This topic is locked263-7
2425-2
failsafe
WindozeXP
WindozeME
floppy
Need help with getting rid of trojan horses![RESOLVED]
Started by
Kristy
, Mar 11 2005 11:20 AM
#16
Posted 13 March 2005 - 02:21 PM
Kristy
- Topic Starter
-
- Member
-
- 1,099 posts
Visiting Consultant
263-7
2425-2
failsafe
WindozeXP
WindozeME
floppy
#17
Posted 13 March 2005 - 05:04 PM
Kristy
- Topic Starter
-
- Member
-
- 1,099 posts
Visiting Consultant
bumping this up
#18
Posted 13 March 2005 - 05:26 PM
Kristy
- Topic Starter
-
- Member
-
- 1,099 posts
Visiting Consultant
I just noticed that my computer has an F lock, which is why I couldn't get to the safe mode option. So I now know how to get it into safe mode. Where do I go from here?
#19
Posted 13 March 2005 - 05:44 PM
Kristy
- Topic Starter
-
- Member
-
- 1,099 posts
Visiting Consultant
Ran HijackThis again after doing what u said, rebooting it into safe mode, and then deleting the files/folders I could find that u told me to delete.
Logfile of HijackThis v1.99.1
Scan saved at 3:40:41 PM, on 3/13/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Media Pass\MediaPass.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Media Pass\MediaPassK.exe
C:\Documents and Settings\kristy\Desktop\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimt.../aimtoolbar.jsp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R3 - Default URLSearchHook is missing
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [Media Pass] C:\Program Files\Media Pass\MediaPass.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: RunOnce - C:\WINDOWS\system32\ddmodemx.dll
O20 - Winlogon Notify: ShellScrap - C:\WINDOWS\system32\g0lmla311d.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
Logfile of HijackThis v1.99.1
Scan saved at 3:40:41 PM, on 3/13/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Media Pass\MediaPass.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Media Pass\MediaPassK.exe
C:\Documents and Settings\kristy\Desktop\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimt.../aimtoolbar.jsp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R3 - Default URLSearchHook is missing
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [Media Pass] C:\Program Files\Media Pass\MediaPass.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: RunOnce - C:\WINDOWS\system32\ddmodemx.dll
O20 - Winlogon Notify: ShellScrap - C:\WINDOWS\system32\g0lmla311d.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
#20
Posted 13 March 2005 - 09:36 PM
Kristy
- Topic Starter
-
- Member
-
- 1,099 posts
Visiting Consultant
bumping this up
#21
Guest_thatman_*
Posted 14 March 2005 - 02:37 AM
Guest_thatman_*
Guest_thatman_*
-
- Guest
Hi Rustymilo
Please rerun L2mfix again.
You have the latest version of VX2. Download L2mfix from one of these two locations:
http://www.atribune....oads/l2mfix.exe
http://www.downloads....org/l2mfix.exe
Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.
IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!
Kc
Please rerun L2mfix again.
You have the latest version of VX2. Download L2mfix from one of these two locations:
http://www.atribune....oads/l2mfix.exe
http://www.downloads....org/l2mfix.exe
Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.
IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!
Kc
#22
Posted 14 March 2005 - 06:38 PM
Kristy
- Topic Starter
-
- Member
-
- 1,099 posts
Visiting Consultant
L2MFIX find log 1.02b
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
"Asynchronous"=dword:00000000
"DllName"=""
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ShellScrap]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\enpul1791.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
**********************************************************************************
useragent:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{72CB40DA-E600-5CE5-7F8F-06B3246FF720}"=""
**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"="AVG7 Shell Extension"
"{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}"="AVG7 Find Extension"
"{63542C48-9552-494A-84F7-73AA6A7C99C1}"="OpenOffice Property Sheet Handler"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Office Outlook Custom Icon Handler"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
"{44C95C93-CFD0-4589-98FD-D13635A00880}"=""
"{5BDF1BDF-9C58-43A1-849A-E3D43190AAE8}"=""
**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{44C95C93-CFD0-4589-98FD-D13635A00880}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{44C95C93-CFD0-4589-98FD-D13635A00880}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{44C95C93-CFD0-4589-98FD-D13635A00880}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{44C95C93-CFD0-4589-98FD-D13635A00880}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{5BDF1BDF-9C58-43A1-849A-E3D43190AAE8}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{5BDF1BDF-9C58-43A1-849A-E3D43190AAE8}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{5BDF1BDF-9C58-43A1-849A-E3D43190AAE8}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{5BDF1BDF-9C58-43A1-849A-E3D43190AAE8}\InprocServer32]
@="C:\\WINDOWS\\system32\\bndispl.dll"
"ThreadingModel"="Apartment"
**********************************************************************************
Files Found are not all bad files:
Directory Listing of system files:
Volume in drive C is rajuke2
Volume Serial Number is 0017-F17B
Directory of C:\WINDOWS\System32
03/14/2005 04:31 PM 233,209 bndispl.dll
03/13/2005 09:41 PM 234,698 irrol5931.dll
03/13/2005 09:37 PM 233,209 enpul1791.dll
03/13/2005 04:45 PM 236,063 ir6ol5j31.dll
03/13/2005 03:33 PM 233,184 en2ul1f91.dll
03/13/2005 03:22 PM 233,097 mpimg32.dll
03/13/2005 12:18 PM 235,948 WRDMPS.dll
03/13/2005 11:38 AM 236,297 ihircl.dll
03/13/2005 11:36 AM 235,062 wvnetmgr.dll
03/13/2005 11:34 AM 233,977 pbintui.dll
03/13/2005 10:18 AM 233,147 dt32gt.dll
03/13/2005 10:09 AM 233,841 r4r60e9seh.dll
03/13/2005 10:03 AM <DIR> dllcache
03/13/2005 09:58 AM 234,878 dyound3d.dll
03/13/2005 09:52 AM 233,187 kldes.dll
03/13/2005 09:49 AM 235,077 uqbui.dll
03/13/2005 09:35 AM 235,566 odethk32.dll
03/12/2005 06:15 PM 235,077 khdir.dll
03/11/2005 05:59 PM 234,688 enlql1351.dll
03/11/2005 09:05 AM 233,157 wserrenu.dll
03/11/2005 08:05 AM 233,157 rzched32.dll
03/10/2005 06:02 PM 234,668 enjql1151.dll
03/10/2005 05:59 PM 232,622 jlbexec.dll
03/10/2005 05:13 PM 232,685 kidfc.dll
03/09/2005 05:00 PM 233,599 dbnhupnp.dll
03/08/2005 05:52 PM 235,530 mvvidctl.dll
03/08/2005 05:39 PM 233,030 nfmkcert.dll
03/08/2005 05:33 PM 232,736 dqcprop2.dll
01/13/2005 02:26 PM <DIR> Microsoft
27 File(s) 6,321,389 bytes
2 Dir(s) 24,024,276,992 bytes free
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
"Asynchronous"=dword:00000000
"DllName"=""
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ShellScrap]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\enpul1791.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
**********************************************************************************
useragent:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{72CB40DA-E600-5CE5-7F8F-06B3246FF720}"=""
**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"="AVG7 Shell Extension"
"{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}"="AVG7 Find Extension"
"{63542C48-9552-494A-84F7-73AA6A7C99C1}"="OpenOffice Property Sheet Handler"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Office Outlook Custom Icon Handler"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
"{44C95C93-CFD0-4589-98FD-D13635A00880}"=""
"{5BDF1BDF-9C58-43A1-849A-E3D43190AAE8}"=""
**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{44C95C93-CFD0-4589-98FD-D13635A00880}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{44C95C93-CFD0-4589-98FD-D13635A00880}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{44C95C93-CFD0-4589-98FD-D13635A00880}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{44C95C93-CFD0-4589-98FD-D13635A00880}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{5BDF1BDF-9C58-43A1-849A-E3D43190AAE8}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{5BDF1BDF-9C58-43A1-849A-E3D43190AAE8}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{5BDF1BDF-9C58-43A1-849A-E3D43190AAE8}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{5BDF1BDF-9C58-43A1-849A-E3D43190AAE8}\InprocServer32]
@="C:\\WINDOWS\\system32\\bndispl.dll"
"ThreadingModel"="Apartment"
**********************************************************************************
Files Found are not all bad files:
Directory Listing of system files:
Volume in drive C is rajuke2
Volume Serial Number is 0017-F17B
Directory of C:\WINDOWS\System32
03/14/2005 04:31 PM 233,209 bndispl.dll
03/13/2005 09:41 PM 234,698 irrol5931.dll
03/13/2005 09:37 PM 233,209 enpul1791.dll
03/13/2005 04:45 PM 236,063 ir6ol5j31.dll
03/13/2005 03:33 PM 233,184 en2ul1f91.dll
03/13/2005 03:22 PM 233,097 mpimg32.dll
03/13/2005 12:18 PM 235,948 WRDMPS.dll
03/13/2005 11:38 AM 236,297 ihircl.dll
03/13/2005 11:36 AM 235,062 wvnetmgr.dll
03/13/2005 11:34 AM 233,977 pbintui.dll
03/13/2005 10:18 AM 233,147 dt32gt.dll
03/13/2005 10:09 AM 233,841 r4r60e9seh.dll
03/13/2005 10:03 AM <DIR> dllcache
03/13/2005 09:58 AM 234,878 dyound3d.dll
03/13/2005 09:52 AM 233,187 kldes.dll
03/13/2005 09:49 AM 235,077 uqbui.dll
03/13/2005 09:35 AM 235,566 odethk32.dll
03/12/2005 06:15 PM 235,077 khdir.dll
03/11/2005 05:59 PM 234,688 enlql1351.dll
03/11/2005 09:05 AM 233,157 wserrenu.dll
03/11/2005 08:05 AM 233,157 rzched32.dll
03/10/2005 06:02 PM 234,668 enjql1151.dll
03/10/2005 05:59 PM 232,622 jlbexec.dll
03/10/2005 05:13 PM 232,685 kidfc.dll
03/09/2005 05:00 PM 233,599 dbnhupnp.dll
03/08/2005 05:52 PM 235,530 mvvidctl.dll
03/08/2005 05:39 PM 233,030 nfmkcert.dll
03/08/2005 05:33 PM 232,736 dqcprop2.dll
01/13/2005 02:26 PM <DIR> Microsoft
27 File(s) 6,321,389 bytes
2 Dir(s) 24,024,276,992 bytes free
#23
Guest_thatman_*
Posted 14 March 2005 - 07:27 PM
Guest_thatman_*
Guest_thatman_*
-
- Guest
Hi Rustymilo
Close any programs you have open since this step requires a reboot.
