 C:\WINDOWS\SYSTEM32\wbdbase.deu
Checking %System%\Drivers folder and sub-folders...
PTech 8/4/2004 1:41:38 AM 1309184 C:\WINDOWS\SYSTEM32\drivers\mtlstrm.sys
Items found in C:\WINDOWS\SYSTEM32\drivers\etc\hosts
Checking the Windows folder and sub-folders for system and hidden files within the last 60 days...
7/21/2005 7:18:54 PM RHS 116 C:\WINDOWS\PCGWIN32.LI3
8/27/2005 2:26:42 AM HS 8704 C:\WINDOWS\system32\Thumbs.db
8/8/2005 9:22:10 AM RHS 401408 C:\WINDOWS\system32\??xplore.exe
7/8/2005 4:23:18 PM S 12143 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB893756.cat
6/30/2005 9:06:34 AM S 11437 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB896423.cat
7/19/2005 7:18:10 PM S 18913 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB896727.cat
6/30/2005 1:42:18 PM S 11084 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB899587.cat
6/30/2005 2:21:10 PM S 11084 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB899588.cat
6/30/2005 8:46:18 AM S 11084 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB899591.cat
6/28/2005 7:12:56 PM S 11845 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB901214.cat
7/2/2005 4:18:16 AM S 9445 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB903235.cat
8/27/2005 6:28:24 AM H 12288 C:\WINDOWS\system32\config\DEFAULT.LOG
8/27/2005 6:28:14 AM H 1024 C:\WINDOWS\system32\config\SAM.LOG
8/27/2005 6:28:04 AM H 12288 C:\WINDOWS\system32\config\SECURITY.LOG
8/27/2005 6:34:22 AM H 212992 C:\WINDOWS\system32\config\SOFTWARE.LOG
8/27/2005 6:35:34 AM H 962560 C:\WINDOWS\system32\config\SYSTEM.LOG
8/10/2005 6:01:04 AM H 1024 C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
8/24/2005 6:48:46 AM HS 95232 C:\WINDOWS\system32\DirectX\Dinput\Thumbs.db
7/8/2005 7:47:38 AM HS 388 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\a7f992fc-9640-4322-a002-d7aaad40846c
7/8/2005 7:47:38 AM HS 24 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\Preferred
8/27/2005 6:27:10 AM H 6 C:\WINDOWS\Tasks\SA.DAT
8/24/2005 7:45:30 AM HS 113 C:\WINDOWS\Temp\History\History.IE5\desktop.ini
8/24/2005 7:45:28 AM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\desktop.ini
8/24/2005 8:36:20 AM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\32OC4THT\desktop.ini
8/24/2005 8:36:20 AM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\KVMJG5ET\desktop.ini
8/24/2005 8:36:20 AM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\QOJKINAN\desktop.ini
8/24/2005 8:36:20 AM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\S0AJ2U41\desktop.ini
8/19/2005 8:08:00 AM HS 9216 C:\WINDOWS\Web\printers\images\Thumbs.db
Checking for CPL files...
Microsoft Corporation 8/4/2004 3:56:58 AM 68608 C:\WINDOWS\SYSTEM32\access.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 549888 C:\WINDOWS\SYSTEM32\appwiz.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 110592 C:\WINDOWS\SYSTEM32\bthprops.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 135168 C:\WINDOWS\SYSTEM32\desk.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 80384 C:\WINDOWS\SYSTEM32\firewall.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 155136 C:\WINDOWS\SYSTEM32\hdwwiz.cpl
Ahead Software AG 12/23/2003 4:40:52 PM 57344 C:\WINDOWS\SYSTEM32\ImageDrive.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 358400 C:\WINDOWS\SYSTEM32\inetcpl.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 129536 C:\WINDOWS\SYSTEM32\intl.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 380416 C:\WINDOWS\SYSTEM32\irprops.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 68608 C:\WINDOWS\SYSTEM32\joy.cpl
Sun Microsystems, Inc. 6/3/2005 3:52:54 AM 49265 C:\WINDOWS\SYSTEM32\jpicpl32.cpl
Microsoft Corporation 8/18/2001 8:00:00 AM 187904 C:\WINDOWS\SYSTEM32\main.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 618496 C:\WINDOWS\SYSTEM32\mmsys.cpl
Kristal Studio 3/2/2001 9:39:28 PM 121856 C:\WINDOWS\SYSTEM32\Mp3cnfg.cpl
Microsoft Corporation 8/18/2001 8:00:00 AM 35840 C:\WINDOWS\SYSTEM32\ncpa.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 25600 C:\WINDOWS\SYSTEM32\netsetup.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 257024 C:\WINDOWS\SYSTEM32\nusrmgr.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 32768 C:\WINDOWS\SYSTEM32\odbccp32.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 114688 C:\WINDOWS\SYSTEM32\powercfg.cpl
Apple Computer, Inc. 9/23/2004 7:57:40 PM 323072 C:\WINDOWS\SYSTEM32\QuickTime.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 298496 C:\WINDOWS\SYSTEM32\sysdm.cpl
Microsoft Corporation 8/18/2001 8:00:00 AM 28160 C:\WINDOWS\SYSTEM32\telephon.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 94208 C:\WINDOWS\SYSTEM32\timedate.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 148480 C:\WINDOWS\SYSTEM32\wscui.cpl
Microsoft Corporation 5/26/2005 4:16:30 AM 174360 C:\WINDOWS\SYSTEM32\wuaucpl.cpl
Microsoft Corporation 8/18/2001 8:00:00 AM 187904 C:\WINDOWS\SYSTEM32\dllcache\main.cpl
Microsoft Corporation 8/18/2001 8:00:00 AM 35840 C:\WINDOWS\SYSTEM32\dllcache\ncpa.cpl
Microsoft Corporation 8/18/2001 8:00:00 AM 28160 C:\WINDOWS\SYSTEM32\dllcache\telephon.cpl
Microsoft Corporation 5/26/2005 4:16:30 AM 174360 C:\WINDOWS\SYSTEM32\dllcache\wuaucpl.cpl
»»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»»
Checking files in %ALLUSERSPROFILE%\Startup folder...
8/2/2004 9:19:56 PM HS 84 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
12/4/2004 11:08:26 AM 1730 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
Checking files in %ALLUSERSPROFILE%\Application Data folder...
8/2/2004 8:39:52 PM HS 62 C:\Documents and Settings\All Users\Application Data\desktop.ini
9/27/2004 12:30:16 AM 4 C:\Documents and Settings\All Users\Application Data\DragToDiscUserNameE.txt
4/24/2005 1:26:22 AM 845 C:\Documents and Settings\All Users\Application Data\hpzinstall.log
Checking files in %USERPROFILE%\Startup folder...
12/15/2003 7:49:00 PM HS 84 C:\Documents and Settings\Tock\Start Menu\Programs\Startup\desktop.ini
Checking files in %USERPROFILE%\Application Data folder...
12/15/2003 11:30:04 AM HS 62 C:\Documents and Settings\Tock\Application Data\desktop.ini
»»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»»
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
SV1 =
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
[HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers]
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\fkktggyn
{18c4296d-f50e-4502-a296-2e04afb72b80} = C:\WINDOWS\system32\jkkod.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\iO
{C14F7681-33D8-11D3-A09B-00500402F30B} = C:\Program Files\iO\iomenu.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With
{09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu
{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Program Files\Norton AntiVirus\NavShExt.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinRAR
