Excellent forum - found a huge amount of info, but realise complete resolution is complex and beyond me.. I noticed spyware infection from Spysheriff..then immediately followed by the IE homepage hijacked to about:blank.
Have followed the recommended path of scans etc. which have clearly removed a number of threats. Microsoft auto updates have been turned on since machine installed, as has Norton security centre - although my subscription ran out 2 days ago
Many thanks for your help
HJT and Ewido scan reports attached
Logfile of HijackThis v1.99.1
Scan saved at 23:58:36, on 01/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\mszm.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
C:\IBMTOOLS\UTILS\ibmprc.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\ntwj32.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Tom\My Documents\My Received Files\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\ofizx.dll/sp.html#28129%resultposition.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\ofizx.dll/sp.html#28129%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\ofizx.dll/sp.html#28129%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\ofizx.dll/sp.html#28129%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\ofizx.dll/sp.html#28129%resultposition.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\ofizx.dll/sp.html#28129%resultposition.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\ofizx.dll/sp.html#28129%resultposition.net
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {144A8F4B-8A74-6D3D-DFE1-DCADA483C0C3} - C:\WINDOWS\ieqa.dll (file missing)
O2 - BHO: Class - {3F0B4D62-3F78-BCE7-5D04-FF5FF7AF83E7} - C:\WINDOWS\system32\iejd.dll (file missing)
O2 - BHO: Class - {50B9D3EB-DAA2-54F6-5C19-8EE4DF6C6816} - C:\WINDOWS\javaki.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O2 - BHO: Class - {EBA72B4B-C8B6-180C-5E41-E729CE5B9CFE} - C:\WINDOWS\msuc32.dll (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O2 - BHO: Class - {FEDBC933-9884-74C8-1988-83E8B42CE43F} - C:\WINDOWS\system32\sdkrz.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [UC_Start] C:\Program Files\IBM\Updater\\ucstartup.exe
O4 - HKLM\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\\ibmmessages.exe
O4 - HKLM\..\Run: [IBMPRC] C:\IBMTOOLS\UTILS\ibmprc.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [sysbn.exe] C:\WINDOWS\sysbn.exe
O4 - HKLM\..\Run: [16B.tmp] C:\DOCUME~1\Tom\LOCALS~1\Temp\16B.tmp.exe
O4 - HKLM\..\Run: [16C.tmp] C:\DOCUME~1\Tom\LOCALS~1\Temp\16C.tmp.exe
O4 - HKLM\..\Run: [16C.tmp.exe] C:\DOCUME~1\Tom\LOCALS~1\Temp\16C.tmp.exe
O4 - HKLM\..\Run: [16B.tmp.exe] C:\DOCUME~1\Tom\LOCALS~1\Temp\16B.tmp.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ntwj32.exe] C:\WINDOWS\ntwj32.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\RunOnce: [mszm.exe] C:\WINDOWS\system32\mszm.exe
O4 - HKCU\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MessengerPlus3] "\" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Instant Update Reminder.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java141\jre\bin\NPJPI141.dll
O9 - Extra 'Tools' menuitem: IBM Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java141\jre\bin\NPJPI141.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [JAVA_IBM] Java (IBM)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...er.cab31267.cab
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.t...ivex/hcImpl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zon...ro.cab32846.cab
O16 - DPF: {BF6BBE9A-0656-4598-A0CD-32DAC03959B5} (Image Uploader 3.0 Control) - http://www.asda-phot...opcuploader.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.co...aploader_v6.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zon...ss.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...wn.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\apixu32.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Ewido scan report
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------
+ Created on: 20:09:23, 01/01/2006
+ Report-Checksum: 8A39501
+ Scan result:
HKLM\SOFTWARE\Classes\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA} -> Spyware.MyWebSearch : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SE -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SW -> Spyware.CoolWebSearch : Cleaned with backup
HKU\S-1-5-21-1384060179-4109010553-3436349140-1016\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D} -> Spyware.MyWebSearch : Cleaned with backup
HKU\S-1-5-21-1384060179-4109010553-3436349140-1016\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA} -> Spyware.MyWebSearch : Cleaned with backup
[984] C:\WINDOWS\apixu32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\Documents and Settings\Tom\Local Settings\Temp\20.tmp -> Trojan.Small.ga : Cleaned with backup
C:\Documents and Settings\Tom\Local Settings\Temp\21.tmp -> Trojan.Small.ga : Cleaned with backup
C:\Program Files\MSN Messenger\riched20.dll -> Spyware.MyWebSearch : Cleaned with backup
C:\Program Files\U.S. Robotics\ControlCenter\Reminder.exe -> Heuristic.Win32.Dialer : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP337\A0193392.dll -> Adware.SpySheriff : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP337\A0193394.dll -> Spyware.SpywareNo : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP337\A0193395.dll -> Adware.SpySheriff : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP338\A0193401.exe -> Adware.SpySheriff : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP338\A0193402.exe -> Trojan.Small : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP338\A0194448.pif:uuqiy -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP338\A0194467.pif:uuqiy -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0194484.pif:uuqiy -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0196472.pif:uuqiy -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0198471.pif:uuqiy -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0199470.pif:uuqiy -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200470.pif:uuqiy -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200876.exe -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200881.