From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.
IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!
Kc
Close any programs you have open since this step requires a reboot.
From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.
IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!
Kc
#24
Posted 14 March 2005 - 07:55 PM
Kristy
- Topic Starter
-
- Member
-
- 1,099 posts
Visiting Consultant
L2Mfix 1.02b
Running From:
C:\Documents and Settings\kristy\Desktop\l2mfix
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Setting registry permissions:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Denying C access for really "Everyone"
- adding new ACCESS DENY entry
Registry Permissions set too:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- Everyone
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Setting up for Reboot
Starting Reboot!
C:\Documents and Settings\kristy\Desktop\l2mfix
System Rebooted!
Running From:
C:\Documents and Settings\kristy\Desktop\l2mfix
killing explorer and rundll32.exe
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 2032 'explorer.exe'
Killing PID 2032 'explorer.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 1740 'rundll32.exe'
Scanning First Pass. Please Wait!
First Pass Completed
Second Pass Scanning
Second pass Completed!
Zipping up files for submission:
updating: clear.reg (164 bytes security) (deflated 37%)
updating: echo.reg (164 bytes security) (deflated 9%)
updating: direct.txt (164 bytes security) (stored 0%)
updating: lo2.txt (164 bytes security) (deflated 74%)
updating: readme.txt (164 bytes security) (deflated 49%)
updating: report.txt (164 bytes security) (deflated 62%)
updating: test.txt (164 bytes security) (deflated 81%)
updating: test2.txt (164 bytes security) (deflated 18%)
updating: test3.txt (164 bytes security) (deflated 18%)
updating: test5.txt (164 bytes security) (deflated 18%)
adding: log.txt (164 bytes security) (deflated 80%)
updating: backregs/04056DB3-598A-4658-BFBC-716DDB799259.reg (164 bytes security) (deflated 70%)
updating: backregs/047EF261-3447-4280-B9F3-C29C7091D247.reg (164 bytes security) (deflated 70%)
updating: backregs/shell.reg (164 bytes security) (deflated 74%)
adding: backregs/44C95C93-CFD0-4589-98FD-D13635A00880.reg (164 bytes security) (deflated 70%)
adding: backregs/5BDF1BDF-9C58-43A1-849A-E3D43190AAE8.reg (164 bytes security) (deflated 70%)
Restoring Registry Permissions:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Revoking access for really "Everyone"
Warning (option /rge) - There is no ACE to remove!
Registry permissions set too:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrators ... successful
The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
"Asynchronous"=dword:00000000
"DllName"=""
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ShellCompatibility]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\d20m0cd1ef0.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
The following are the files found:
****************************************************************************
Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{44C95C93-CFD0-4589-98FD-D13635A00880}"=-
"{5BDF1BDF-9C58-43A1-849A-E3D43190AAE8}"=-
[-HKEY_CLASSES_ROOT\CLSID\{44C95C93-CFD0-4589-98FD-D13635A00880}]
[-HKEY_CLASSES_ROOT\CLSID\{5BDF1BDF-9C58-43A1-849A-E3D43190AAE8}]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************
Logfile of HijackThis v1.99.1
Scan saved at 5:53:24 PM, on 3/14/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Media Pass\MediaPass.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Media Pass\MediaPassK.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\kristy\Desktop\HijackThis.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimt.../aimtoolbar.jsp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R3 - Default URLSearchHook is missing
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [Media Pass] C:\Program Files\Media Pass\MediaPass.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: ShellCompatibility - C:\WINDOWS\system32\d20m0cd1ef0.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
Running From:
C:\Documents and Settings\kristy\Desktop\l2mfix
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Setting registry permissions:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Denying C access for really "Everyone"
- adding new ACCESS DENY entry
Registry Permissions set too:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- Everyone
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Setting up for Reboot
Starting Reboot!
C:\Documents and Settings\kristy\Desktop\l2mfix
System Rebooted!
Running From:
C:\Documents and Settings\kristy\Desktop\l2mfix
killing explorer and rundll32.exe
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 2032 'explorer.exe'
Killing PID 2032 'explorer.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 1740 'rundll32.exe'
Scanning First Pass. Please Wait!
First Pass Completed
Second Pass Scanning
Second pass Completed!
Zipping up files for submission:
updating: clear.reg (164 bytes security) (deflated 37%)
updating: echo.reg (164 bytes security) (deflated 9%)
updating: direct.txt (164 bytes security) (stored 0%)
updating: lo2.txt (164 bytes security) (deflated 74%)
updating: readme.txt (164 bytes security) (deflated 49%)
updating: report.txt (164 bytes security) (deflated 62%)
updating: test.txt (164 bytes security) (deflated 81%)
updating: test2.txt (164 bytes security) (deflated 18%)
updating: test3.txt (164 bytes security) (deflated 18%)
updating: test5.txt (164 bytes security) (deflated 18%)
adding: log.txt (164 bytes security) (deflated 80%)
updating: backregs/04056DB3-598A-4658-BFBC-716DDB799259.reg (164 bytes security) (deflated 70%)
updating: backregs/047EF261-3447-4280-B9F3-C29C7091D247.reg (164 bytes security) (deflated 70%)
updating: backregs/shell.reg (164 bytes security) (deflated 74%)
adding: backregs/44C95C93-CFD0-4589-98FD-D13635A00880.reg (164 bytes security) (deflated 70%)
adding: backregs/5BDF1BDF-9C58-43A1-849A-E3D43190AAE8.reg (164 bytes security) (deflated 70%)
Restoring Registry Permissions:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Revoking access for really "Everyone"
Warning (option /rge) - There is no ACE to remove!