{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinZip
{E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
Start Menu Pin = %SystemRoot%\system32\SHELL32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu
{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Program Files\Norton AntiVirus\NavShExt.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR
{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinZip
{E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing
{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR
{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinZip
{E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{6EC11407-5B2E-4E25-8BDF-77445B52AB37}
= C:\WINDOWS\system32\supdate.dll
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
AcroIEHlprObj Class = C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872}
CNavExtBho Class = C:\Program Files\Norton AntiVirus\NavShExt.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4528BBE0-4E08-11D5-AD55-00010333D0AD}
=
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}
&Tip of the Day = %SystemRoot%\System32\shdocvw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} = Norton AntiVirus : C:\Program Files\Norton AntiVirus\NavShExt.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}
MenuText = Sun Java Console : C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B13B4423-2647-4cfc-A4B3-C7D56CB83487}
ButtonText = Share in Hello :
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{30D02401-6A81-11D0-8274-00C04FD5AE38}
Search Band = %SystemRoot%\System32\browseui.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}
=
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{4528BBE0-4E08-11D5-AD55-00010333D0AD}
=
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E61-B078-11D0-89E4-00C04FC9E26E}
Favorites Band = %SystemRoot%\System32\shdocvw.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E62-B078-11D0-89E4-00C04FC9E26E}
History Band = %SystemRoot%\System32\shdocvw.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}
Explorer Band = %SystemRoot%\System32\shdocvw.dll
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} = Norton AntiVirus : C:\Program Files\Norton AntiVirus\NavShExt.dll
{01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\System32\browseui.dll
{0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Links : %SystemRoot%\system32\SHELL32.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
{01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\System32\browseui.dll
{0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Links : %SystemRoot%\system32\SHELL32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
RCScheduleCheck C:\Program Files\VCOM\Recovery Commander\RCSCHED.EXE -CHECK
NeroFilterCheck C:\WINDOWS\system32\NeroCheck.exe
QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime
MsConfigs
p2pnetwork
ccApp "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
Advanced Tools Check C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
LXSUPMON C:\WINDOWS\System32\LXSUPMON.EXE RUN
MSConfig C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
winsync C:\WINDOWS\system32\ldd4kk.exe reg_run
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
IMAIL Installed = 1
MAPI Installed = 1
MSFS Installed = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
p2pnetwork
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
p2pnetwork
msconfigs
ctfmon.exe C:\WINDOWS\system32\ctfmon.exe
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
p2pnetwork
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} =
{0DF44EAA-FF21-4412-828E-260A8728E7F1} =
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings
Key }®CHƒ@ÕµÄ Ü€ãgæ
Hint 1mokeg
FileName0 C:\WINDOWS\System32\RSACi.rat
WarnOnOff 1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings\.Default
Allow_Unknowns 1
PleaseMom 0
Enabled 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings\.Default\
http://www.rsac.org/ratingsv01.html v 4
s 4
n 4
l 4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings\PICSRules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings\PICSRules\.Default
NumSys 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
dontdisplaylastusername 0
legalnoticecaption
legalnoticetext
shutdownwithoutlogon 1
undockwithoutlogon 1
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoDriveTypeAutoRun 0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
PostBootReminder {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll
CDBurn {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll
WebCheck {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll
SysTray {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
Shell = Explorer.exe
System =
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain
= crypt32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet
= cryptnet.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll
= cscdll.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp
= wlnotify.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule
= wlnotify.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy
= sclgntfy.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn
= WlNotify.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv
= wlnotify.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon
= wlnotify.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif
= wzcdlg.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path
Debugger = ntsd -d
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLs
»»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
WinPFind v1.3.1 - Log file written to "WinPFind.Txt" in the WinPFind folder.
Scan completed on 8/27/2005 6:45:49 AM
Logfile of HijackThis v1.99.1
Scan saved at 7:01:52 AM, on 8/27/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://gmail.comR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://gmail.comO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [RCScheduleCheck] C:\Program Files\VCOM\Recovery Commander\RCSCHED.EXE -CHECK
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\ldd4kk.exe reg_run
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) -
http://support.f-sec...m/ols/fscax.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
http://www.pandasoft...free/asinst.cabO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LexBce Server (LexBceS) - Unknown owner - C:\WINDOWS\system32\LEXBCES.EXE (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
Finished: 197 viruses found
Scanned files: 56539 Warning: 197 file(s) still infected!
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\nccp.exe Trojan-Downloader.Win32.Qoologic.ac
C:\Documents and Settings\Tock\Local Settings\Temporary Internet Files\Content.IE5\0PFTL811\protect[1].htm Trojan-Downloader.JS.Codebase.c
C:\Program Files\Norton AntiVirus\Quarantine\175376FE.dll Trojan-Clicker.Win32.Small.ez
