[Cthulhu111]

Please help.

I got an error this morning about a missing ssttq.exe file. That was unfamiliar to me, and after a little research, it seemed to connect it to Virtumonde. I tried one removal tool, and it didn't find anything. I followed some other removal steps I've found, and things went south from there. Vfixundo.exe did find a few files, and removed them. Spybot found a single file and took care of that. However, at this point, when I log into Windows XP normally, I can no longer connect to the Internet via Firefox. However, I can connect when I run Windows in Safe Mode w/ networking. I can get AVG Free and ZoneAlarm to install, but after rebooting, they stopped running. AVG seems to be working again, but I don't know for how long. Also, when eventually, my Internet connectivity craps out in Safe Mode, but is apparently restored after rebooting back into Safe Mode.

Here is my latest Hijack This log:

Logfile of HijackThis v1.99.1
Scan saved at 8:31:05 PM, on 12/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
C:\Program Files\Intel\Intel® Active Monitor\imonnt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\TDK\TDKLauncher\TDKLauncher.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\Adobe\Acrobat Reader 5\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {68FBD501-1A3F-4996-8F17-CBD00C2B493C} - C:\WINDOWS\system32\ssttq.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O2 - BHO: (no name) - {CA4F0D8D-5F2B-4F16-838A-8D52249EAB21} - C:\WINDOWS\system32\awtsqnn.dll (file missing)
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - Startup: TDK Launcher.lnk = C:\Program Files\TDK\TDKLauncher\TDKLauncher.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.net\PartyPokerNet\RunPF.exe
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.net\PartyPokerNet\RunPF.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: awtsqnn - awtsqnn.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intel® Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel® Active Monitor\imonnt.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe

Any help would be appreciated.

[Advertisements]

Hello

1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
O2 - BHO: (no name) - {68FBD501-1A3F-4996-8F17-CBD00C2B493C} - C:\WINDOWS\system32\ssttq.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O2 - BHO: (no name) - {CA4F0D8D-5F2B-4F16-838A-8D52249EAB21} - C:\WINDOWS\system32\awtsqnn.dll (file missing)
O20 - Winlogon Notify: awtsqnn - awtsqnn.dll (file missing)

2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.



Please download Deckard's System Scanner (DSS) and save it to your Desktop.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
• When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

[Rorschach112]

Hello

1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
O2 - BHO: (no name) - {68FBD501-1A3F-4996-8F17-CBD00C2B493C} - C:\WINDOWS\system32\ssttq.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O2 - BHO: (no name) - {CA4F0D8D-5F2B-4F16-838A-8D52249EAB21} - C:\WINDOWS\system32\awtsqnn.dll (file missing)
O20 - Winlogon Notify: awtsqnn - awtsqnn.dll (file missing)

2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.



Please download Deckard's System Scanner (DSS) and save it to your Desktop.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
• When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

[Cthulhu111]

Thanks for your reply! I'm at work now, so I'm unable to run HJT and DSS until I get home several hours from now. I will post the logs as soon as I get them.

Thanks again!

[Cthulhu111]

DSS logs:

Main.txt:
Deckard's System Scanner v20071014.68
Run by J&L Torres on 2007-12-24 17:48:31
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
7: 2007-12-24 22:48:36 UTC - RP7 - Deckard's System Scanner Restore Point
6: 2007-12-24 14:34:09 UTC - RP6 - Software Distribution Service 3.0
5: 2007-12-24 00:21:10 UTC - RP5 - Installed AVG 7.5
4: 2007-12-23 22:48:58 UTC - RP4 - Installed AVG 7.5
3: 2007-12-23 19:42:04 UTC - RP3 - Removed AVG 7.5


-- First Restore Point --
1: 2007-12-23 16:11:06 UTC - RP1 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 511 MiB (512 MiB recommended).


-- HijackThis (run as J&L Torres.exe) ------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 5:49:55 PM, on 12/24/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
C:\Program Files\Intel\Intel® Active Monitor\imonnt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\TDK\TDKLauncher\TDKLauncher.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\J&L Torres\Desktop\dss.exe
C:\PROGRA~1\HIJACK~2\J&L Torres.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\Adobe\Acrobat Reader 5\Acrobat\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - Startup: TDK Launcher.lnk = C:\Program Files\TDK\TDKLauncher\TDKLauncher.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.net\PartyPokerNet\RunPF.exe
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.net\PartyPokerNet\RunPF.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intel® Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel® Active Monitor\imonnt.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe


-- HijackThis Fixed Entries (C:\PROGRA~1\HIJACK~2\backups\) --------------------

backup-20071223-161940-466 O16 - DPF: {410A8B3C-7CCB-40E8-8B11-28B099E5C488} (Trend Micro Security Services Control) - http://tmss.trendmic...TMSSReportW.CAB
backup-20071223-161940-683 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) -
backup-20071223-161940-897 O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
backup-20071223-161941-527 O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_02) -
backup-20071223-161941-756 O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) -
backup-20071223-161941-880 O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} -
backup-20071224-174755-183 O20 - Winlogon Notify: awtsqnn - awtsqnn.dll (file missing)
backup-20071224-174755-194 O2 - BHO: (no name) - {68FBD501-1A3F-4996-8F17-CBD00C2B493C} - C:\WINDOWS\system32\ssttq.dll (file missing)
backup-20071224-174755-368 O2 - BHO: (no name) - {CA4F0D8D-5F2B-4F16-838A-8D52249EAB21} - C:\WINDOWS\system32\awtsqnn.dll (file missing)
backup-20071224-174755-463 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
backup-20071224-174755-973 O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)