Registry permissions set too:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrators ... successful
The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
"Asynchronous"=dword:00000000
"DllName"=""
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ShellCompatibility]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\d20m0cd1ef0.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
The following are the files found:
****************************************************************************
Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{44C95C93-CFD0-4589-98FD-D13635A00880}"=-
"{5BDF1BDF-9C58-43A1-849A-E3D43190AAE8}"=-
[-HKEY_CLASSES_ROOT\CLSID\{44C95C93-CFD0-4589-98FD-D13635A00880}]
[-HKEY_CLASSES_ROOT\CLSID\{5BDF1BDF-9C58-43A1-849A-E3D43190AAE8}]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************
Logfile of HijackThis v1.99.1
Scan saved at 5:53:24 PM, on 3/14/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Media Pass\MediaPass.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Media Pass\MediaPassK.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\kristy\Desktop\HijackThis.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimt.../aimtoolbar.jsp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R3 - Default URLSearchHook is missing
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [Media Pass] C:\Program Files\Media Pass\MediaPass.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: ShellCompatibility - C:\WINDOWS\system32\d20m0cd1ef0.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
#25
Guest_thatman_*
Posted 14 March 2005 - 08:05 PM
Guest_thatman_*
Guest_thatman_*
-
- Guest
Hi Rustymilo
Welcome to the forums!
Please set your system to show all files; please see here if you're unsure how to do this.
Close all programs leaving only HijackThis running. Place a check against each of the following, making sure you get them all and not any others by mistake:
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O20 - Winlogon Notify: ShellCompatibility - C:\WINDOWS\system32\d20m0cd1ef0.dll
Click on Fix Checked when finished and exit HijackThis.
Reboot into Safe Mode: please see here if you are not sure how to do this.
Using Windows Explorer, locate the following files/folders, and delete them:
C:\WINDOWS\isrvs\desktop.exe
C:\WINDOWS\isrvs\ffisearch.exe
C:\WINDOWS\system32\d20m0cd1ef0.dll
Exit Explorer, and reboot as normal afterwards.
Please run the following free, online virus scans.
http://housecall.tre.../start_corp.asp
http://www.pandasoft...n_principal.htm
Please post the logs From both virus scans and HJT.log we will need them to remove previous infections that have left files on your system.
Kc
Welcome to the forums!
Please set your system to show all files; please see here if you're unsure how to do this.
Close all programs leaving only HijackThis running. Place a check against each of the following, making sure you get them all and not any others by mistake:
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O20 - Winlogon Notify: ShellCompatibility - C:\WINDOWS\system32\d20m0cd1ef0.dll
Click on Fix Checked when finished and exit HijackThis.
Reboot into Safe Mode: please see here if you are not sure how to do this.
Using Windows Explorer, locate the following files/folders, and delete them:
C:\WINDOWS\isrvs\desktop.exe
C:\WINDOWS\isrvs\ffisearch.exe
C:\WINDOWS\system32\d20m0cd1ef0.dll
Exit Explorer, and reboot as normal afterwards.
Please run the following free, online virus scans.
http://housecall.tre.../start_corp.asp
http://www.pandasoft...n_principal.htm
Please post the logs From both virus scans and HJT.log we will need them to remove previous infections that have left files on your system.
Kc
#26
Posted 14 March 2005 - 08:58 PM
Kristy
- Topic Starter
-
- Member
-
- 1,099 posts
Visiting Consultant
I tried to find the three files/folders you listed after rebooting in safe mode, but could not find them. I remember seeing the first two when you asked me to delete them the first time. I deleted them then, and did not see it come back. I could not figure out how to run either of the online virus scans. The panda one said "ActiveScan requires the browser Microsoft Internet Explorer 5.0 or later version." And with housecall when I would click on the country I am in, and press go, and seemed like all the page did was refresh. However, this came up, and I'm wondering if maybe that was one of the scans, or maybe it was just an example of something.
Here is what came up:
PC Security Shield Virus Alert: JPEG-Exploit.Downloader.4098
# Also Known As
JPEG-Exploit/Downloader.4098[Ahnlab]
# Type
Trojan Horse
# Systems Affected
Win32
# Resident in System Memory
No
# Origin
Bulgaria
# Encryption
No
# Discovered on
09/23/2004
# How it spread
downloads
# Infection symptoms
Installs Trojan Horse
# Specific date of infections
None
# Destructivity/ Distribution Potential
** / ***
# ViRobot version able to detect/repair
Unable to detect/repair
[Run Latest Microsoft Patch]
Technical Description
Detailed Contents
It is an Trojan Horse which takes an advantage of MS04-028 GDI+ buffer overrun vulnerability and was found on Sept. 23, 2004.
Trojan Horse usually takes an advantage of vulnerability to execute random operation when JPEG file is opened. However Trojan Horse currently found has the symptom that downloads a file from a specified website.
The files downloaded from speciied website is not able to be seized but most of them are worms or malignant files.
Especially this vulnerability is changeable to be able to occur several symptoms, just only spam mail is read. Therefore you should be careful to read any specious file including JPEG before security patch is already patched.
Infection object system
- Trojan Horse currently found is normally exploited at Windows XP Service pack 1 (English version). Therefore in the rest of Windows systems except Windows XP1 Service pack1 (English version), no symptoms or errors occur and Troja Horse infection symptoms aren't executed although the JPEG file constains a vulnerability code is opened.
I ran HijackThis again, so here it is:
Logfile of HijackThis v1.99.1
Scan saved at 6:58:28 PM, on 3/14/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Media Pass\MediaPass.exe
C:\Program Files\AIM\aim.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Media Pass\MediaPassK.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZENG10.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\kristy\Desktop\HijackThis.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimt.../aimtoolbar.jsp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R3 - Default URLSearchHook is missing
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [Media Pass] C:\Program Files\Media Pass\MediaPass.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: MS-DOS Emulation - C:\WINDOWS\system32\en4ul1h91.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
Here is what came up:
PC Security Shield Virus Alert: JPEG-Exploit.Downloader.4098
# Also Known As
JPEG-Exploit/Downloader.4098[Ahnlab]
# Type
Trojan Horse
# Systems Affected
Win32
# Resident in System Memory
No
# Origin
Bulgaria
# Encryption
No
# Discovered on
09/23/2004
# How it spread
downloads
# Infection symptoms
Installs Trojan Horse
# Specific date of infections
None
# Destructivity/ Distribution Potential
** / ***
# ViRobot version able to detect/repair
Unable to detect/repair
[Run Latest Microsoft Patch]
Technical Description
Detailed Contents
It is an Trojan Horse which takes an advantage of MS04-028 GDI+ buffer overrun vulnerability and was found on Sept. 23, 2004.
Trojan Horse usually takes an advantage of vulnerability to execute random operation when JPEG file is opened. However Trojan Horse currently found has the symptom that downloads a file from a specified website.
The files downloaded from speciied website is not able to be seized but most of them are worms or malignant files.
Especially this vulnerability is changeable to be able to occur several symptoms, just only spam mail is read. Therefore you should be careful to read any specious file including JPEG before security patch is already patched.
Infection object system
- Trojan Horse currently found is normally exploited at Windows XP Service pack 1 (English version). Therefore in the rest of Windows systems except Windows XP1 Service pack1 (English version), no symptoms or errors occur and Troja Horse infection symptoms aren't executed although the JPEG file constains a vulnerability code is opened.
I ran HijackThis again, so here it is:
Logfile of HijackThis v1.99.1
Scan saved at 6:58:28 PM, on 3/14/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Media Pass\MediaPass.exe
C:\Program Files\AIM\aim.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Media Pass\MediaPassK.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZENG10.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\kristy\Desktop\HijackThis.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimt.../aimtoolbar.jsp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R3 - Default URLSearchHook is missing
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [Media Pass] C:\Program Files\Media Pass\MediaPass.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: MS-DOS Emulation - C:\WINDOWS\system32\en4ul1h91.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
#27
Posted 14 March 2005 - 09:04 PM
Kristy
- Topic Starter
-
- Member
-
- 1,099 posts
Visiting Consultant
I tried Housecall again, and I got a similar response to Panda: Only Internet Explorer Browser is supported.
I'm one Mozilla Firefox now, do I just go to Internet Explorer to run those?
I'm one Mozilla Firefox now, do I just go to Internet Explorer to run those?
#28
Guest_thatman_*
Posted 14 March 2005 - 09:38 PM
Guest_thatman_*
Guest_thatman_*
-
- Guest
Hi Rustymilo
Yes use Internet Explorer
Kc
Yes use Internet Explorer
Kc
#29
Posted 15 March 2005 - 10:28 PM
Kristy
- Topic Starter
-
- Member
-
- 1,099 posts
Visiting Consultant
Did all of the scans. I tried housecall yesterday doing the complete scan, and since it was taking so long, i left for awhile, came back and it was done, had to leave for awhile again, and then came back to the computer noticing it had restarted itself. So I ran it again, doing only the virus scan. I also ran Panda, and ran HijackThis again. So here all of it is. First Housecall, then Panda, followed by hjt log.