C:\Program Files\Norton AntiVirus\Quarantine\175376FE.exe Trojan-Dropper.Win32.Agent.lu
C:\Program Files\Norton AntiVirus\Quarantine\1EA74A5A Trojan-Dropper.Win32.Agent.pd
C:\Program Files\Norton AntiVirus\Quarantine\33884D17 Trojan-Dropper.Win32.Agent.pd
C:\Program Files\Norton AntiVirus\Quarantine\3FCF2744.exe Trojan-Downloader.Win32.Qoologic.ac
C:\Program Files\Norton AntiVirus\Quarantine\3FE64D2B.exe Trojan-Downloader.Win32.Qoologic.ac
C:\Program Files\Norton AntiVirus\Quarantine\414609F9.exe Trojan-Dropper.Win32.Agent.pb
C:\Program Files\Norton AntiVirus\Quarantine\414A33F5.com Trojan-Dropper.Win32.Agent.pb
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP418\A0112522.exe Trojan-Spy.Win32.VB.eh
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP418\A0112750.exe Trojan-Downloader.Win32.Small.aal
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP418\A0112752.exe Trojan-Downloader.Win32.Adload.a
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP419\A0112844.exe Trojan-Dropper.Win32.Small.qn
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP419\A0112849.exe Trojan-Dropper.Win32.Agent.hl
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP419\A0112893.exe Trojan-Dropper.Win32.Agent.lu
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP419\A0113195.exe Trojan-Downloader.Win32.Apropo.ae
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0114155.exe Trojan-Downloader.Win32.Qoologic.v
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0114156.dll Trojan-Downloader.Win32.Qoologic.s
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0114157.exe Trojan-Downloader.Win32.Small.apm
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0114162.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0114164.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0114165.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0114166.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0114176.exe Trojan-Downloader.Win32.Apropo.ag
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0114469.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0114470.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0114471.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0114472.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0114788.exe Trojan-Dropper.Win32.Agent.pd
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0114793.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0114794.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0114795.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115107.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115108.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115109.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115110.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115176.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115177.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115178.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115179.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115233.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115234.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115235.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115236.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115255.dll Trojan-Downloader.Win32.Apropo.ag
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115256.exe Trojan-Downloader.Win32.Apropo.ag
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115262.dll Trojan-Clicker.Win32.Small.ez
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115264.exe Trojan-Downloader.Win32.Apropo.g
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115265.exe Trojan-Downloader.Win32.Agent.ro
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115267.exe Trojan-Downloader.Win32.Small.abd
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115273.cpl Trojan-Downloader.Win32.Qoologic.p
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115288.dll Trojan-Downloader.Win32.Qoologic.p
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115301.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115302.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115304.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115305.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115310.exe Trojan-Downloader.Win32.Small.abd
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115340.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115341.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115342.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115358.exe Trojan-Dropper.Win32.Agent.pb
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115359.exe Trojan-Dropper.Win32.Agent.pb
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115360.exe Trojan-Dropper.Win32.Agent.pb
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115361.exe Trojan-Dropper.Win32.Agent.pb
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115362.exe Trojan-Dropper.Win32.Agent.pb
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115363.dll Trojan-Clicker.Win32.Small.ez
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115364.exe Trojan-Downloader.Win32.Apropo.u
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115366.exe Trojan-Downloader.Win32.Apropo.g
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115367.exe Trojan-Downloader.Win32.Agent.ro
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115369.exe Trojan-Downloader.Win32.Small.bgl
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115370.exe Trojan-Downloader.Win32.Small.abd
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115378.cpl Trojan-Downloader.Win32.Qoologic.p
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115426.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115427.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115428.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP420\A0115429.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP421\A0115458.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP421\A0115459.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP421\A0115460.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP421\A0115496.exe Trojan-Dropper.Win32.Agent.lu
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP421\A0115499.exe Trojan-Spy.Win32.VB.eh
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP422\A0115524.com Trojan-Dropper.Win32.Agent.pb
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP422\A0115621.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP422\A0115622.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP422\A0115623.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP422\A0115624.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP422\A0115819.exe Trojan-Dropper.Win32.Agent.pb
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP422\A0115820.exe Trojan-Dropper.Win32.Agent.pb