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200882.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200884.EXE -> Spyware.Wesbar : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200885.DLL -> Spyware.FunWeb : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200886.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200887.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200888.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200889.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200890.SCR -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200891.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200892.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200893.EXE -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200894.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200895.DLL -> Spyware.Wesbar : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200896.DLL -> Adware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200897.DLL -> Adware.IWon : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200898.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200899.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200900.DLL -> Adware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200903.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200909.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200910.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200920.pif:uuqiy -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{81D97640-A600-45A6-B0D3-BD06AB5A81A7}\RP339\A0200930.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\addyh32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apiqm.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\apixu32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\appgm32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\appmd32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\atlei32.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\crxv32.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\d3bb.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\d3bt32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\popcaploader.dll -> Not-A-Virus.PornWare.PopCap.b : Cleaned with backup
C:\WINDOWS\ielu32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ieqa.dll -> Downloader.Agent.bc : Cleaned with backup
C:\WINDOWS\iis6.log:ovogd -> Downloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ipcf32.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\iphb.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipym32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javaki.dll -> Downloader.Agent.bc : Cleaned with backup
C:\WINDOWS\javaki.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javamh32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\KB873333.log:zwrrs -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\KB885835.log:slrqr -> Downloader.Agent.bc : Cleaned with backup
C:\WINDOWS\KB887472.log:qyrxy -> Downloader.Agent.bc : Cleaned with backup
C:\WINDOWS\KB893803.log:mtxar -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\LUINSTALL.LOG:hfkfp -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\mfclk.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\msbl32.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\mssk.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\msuc32.dll -> Downloader.Agent.bc : Cleaned with backup
C:\WINDOWS\mszc.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\netfv.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\netpp.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ntnv32.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\REGLOCS.OLD:bnzha -> Downloader.Agent.bc : Cleaned with backup
C:\WINDOWS\setupapi.log:xhvfq -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\stub7.ini:ravki -> Downloader.Agent.bc : Cleaned with backup
C:\WINDOWS\syskf.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\system32\addfv.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\system32\apibo32.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\system32\apivc32.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\system32\apixt32.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\system32\appnh32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\appxu.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\croj.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\system32\crwc.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\system32\d3xl.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\system32\f3PSSavr.scr -> Spyware.MyWebSearch : Cleaned with backup
C:\WINDOWS\system32\iehz32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\iejb.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\iejd.dll -> Downloader.Agent.bc : Cleaned with backup
C:\WINDOWS\system32\javanf.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\mfcgq32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\netea.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\system32\netkp32.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\system32\netnh.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\system32\ntgf.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\system32\ntqm.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\system32\sysef.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\syswn32.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\winck32.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\_default.pif:uuqiy -> Downloader.Agent.td : Cleaned with backup
::Report End
Sign In
Create Account