Virus Scan 0 virus cleaned, 3 viruses deleted
Results:
We have detected 3 infected file(s) with 3 virus(es) on your computer: - 0 virus(es) passed, 0 virus(es) no action available
- 0 virus(es) cleaned, 0 virus(es) uncleanable
- 3 virus(es) deleted, 0 virus(es) undeletable
- 0 virus(es) not found, 0 virus(es) unaccessible
Detected File Associated Virus Name Action taken
G:\System Volume Information\_restore{4524B2DB-A949-411E-97AD-34B191763C4B}\RP74\A0010402.dll TROJ_QDOWN.L Deletion successful
G:\System Volume Information\_restore{4524B2DB-A949-411E-97AD-34B191763C4B}\RP74\A0010403.exe TROJ_MIDADDLE.A Deletion successful
G:\System Volume Information\_restore{4524B2DB-A949-411E-97AD-34B191763C4B}\RP74\A0010404.exe TROJ_REALTENS.G Deletion successful
Trojan/Worm Check 0 worm/Trojan horse deleted
What we checked:
Malicious activity by a Trojan horse program. Although a Trojan seems like a harmless program, it contains malicious code and once installed can cause damage to your computer.
Results:
We have detected 0 Trojan horse program(s) and worm(s) on your computer: - 0 worm(s)/Trojan(s) passed, 0 worm(s)/Trojan(s) no action available
- 0 Worm(s)/Trojan(s) deleted, 0 worm(s)/Trojan(s) undeletable
Incident Status Location
Adware:Adware/WUpd No disinfected C:\Program Files\Media Pass\MediaPass.exe
Adware:Adware/WUpd No disinfected C:\Program Files\Media Pass\MediaPassC.dll
Adware:Adware/WUpd No disinfected C:\Program Files\Media Pass\MediaPassK.exe
Adware:Adware/WUpd No disinfected C:\PROGRA~1\MEDIAP~1\MEDIAP~2.EXE
Adware:Adware/eZula No disinfected C:\WINDOWS\system32\ezPopStub.exe
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\CERES.DLL
Adware:Adware/PowerScan No disinfected Windows Registry
Adware:Adware/AdDestroyer No disinfected C:\WINDOWS\system32\SWRT??.dll
Adware:Adware/VirtualBouncer No disinfected C:\Program Files\VBouncer
Adware:Adware/IPInsight No disinfected C:\WINDOWS\inf\farmmext.inf
Adware:Adware/ISearch No disinfected Windows Registry
Adware:Adware/TopRebates No disinfected C:\DOCUME~1\kristy\LOCALS~1\Temp\webrebates.exe
Adware:Adware/WUpd No disinfected C:\WINDOWS\system32\ide21201.vxd
Spyware:Spyware/Virtumonde No disinfected C:\DOCUME~1\kristy\LOCALS~1\Temp\bw2.com
Spyware:Spyware/YourSiteBar No disinfected C:\Program Files\YourSiteBar
Spyware:Spyware/Here4search No disinfected Windows Registry
Adware:Adware/WUpd No disinfected C:\Documents and Settings\kristy\Local Settings\Temp\AdStatServInstPack.exe
Adware:Adware/ISearch No disinfected C:\Documents and Settings\kristy\Local Settings\Temp\B222131346\build2.exe
Adware:Adware/nCase No disinfected C:\Documents and Settings\kristy\Local Settings\Temp\Del136.tmp
Adware:Adware/TopRebates No disinfected C:\Documents and Settings\kristy\Local Settings\Temp\webrebates.exe
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\kristy\Local Settings\Temporary Internet Files\Content.IE5\CT6J0PEN\Installer[1].exe
Adware:Adware/TopRebates No disinfected C:\Documents and Settings\kristy\Local Settings\Temporary Internet Files\Content.IE5\CT6J0PEN\webrebates_usa[1].exe
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\kristy\Local Settings\Temporary Internet Files\Content.IE5\STAV05AF\AppWrap[2].exe
Spyware:Spyware/YourSiteBar No disinfected C:\Documents and Settings\kristy\Local Settings\Temporary Internet Files\Content.IE5\STAV05AF\ysb[1].dll
Spyware:Spyware/Virtumonde No disinfected C:\Documents and Settings\kristy\Local Settings\Temporary Internet Files\Content.IE5\WDU7W9YJ\TargetSoftSetup[1].exe
Adware:Adware/Minibug.A No disinfected C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll
Adware:Adware/WUpd No disinfected C:\Program Files\Media Pass\MediaPass.exe
Adware:Adware/WUpd No disinfected C:\Program Files\Media Pass\MediaPassC.dll
Adware:Adware/WUpd No disinfected C:\Program Files\Media Pass\MediaPassK.exe
Adware:Adware/ISearch No disinfected C:\Program Files\Mozilla Firefox\extensions\{2bafa858-4ff3-4207-822e-ef46d1b431de}\chrome\isearch.jar[isearch.js]
Adware:Adware/VirtualBouncer No disinfected C:\Program Files\VBouncer\VirtualBouncerUninstaller.EXE
Spyware:Spyware/YourSiteBar No disinfected C:\Program Files\YourSiteBar\ysb.dll
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\ceres.dll
Adware:Adware/ISearch No disinfected C:\WINDOWS\delprot.ini
Adware:Adware/Look2Me No disinfected C:\WINDOWS\iconu.exe
Adware:Adware/IPInsight No disinfected C:\WINDOWS\inf\farmmext.inf
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\inst\3p_1n.exe
Spyware:Spyware/CouponAge No disinfected C:\WINDOWS\system32\docore.dll
Spyware:Spyware/CouponAge No disinfected C:\WINDOWS\system32\dosync.dll
Adware:Adware/VirtualBouncer No disinfected C:\WINDOWS\system32\SWRT01.dll
Spyware:Spyware/Virtumonde No disinfected C:\WINDOWS\system32\TargetSoftSetup.exe
Adware:Adware/ISearch No disinfected C:\WINDOWS\Temp\B222131346\build2.exe
Adware:Adware/IPInsight No disinfected C:\WINDOWS\Temp\THI5FE6.tmp\farmmext.inf
Adware:Adware/IPInsight No disinfected C:\WINDOWS\Temp\THI5FE6.tmp\farmmext.ini
Adware:Adware/IEDriver No disinfected G:\windows\system\SearchBar.htm
Adware:Adware/IEDriver No disinfected G:\windows\system\ICWDIAL8.exe
Adware:Adware/PurityScan No disinfected G:\windows\system\ygl.dll
Adware:Adware/PurityScan No disinfected G:\windows\system\fvtapikd.exe
Adware:Adware/IEDriver No disinfected G:\windows\system\Searchx.htm
Adware:Adware/Envolo No disinfected G:\windows\system\auto_update_uninstall.exe
Adware:Adware/IEDriver No disinfected G:\windows\system\IESETUP7.exe
Adware:Adware/DelFinMedia No disinfected G:\windows\system\wsxsvc\wsxsvc.exe
Adware:Adware/DelFinMedia No disinfected G:\windows\system\wsxsvc\wsx.dll
Adware:Adware/DelFinMedia No disinfected G:\windows\system\wsxsvc\wsx.ocx
Adware:Adware/IEDriver No disinfected G:\windows\system\pinstaller.exe
Adware:Adware/DelFinMedia No disinfected G:\windows\system\vmss\vmss.exe
Adware:Adware/PurityScan No disinfected G:\windows\Profiles\comp\Application Data\oecm.exe
Adware:Adware/PurityScan No disinfected G:\windows\Profiles\comp\Application Data\tbar.exe
Adware:Adware/WebHancer No disinfected G:\windows\webhdll.dll
Adware:Adware/WebHancer No disinfected G:\windows\whagent.inf
Adware:Adware/WebHancer No disinfected G:\windows\whInstaller.exe
Adware:Adware/eZula No disinfected G:\windows\eZinstall.exe
Spyware:Spyware/BetterInet No disinfected G:\windows\bi.dll
Spyware:Spyware/New.net No disinfected G:\windows\NDNuninstall5_48.exe
Adware:Adware/nCase No disinfected G:\windows\iLookup\TTIL.exe
Spyware:Spyware/New.net No disinfected G:\windows\NDNuninstall6_10.exe
Spyware:Spyware/New.net No disinfected G:\windows\NDNuninstall5_64.exe
Spyware:Spyware/New.net No disinfected G:\windows\NDNuninstall6_22.exe
Adware:Adware/Midaddle No disinfected G:\windows\Watcher.exe
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3508.cab[A0725730.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3508.cab[A0725731.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3508.cab[A0725746.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3508.cab[A0725747.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3508.cab[A0725766.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3508.cab[A0725767.CPY]
Spyware:Spyware/BetterInet No disinfected G:\_restore\archive\fs3511.cab[A0726125.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3513.cab[A0726340.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3513.cab[A0726341.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3539.cab[A0737448.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3539.cab[A0737449.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3539.cab[A0737455.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3539.cab[A0737456.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3539.cab[A0737457.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3519.cab[A0730341.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3519.cab[A0730342.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3519.cab[A0730378.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3519.cab[A0730379.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3519.cab[A0730392.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3519.cab[A0730393.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3519.cab[A0730404.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3519.cab[A0730405.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3027.cab[A0659318.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3027.cab[A0659319.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3027.cab[A0659348.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3027.cab[A0659349.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3025.cab[A0659112.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3025.cab[A0659113.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3025.cab[A0659145.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3025.cab[A0659146.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3026.cab[A0659246.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3026.cab[A0659247.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3026.cab[A0659255.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3026.cab[A0659256.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3111.cab[A0660336.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3111.cab[A0660337.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3120.cab[A0662111.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3120.cab[A0662112.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3124.cab[A0663170.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3124.cab[A0663171.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3124.cab[A0663187.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3124.cab[A0663188.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3124.cab[A0663210.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3124.cab[A0663211.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3124.cab[A0663221.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3124.cab[A0663222.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3134.cab[A0667410.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3134.cab[A0667411.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3142.cab[A0671267.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3142.cab[A0671268.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3140.cab[A0670263.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3140.cab[A0670264.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3145.cab[A0672349.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3145.cab[A0672350.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3145.cab[A0672372.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3145.cab[A0672373.CPY]