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP422\A0115822.exe Trojan-Dropper.Win32.Agent.pb
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP422\A0115823.exe Trojan-Dropper.Win32.Agent.pb
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP422\A0115824.exe Trojan-Dropper.Win32.Agent.pb
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP422\A0115829.exe Trojan-Dropper.Win32.Agent.pb
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP423\A0116623.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP423\A0116624.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP423\A0116625.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP423\A0116627.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP423\A0116662.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP423\A0116663.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP423\A0116664.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP423\A0116665.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP423\A0116837.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP423\A0116838.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP423\A0116839.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP423\A0116840.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP423\A0117004.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP423\A0117005.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP423\A0117006.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP423\A0117007.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP423\A0117100.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP423\A0117101.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP423\A0117102.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117149.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117150.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117151.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117167.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117168.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117169.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117170.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117203.exe Trojan-Downloader.Win32.Adload.a
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117211.exe Trojan-Dropper.Win32.Small.qn
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117221.exe Trojan-Dropper.Win32.Agent.hl
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117226.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117227.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117228.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117229.exe Trojan-Downloader.Win32.Small.abd
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117264.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117265.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117266.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117267.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117288.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117289.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117290.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117308.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117309.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117310.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117311.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117329.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117330.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117331.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117340.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117341.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117342.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP424\A0117343.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117614.exe Trojan-Downloader.Win32.Small.apm
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117620.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117621.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117622.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117623.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117636.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117637.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117638.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117639.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117648.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117649.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117650.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117651.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117662.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117663.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117664.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117665.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117675.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117676.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117677.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117685.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117686.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117687.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117855.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117856.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117857.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117870.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117871.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117872.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117877.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117878.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117879.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117880.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0117916.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0118066.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP425\A0118067.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP426\A0118092.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP426\A0118099.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP426\A0118100.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP426\A0118101.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP426\A0118141.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP426\A0118147.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP426\A0118151.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP426\A0118152.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP426\A0118153.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP427\A0118190.exe Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP427\A0118193.dll Trojan-Downloader.Win32.Qoologic.ac
C:\System Volume Information\_restore{78077382-E913-449C-ADC1-742F59543214}\RP427\A