Adware:Adware/StatBlaster No disinfected G:\_restore\archive\fs3136.cab[A0668304.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3136.cab[A0668324.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3136.cab[A0668325.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3136.cab[A0668332.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3136.cab[A0668333.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3136.cab[A0668341.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3136.cab[A0668342.CPY]
Adware:Adware/Minibug.A No disinfected G:\_restore\archive\fs3136.cab[A0668355.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3136.cab[A0668365.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3136.cab[A0668366.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3137.cab[A0668441.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3137.cab[A0668442.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3225.cab[A0673891.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3225.cab[A0673892.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3222.cab[A0673763.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3222.cab[A0673764.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3150.cab[A0673538.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3150.cab[A0673539.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3150.cab[A0673554.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3150.cab[A0673555.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3150.cab[A0673593.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3150.cab[A0673594.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3552.cab[A0740850.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3552.cab[A0740851.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3552.cab[A0740864.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3552.cab[A0740865.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3528.cab[A0734510.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3528.cab[A0734511.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3528.cab[A0734520.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3528.cab[A0734521.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3526.cab[A0734423.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3526.cab[A0734424.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3530.cab[A0735557.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3530.cab[A0735558.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3540.cab[A0737520.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3540.cab[A0737521.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3540.cab[A0737536.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3540.cab[A0737537.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3540.cab[A0737586.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3540.cab[A0737587.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3544.cab[A0738644.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3544.cab[A0738645.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3548.cab[A0739745.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3548.cab[A0739746.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3553.cab[A0740914.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3553.cab[A0740915.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3561.cab[A0743119.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3561.cab[A0743120.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3561.cab[A0743156.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3561.cab[A0743157.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3561.cab[A0743169.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3561.cab[A0743170.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3559.cab[A0743073.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3559.cab[A0743074.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3564.cab[A0743232.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3564.cab[A0743234.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3567.cab[A0744327.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3567.cab[A0744329.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3567.cab[A0744363.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3567.cab[A0744364.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3567.cab[A0744383.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3567.cab[A0744384.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3567.cab[A0744388.CPY]
Virus Scan 0 virus cleaned, 3 viruses deleted
Results:
We have detected 3 infected file(s) with 3 virus(es) on your computer: - 0 virus(es) passed, 0 virus(es) no action available
- 0 virus(es) cleaned, 0 virus(es) uncleanable
- 3 virus(es) deleted, 0 virus(es) undeletable
- 0 virus(es) not found, 0 virus(es) unaccessible
Detected File Associated Virus Name Action taken
G:\System Volume Information\_restore{4524B2DB-A949-411E-97AD-34B191763C4B}\RP74\A0010402.dll TROJ_QDOWN.L Deletion successful
G:\System Volume Information\_restore{4524B2DB-A949-411E-97AD-34B191763C4B}\RP74\A0010403.exe TROJ_MIDADDLE.A Deletion successful
G:\System Volume Information\_restore{4524B2DB-A949-411E-97AD-34B191763C4B}\RP74\A0010404.exe TROJ_REALTENS.G Deletion successful
Trojan/Worm Check 0 worm/Trojan horse deleted
What we checked:
Malicious activity by a Trojan horse program. Although a Trojan seems like a harmless program, it contains malicious code and once installed can cause damage to your computer.
Results:
We have detected 0 Trojan horse program(s) and worm(s) on your computer: - 0 worm(s)/Trojan(s) passed, 0 worm(s)/Trojan(s) no action available
- 0 Worm(s)/Trojan(s) deleted, 0 worm(s)/Trojan(s) undeletable
Incident Status Location
Adware:Adware/WUpd No disinfected C:\Program Files\Media Pass\MediaPass.exe
Adware:Adware/WUpd No disinfected C:\Program Files\Media Pass\MediaPassC.dll
Adware:Adware/WUpd No disinfected C:\Program Files\Media Pass\MediaPassK.exe
Adware:Adware/WUpd No disinfected C:\PROGRA~1\MEDIAP~1\MEDIAP~2.EXE
Adware:Adware/eZula No disinfected C:\WINDOWS\system32\ezPopStub.exe
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\CERES.DLL
Adware:Adware/PowerScan No disinfected Windows Registry
Adware:Adware/AdDestroyer No disinfected C:\WINDOWS\system32\SWRT??.dll
Adware:Adware/VirtualBouncer No disinfected C:\Program Files\VBouncer
Adware:Adware/IPInsight No disinfected C:\WINDOWS\inf\farmmext.inf
Adware:Adware/ISearch No disinfected Windows Registry
Adware:Adware/TopRebates No disinfected C:\DOCUME~1\kristy\LOCALS~1\Temp\webrebates.exe
Adware:Adware/WUpd No disinfected C:\WINDOWS\system32\ide21201.vxd
Spyware:Spyware/Virtumonde No disinfected C:\DOCUME~1\kristy\LOCALS~1\Temp\bw2.com
Spyware:Spyware/YourSiteBar No disinfected C:\Program Files\YourSiteBar
Spyware:Spyware/Here4search No disinfected Windows Registry
Adware:Adware/WUpd No disinfected C:\Documents and Settings\kristy\Local Settings\Temp\AdStatServInstPack.exe
Adware:Adware/ISearch No disinfected C:\Documents and Settings\kristy\Local Settings\Temp\B222131346\build2.exe
Adware:Adware/nCase No disinfected C:\Documents and Settings\kristy\Local Settings\Temp\Del136.tmp
Adware:Adware/TopRebates No disinfected C:\Documents and Settings\kristy\Local Settings\Temp\webrebates.exe
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\kristy\Local Settings\Temporary Internet Files\Content.IE5\CT6J0PEN\Installer[1].exe
Adware:Adware/TopRebates No disinfected C:\Documents and Settings\kristy\Local Settings\Temporary Internet Files\Content.IE5\CT6J0PEN\webrebates_usa[1].exe
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\kristy\Local Settings\Temporary Internet Files\Content.IE5\STAV05AF\AppWrap[2].exe
Spyware:Spyware/YourSiteBar No disinfected C:\Documents and Settings\kristy\Local Settings\Temporary Internet Files\Content.IE5\STAV05AF\ysb[1].dll
Spyware:Spyware/Virtumonde No disinfected C:\Documents and Settings\kristy\Local Settings\Temporary Internet Files\Content.IE5\WDU7W9YJ\TargetSoftSetup[1].exe
Adware:Adware/Minibug.A No disinfected C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll
Adware:Adware/WUpd No disinfected C:\Program Files\Media Pass\MediaPass.exe
Adware:Adware/WUpd No disinfected C:\Program Files\Media Pass\MediaPassC.dll
Adware:Adware/WUpd No disinfected C:\Program Files\Media Pass\MediaPassK.exe
Adware:Adware/ISearch No disinfected C:\Program Files\Mozilla Firefox\extensions\{2bafa858-4ff3-4207-822e-ef46d1b431de}\chrome\isearch.jar[isearch.js]
Adware:Adware/VirtualBouncer No disinfected C:\Program Files\VBouncer\VirtualBouncerUninstaller.EXE
Spyware:Spyware/YourSiteBar No disinfected C:\Program Files\YourSiteBar\ysb.dll
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\ceres.dll
Adware:Adware/ISearch No disinfected C:\WINDOWS\delprot.ini
Adware:Adware/Look2Me No disinfected C:\WINDOWS\iconu.exe
Adware:Adware/IPInsight No disinfected C:\WINDOWS\inf\farmmext.inf
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\inst\3p_1n.exe
Spyware:Spyware/CouponAge No disinfected C:\WINDOWS\system32\docore.dll
Spyware:Spyware/CouponAge No disinfected C:\WINDOWS\system32\dosync.dll
Adware:Adware/VirtualBouncer No disinfected C:\WINDOWS\system32\SWRT01.dll
Spyware:Spyware/Virtumonde No disinfected C:\WINDOWS\system32\TargetSoftSetup.exe
Adware:Adware/ISearch No disinfected C:\WINDOWS\Temp\B222131346\build2.exe
Adware:Adware/IPInsight No disinfected C:\WINDOWS\Temp\THI5FE6.tmp\farmmext.inf
Adware:Adware/IPInsight No disinfected C:\WINDOWS\Temp\THI5FE6.tmp\farmmext.ini
Adware:Adware/IEDriver No disinfected G:\windows\system\SearchBar.htm
Adware:Adware/IEDriver No disinfected G:\windows\system\ICWDIAL8.exe
Adware:Adware/PurityScan No disinfected G:\windows\system\ygl.dll
Adware:Adware/PurityScan No disinfected G:\windows\system\fvtapikd.exe
Adware:Adware/IEDriver No disinfected G:\windows\system\Searchx.htm
Adware:Adware/Envolo No disinfected G:\windows\system\auto_update_uninstall.exe
Adware:Adware/IEDriver No disinfected G:\windows\system\IESETUP7.exe
Adware:Adware/DelFinMedia No disinfected G:\windows\system\wsxsvc\wsxsvc.exe
Adware:Adware/DelFinMedia No disinfected G:\windows\system\wsxsvc\wsx.dll
Adware:Adware/DelFinMedia No disinfected G:\windows\system\wsxsvc\wsx.ocx
Adware:Adware/IEDriver No disinfected G:\windows\system\pinstaller.exe
Adware:Adware/DelFinMedia No disinfected G:\windows\system\vmss\vmss.exe
Adware:Adware/PurityScan No disinfected G:\windows\Profiles\comp\Application Data\oecm.exe
Adware:Adware/PurityScan No disinfected G:\windows\Profiles\comp\Application Data\tbar.exe
Adware:Adware/WebHancer No disinfected G:\windows\webhdll.dll
Adware:Adware/WebHancer No disinfected G:\windows\whagent.inf
Adware:Adware/WebHancer No disinfected G:\windows\whInstaller.exe
Adware:Adware/eZula No disinfected G:\windows\eZinstall.exe
Spyware:Spyware/BetterInet No disinfected G:\windows\bi.dll
Spyware:Spyware/New.net No disinfected G:\windows\NDNuninstall5_48.exe
Adware:Adware/nCase No disinfected G:\windows\iLookup\TTIL.exe
Spyware:Spyware/New.net No disinfected G:\windows\NDNuninstall6_10.exe
Spyware:Spyware/New.net No disinfected G:\windows\NDNuninstall5_64.exe
Spyware:Spyware/New.net No disinfected G:\windows\NDNuninstall6_22.exe
Adware:Adware/Midaddle No disinfected G:\windows\Watcher.exe
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3508.cab[A0725730.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3508.cab[A0725731.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3508.cab[A0725746.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3508.cab[A0725747.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3508.cab[A0725766.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3508.cab[A0725767.CPY]
Spyware:Spyware/BetterInet No disinfected G:\_restore\archive\fs3511.cab[A0726125.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3513.cab[A0726340.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3513.cab[A0726341.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3539.cab[A0737448.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3539.cab[A0737449.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3539.cab[A0737455.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3539.cab[A0737456.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3539.cab[A0737457.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3519.cab[A0730341.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3519.cab[A0730342.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3519.cab[A0730378.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3519.cab[A0730379.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3519.cab[A0730392.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3519.cab[A0730393.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3519.cab[A0730404.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3519.cab[A0730405.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3027.cab[A0659318.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3027.cab[A0659319.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3027.cab[A0659348.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3027.cab[A0659349.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3025.cab[A0659112.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3025.cab[A0659113.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3025.cab[A0659145.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3025.cab[A0659146.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3026.cab[A0659246.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3026.cab[A0659247.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3026.cab[A0659255.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3026.cab[A0659256.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3111.cab[A0660336.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3111.cab[A0660337.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3120.cab[A0662111.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3120.cab[A0662112.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3124.cab[A0663170.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3124.cab[A0663171.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3124.cab[A0663187.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3124.cab[A0663188.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3124.cab[A0663210.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3124.cab[A0663211.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3124.cab[A0663221.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3124.cab[A0663222.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3134.cab[A0667410.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3134.cab[A0667411.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3142.cab[A0671267.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3142.cab[A0671268.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3140.cab[A0670263.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3140.cab[A0670264.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3145.cab[A0672349.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3145.cab[A0672350.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3145.cab[A0672372.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3145.cab[A0672373.CPY]
Adware:Adware/StatBlaster No disinfected G:\_restore\archive\fs3136.cab[A0668304.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3136.cab[A0668324.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3136.cab[A0668325.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3136.cab[A0668332.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3136.cab[A0668333.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3136.cab[A0668341.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3136.cab[A0668342.CPY]
Adware:Adware/Minibug.A No disinfected G:\_restore\archive\fs3136.cab[A0668355.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3136.cab[A0668365.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3136.cab[A0668366.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3137.cab[A0668441.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3137.cab[A0668442.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3225.cab[A0673891.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3225.cab[A0673892.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3222.cab[A0673763.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3222.cab[A0673764.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3150.cab[A0673538.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3150.cab[A0673539.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3150.cab[A0673554.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3150.cab[A0673555.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3150.cab[A0673593.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3150.cab[A0673594.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3552.cab[A0740850.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3552.cab[A0740851.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3552.cab[A0740864.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3552.cab[A0740865.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3528.cab[A0734510.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3528.cab[A0734511.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3528.cab[A0734520.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3528.cab[A0734521.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3526.cab[A0734423.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3526.cab[A0734424.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3530.cab[A0735557.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3530.cab[A0735558.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3540.cab[A0737520.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3540.cab[A0737521.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3540.cab[A0737536.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3540.cab[A0737537.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3540.cab[A0737586.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3540.cab[A0737587.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3544.cab[A0738644.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3544.cab[A0738645.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3548.cab[A0739745.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3548.cab[A0739746.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3553.cab[A0740914.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3553.cab[A0740915.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3561.cab[A0743119.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3561.cab[A0743120.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3561.cab[A0743156.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3561.cab[A0743157.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3561.cab[A0743169.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3561.cab[A0743170.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3559.cab[A0743073.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3559.cab[A0743074.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3564.cab[A0743232.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3564.cab[A0743234.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3567.cab[A0744327.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3567.cab[A0744329.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3567.cab[A0744363.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3567.cab[A0744364.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3567.cab[A0744383.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3567.cab[A0744384.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3567.cab[A0744388.CPY]
#30
Posted 15 March 2005 - 10:36 PM
Kristy
- Topic Starter
-
- Member
-
- 1,099 posts
Visiting Consultant
Here is the rest of Activescan, it got cut off.
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3567.cab[A0744388.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3567.cab[A0744389.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3567.cab[A0744390.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3567.cab[A0744391.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3567.cab[A0744393.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3567.cab[A0744394.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3576.cab[A0747535.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3576.cab[A0747536.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3573.cab[A0746450.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3573.cab[A0746451.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3577.cab[A0748529.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3577.cab[A0748530.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3765.cab[A0749961.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3765.cab[A0749962.CPY]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3765.cab[A0749966.CPY][Webhdll.dll]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3765.cab[A0749966.CPY][WhAgent.exe]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3765.cab[A0749966.CPY][whAgent.inf]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3765.cab[A0749966.CPY][whiehlpr.dll]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3765.cab[A0749966.CPY][whInstaller.exe]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3765.cab[A0749966.CPY][WhSurvey.exe]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3586.cab[A0748822.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3586.cab[A0748823.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3581.cab[A0748620.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3581.cab[A0748630.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3581.cab[A0748676.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3581.cab[A0748677.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3581.cab[A0748684.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3581.cab[A0748685.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3581.cab[A0748686.CPY]
Adware:Adware/PurityScan No disinfected G:\_restore\archive\fs3581.cab[A0748695.CPY]
Adware:Adware/PurityScan No disinfected G:\_restore\archive\fs3581.cab[A0748696.CPY]
Adware:Adware/PurityScan No disinfected G:\_restore\archive\fs3524.cab[A0733346.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3524.cab[A0733374.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3524.cab[A0733375.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3524.cab[A0733398.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3524.cab[A0733399.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3557.cab[A0742004.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3557.cab[A0742005.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3556.cab[A0741007.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3556.cab[A0741009.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3556.cab[A0741016.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3556.cab[A0741017.CPY]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3762.cab[A0749834.CPY][Webhdll.dll]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3762.cab[A0749834.CPY][WhAgent.exe]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3762.cab[A0749834.CPY][whAgent.inf]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3762.cab[A0749834.CPY][whiehlpr.dll]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3762.cab[A0749834.CPY][whInstaller.exe]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3762.cab[A0749834.CPY][WhSurvey.exe]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3763.cab[A0749883.CPY]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3764.cab[W1624513.CPY]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3764.cab[W1624515.CPY]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3764.cab[W1624517.CPY]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3764.cab[W1624519.CPY]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3764.cab[W1624521.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3766.cab[A0750078.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3766.cab[A0750080.CPY]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3766.cab[A0750082.CPY][Webhdll.dll]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3766.cab[A0750082.CPY][WhAgent.exe]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3766.cab[A0750082.CPY][whAgent.inf]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3766.cab[A0750082.CPY][whiehlpr.dll]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3766.cab[A0750082.CPY][whInstaller.exe]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3766.cab[A0750082.CPY][WhSurvey.exe]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3766.cab[A0750084.CPY][Webhdll.dll]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3766.cab[A0750084.CPY][WhAgent.exe]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3766.cab[A0750084.CPY][whAgent.inf]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3766.cab[A0750084.CPY][whiehlpr.dll]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3766.cab[A0750084.CPY][whInstaller.exe]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3766.cab[A0750084.CPY][WhSurvey.exe]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3766.cab[A0750094.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3766.cab[A0750095.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3768.cab[A0751933.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3768.cab[A0751934.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3769.cab[A0752970.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3769.cab[A0752971.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3773.cab[A0755026.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3773.cab[A0755027.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3776.cab[A0755992.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3776.cab[A0755993.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3776.cab[A0756005.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3776.cab[A0756006.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3776.cab[A0756026.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3776.cab[A0756028.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3787.cab[A0758126.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3787.cab[A0758127.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3787.cab[A0758136.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3787.cab[A0758137.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3787.cab[A0758148.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3787.cab[A0758149.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3790.cab[W1635517.CPY]
Virus:Trj/Downloader.GK No disinfected G:\_restore\archive\fs3000.cab[A0654950.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3233.cab[A0675860.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3233.cab[A0675861.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3233.cab[A0675864.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3233.cab[A0675865.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3233.cab[A0675866.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3227.cab[A0674851.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3227.cab[A0674852.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3247.cab[A0679864.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3247.cab[A0679865.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3247.cab[A0679931.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3247.cab[A0679932.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3240.cab[A0677789.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3240.cab[A0677790.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3240.cab[A0677870.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3240.cab[A0677871.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3246.cab[A0679793.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3246.cab[A0679797.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3252.cab[A0680130.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3252.cab[A0680131.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3381.cab[A0682118.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3381.cab[A0682119.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3381.cab[A0682167.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3381.cab[A0682168.CPY]
Adware:Adware/MemoryWatcher No disinfected G:\_restore\archive\fs3381.cab[A0682169.CPY]
Adware:Adware/MemoryWatcher No disinfected G:\_restore\archive\fs3381.cab[A0682170.CPY]
Adware:Adware/MemoryWatcher No disinfected G:\_restore\archive\fs3381.cab[A0682174.CPY]
Adware:Adware/MemoryWatcher No disinfected G:\_restore\archive\fs3381.cab[A0682175.CPY]
Adware:Adware/MemoryWatcher No disinfected G:\_restore\archive\fs3381.cab[A0682176.CPY]
Adware:Adware/MemoryWatcher No disinfected G:\_restore\archive\fs3381.cab[A0682177.CPY]
Adware:Adware/MemoryWatcher No disinfected G:\_restore\archive\fs3381.cab[A0682178.CPY]
Adware:Adware/MemoryWatcher No disinfected G:\_restore\archive\fs3381.cab[A0682179.CPY]
Adware:Adware/MemoryWatcher No disinfected G:\_restore\archive\fs3381.cab[A0682180.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3385.cab[A0684280.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3385.cab[A0684281.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3385.cab[A0684285.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3385.cab[A0684287.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3385.cab[A0684291.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3385.cab[A0684317.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3385.cab[A0684318.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3390.cab[A0686418.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3390.cab[A0686419.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3390.cab[A0686524.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3390.cab[A0686527.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3391.cab[A0686639.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3391.cab[A0686640.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3401.cab[A0690476.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3401.cab[A0690479.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3399.cab[A0689496.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3399.cab[A0689498.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3408.cab[A0692628.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3408.cab[A0692629.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3418.cab[A0695643.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3418.cab[A0695644.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3402.cab[A0691522.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3402.cab[A0691523.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3427.cab[A0697870.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3427.cab[A0697871.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3427.cab[A0697881.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3427.cab[A0697882.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3427.cab[A0697883.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3421.cab[A0696850.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3421.cab[A0696851.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3421.cab[A0696859.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3421.cab[A0696860.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3421.cab[A0696908.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3421.cab[A0696909.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3421.cab[A0696915.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3421.cab[A0696916.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3421.cab[A0696917.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3416.cab[A0694647.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3416.cab[A0694649.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3419.cab[A0695782.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3419.cab[A0695783.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3419.cab[A0695792.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3419.cab[A0695793.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3425.cab[A0696951.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3425.cab[A0696952.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3437.cab[A0699930.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3437.cab[A0699931.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3398.cab[A0688492.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3398.cab[A0688493.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3398.cab[A0688542.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3398.cab[A0688543.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3435.cab[A0699074.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3435.cab[A0699075.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3448.cab[A0701912.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3448.cab[A0701913.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3448.cab[A0701919.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3448.cab[A0701920.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3448.cab[A0701921.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3439.cab[A0700049.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3439.cab[A0700050.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3457.cab[A0704921.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3457.cab[A0704922.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3457.cab[A0704927.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3457.cab[A0704934.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3457.cab[A0704937.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3457.cab[A0704938.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3457.cab[A0704939.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3457.cab[A0704976.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3457.cab[A0704977.CPY]
Adware:Adware/ExactSearch No disinfected G:\_restore\archive\fs3456.cab[W1565940.CPY]
Adware:Adware/ExactSearch No disinfected G:\_restore\archive\fs3456.cab[W1565941.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3452.cab[A0703862.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3567.cab[A0744388.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3567.cab[A0744389.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3567.cab[A0744390.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3567.cab[A0744391.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3567.cab[A0744393.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3567.cab[A0744394.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3576.cab[A0747535.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3576.cab[A0747536.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3573.cab[A0746450.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3573.cab[A0746451.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3577.cab[A0748529.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3577.cab[A0748530.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3765.cab[A0749961.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3765.cab[A0749962.CPY]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3765.cab[A0749966.CPY][Webhdll.dll]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3765.cab[A0749966.CPY][WhAgent.exe]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3765.cab[A0749966.CPY][whAgent.inf]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3765.cab[A0749966.CPY][whiehlpr.dll]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3765.cab[A0749966.CPY][whInstaller.exe]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3765.cab[A0749966.CPY][WhSurvey.exe]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3586.cab[A0748822.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3586.cab[A0748823.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3581.cab[A0748620.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3581.cab[A0748630.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3581.cab[A0748676.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3581.cab[A0748677.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3581.cab[A0748684.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3581.cab[A0748685.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3581.cab[A0748686.CPY]
Adware:Adware/PurityScan No disinfected G:\_restore\archive\fs3581.cab[A0748695.CPY]
Adware:Adware/PurityScan No disinfected G:\_restore\archive\fs3581.cab[A0748696.CPY]
Adware:Adware/PurityScan No disinfected G:\_restore\archive\fs3524.cab[A0733346.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3524.cab[A0733374.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3524.cab[A0733375.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3524.cab[A0733398.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3524.cab[A0733399.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3557.cab[A0742004.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3557.cab[A0742005.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3556.cab[A0741007.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3556.cab[A0741009.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3556.cab[A0741016.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3556.cab[A0741017.CPY]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3762.cab[A0749834.CPY][Webhdll.dll]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3762.cab[A0749834.CPY][WhAgent.exe]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3762.cab[A0749834.CPY][whAgent.inf]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3762.cab[A0749834.CPY][whiehlpr.dll]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3762.cab[A0749834.CPY][whInstaller.exe]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3762.cab[A0749834.CPY][WhSurvey.exe]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3763.cab[A0749883.CPY]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3764.cab[W1624513.CPY]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3764.cab[W1624515.CPY]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3764.cab[W1624517.CPY]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3764.cab[W1624519.CPY]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3764.cab[W1624521.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3766.cab[A0750078.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3766.cab[A0750080.CPY]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3766.cab[A0750082.CPY][Webhdll.dll]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3766.cab[A0750082.CPY][WhAgent.exe]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3766.cab[A0750082.CPY][whAgent.inf]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3766.cab[A0750082.CPY][whiehlpr.dll]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3766.cab[A0750082.CPY][whInstaller.exe]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3766.cab[A0750082.CPY][WhSurvey.exe]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3766.cab[A0750084.CPY][Webhdll.dll]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3766.cab[A0750084.CPY][WhAgent.exe]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3766.cab[A0750084.CPY][whAgent.inf]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3766.cab[A0750084.CPY][whiehlpr.dll]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3766.cab[A0750084.CPY][whInstaller.exe]
Adware:Adware/WebHancer No disinfected G:\_restore\archive\fs3766.cab[A0750084.CPY][WhSurvey.exe]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3766.cab[A0750094.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3766.cab[A0750095.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3768.cab[A0751933.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3768.cab[A0751934.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3769.cab[A0752970.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3769.cab[A0752971.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3773.cab[A0755026.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3773.cab[A0755027.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3776.cab[A0755992.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3776.cab[A0755993.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3776.cab[A0756005.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3776.cab[A0756006.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3776.cab[A0756026.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3776.cab[A0756028.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3787.cab[A0758126.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3787.cab[A0758127.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3787.cab[A0758136.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3787.cab[A0758137.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3787.cab[A0758148.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3787.cab[A0758149.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3790.cab[W1635517.CPY]
Virus:Trj/Downloader.GK No disinfected G:\_restore\archive\fs3000.cab[A0654950.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3233.cab[A0675860.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3233.cab[A0675861.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3233.cab[A0675864.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3233.cab[A0675865.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3233.cab[A0675866.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3227.cab[A0674851.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3227.cab[A0674852.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3247.cab[A0679864.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3247.cab[A0679865.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3247.cab[A0679931.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3247.cab[A0679932.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3240.cab[A0677789.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3240.cab[A0677790.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3240.cab[A0677870.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3240.cab[A0677871.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3246.cab[A0679793.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3246.cab[A0679797.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3252.cab[A0680130.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3252.cab[A0680131.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3381.cab[A0682118.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3381.cab[A0682119.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3381.cab[A0682167.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3381.cab[A0682168.CPY]
Adware:Adware/MemoryWatcher No disinfected G:\_restore\archive\fs3381.cab[A0682169.CPY]
Adware:Adware/MemoryWatcher No disinfected G:\_restore\archive\fs3381.cab[A0682170.CPY]
Adware:Adware/MemoryWatcher No disinfected G:\_restore\archive\fs3381.cab[A0682174.CPY]
Adware:Adware/MemoryWatcher No disinfected G:\_restore\archive\fs3381.cab[A0682175.CPY]
Adware:Adware/MemoryWatcher No disinfected G:\_restore\archive\fs3381.cab[A0682176.CPY]
Adware:Adware/MemoryWatcher No disinfected G:\_restore\archive\fs3381.cab[A0682177.CPY]
Adware:Adware/MemoryWatcher No disinfected G:\_restore\archive\fs3381.cab[A0682178.CPY]
Adware:Adware/MemoryWatcher No disinfected G:\_restore\archive\fs3381.cab[A0682179.CPY]
Adware:Adware/MemoryWatcher No disinfected G:\_restore\archive\fs3381.cab[A0682180.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3385.cab[A0684280.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3385.cab[A0684281.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3385.cab[A0684285.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3385.cab[A0684287.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3385.cab[A0684291.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3385.cab[A0684317.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3385.cab[A0684318.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3390.cab[A0686418.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3390.cab[A0686419.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3390.cab[A0686524.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3390.cab[A0686527.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3391.cab[A0686639.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3391.cab[A0686640.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3401.cab[A0690476.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3401.cab[A0690479.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3399.cab[A0689496.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3399.cab[A0689498.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3408.cab[A0692628.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3408.cab[A0692629.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3418.cab[A0695643.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3418.cab[A0695644.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3402.cab[A0691522.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3402.cab[A0691523.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3427.cab[A0697870.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3427.cab[A0697871.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3427.cab[A0697881.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3427.cab[A0697882.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3427.cab[A0697883.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3421.cab[A0696850.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3421.cab[A0696851.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3421.cab[A0696859.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3421.cab[A0696860.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3421.cab[A0696908.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3421.cab[A0696909.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3421.cab[A0696915.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3421.cab[A0696916.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3421.cab[A0696917.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3416.cab[A0694647.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3416.cab[A0694649.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3419.cab[A0695782.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3419.cab[A0695783.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3419.cab[A0695792.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3419.cab[A0695793.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3425.cab[A0696951.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3425.cab[A0696952.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3437.cab[A0699930.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3437.cab[A0699931.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3398.cab[A0688492.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3398.cab[A0688493.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3398.cab[A0688542.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3398.cab[A0688543.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3435.cab[A0699074.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3435.cab[A0699075.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3448.cab[A0701912.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3448.cab[A0701913.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3448.cab[A0701919.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3448.cab[A0701920.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3448.cab[A0701921.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3439.cab[A0700049.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3439.cab[A0700050.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3457.cab[A0704921.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3457.cab[A0704922.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3457.cab[A0704927.CPY]
Adware:Adware/Apropos No disinfected G:\_restore\archive\fs3457.cab[A0704934.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3457.cab[A0704937.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3457.cab[A0704938.CPY]
Adware:Adware/IEDriver No disinfected G:\_restore\archive\fs3457.cab[A0704939.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3457.cab[A0704976.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3457.cab[A0704977.CPY]
Adware:Adware/ExactSearch No disinfected G:\_restore\archive\fs3456.cab[W1565940.CPY]
Adware:Adware/ExactSearch No disinfected G:\_restore\archive\fs3456.cab[W1565941.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3452.cab[A0703862.CPY]
Spyware:Spyware/ClearSearch No disinfected G:\_restore\archive\fs3
Similar Topics
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users
As Featured On:
Sign In
Create Account