-- File Associations -----------------------------------------------------------

.js - JSFile - DefaultIcon - C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe,2
.js - JSFile - shell\open\command - "C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe" "%1"


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R0 iomdisk (Iomega Devices Disk Filter Services) - c:\windows\system32\drivers\iomdisk.sys <Not Verified; Iomega Corporation; Microsoft® Windows NT® Operating System>
R1 DCxxMJPG (Pinnacle DC10plus, Motion-JPEG VideoIO Board) - c:\windows\system32\drivers\dcxxmjpg.sys <Not Verified; Pinnacle Systems; Pinnacle Systems Studio DC10plus>
R2 dmsmbios - c:\windows\system32\dmsmbios.sys <Not Verified; Intel Corporation; Intel® Active Monitor>
R2 iSMBIOS - c:\windows\system32\drivers\ismbios.sys <Not Verified; Intel Corporation; Intel® Active Monitor>
R2 SIODRV - c:\windows\system32\drivers\siodrv.sys <Not Verified; Intel Corporation; Intel® Active Monitor>
R3 pfc (PADUS ASPI SHELL) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus® ASPI Shell>
R3 smbusp (Intel® SMBus 2.0 Driver) - c:\windows\system32\drivers\smb.sys <Not Verified; Intel Corporation; Intel® SMBus Controller>

S3 catchme - c:\docume~1\j&ltor~1\locals~1\temp\catchme.sys (file missing)
S3 ENTECH - c:\windows\system32\drivers\entech.sys <Not Verified; EnTech Taiwan; PowerStrip>
S3 PalmUSBD - c:\windows\system32\drivers\palmusbd.sys (file missing)
S3 PCIDATA - e:\pcidata.sys (file missing)
S3 SQTECH905C (DualCamera) - c:\windows\system32\drivers\capt905c.sys <Not Verified; Service & Quality Technology.; SQ905c>
S3 TVICHW32 - c:\windows\system32\drivers\tvichw32.sys (file missing)


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 _IOMEGA_ACTIVE_DISK_SERVICE_ (Iomega Active Disk) - "c:\program files\iomega\autodisk\adservice.exe" <Not Verified; Iomega Corporation; Iomega Active Disk>
R2 imonNT (Intel® Active Monitor) - c:\program files\intel\intel® active monitor\imonnt.exe <Not Verified; Intel Corp.; Intel® Active Monitor>
R2 Iomega App Services - "c:\progra~1\iomega\system32\appservices.exe" <Not Verified; Iomega Corporation; Iomega App Services>
R2 RetroLauncher (Retrospect Launcher) - c:\progra~1\dantz\retros~1\retrorun.exe <Not Verified; Dantz Development Corporation; Retrospect>

S4 Amtarru -
S4 Iomega Activity Disk2 - ""


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Scheduled Tasks -------------------------------------------------------------

2007-11-19 12:19:01 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job


-- Files created between 2007-11-24 and 2007-12-24 -----------------------------

2007-12-23 20:25:13 251392 --a------ C:\hijackthis_sfx.exe
2007-12-23 19:21:48 0 d-------- C:\Documents and Settings\J&L Torres\Application Data\AVG7
2007-12-23 19:21:31 0 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2007-12-23 19:21:11 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-23 19:05:10 0 d-------- C:\HiJack This
2007-12-23 19:01:07 0 d-------- C:\Documents and Settings\Administrator\Application Data\Mozilla
2007-12-23 17:55:14 0 d-------- C:\VundoFix Backups
2007-12-23 17:40:46 0 d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2007-12-23 16:52:44 0 d--hs---- C:\WINDOWS\CSC
2007-12-23 15:14:15 544800 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2007-12-23 15:09:05 0 d-------- C:\WINDOWS\system32\ZoneLabs
2007-12-23 13:45:09 90112 --a------ C:\WINDOWS\system32\RegDACL.exe <Not Verified; Frank Heyne Software; RegTools>
2007-12-23 13:45:09 4096 --a------ C:\WINDOWS\system32\reboot.exe
2007-12-23 13:45:09 53248 --a------ C:\WINDOWS\system32\process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2007-12-23 13:45:09 347 --a------ C:\run2.reg
2007-12-23 13:45:09 8925 --a------ C:\clean.bat
2007-12-23 13:44:18 0 d--h----- C:\WINDOWS\PIF
2007-12-23 08:36:17 348160 --a------ C:\WINDOWS\system32\hphmon04 .exe <Not Verified; Hewlett-Packard; hp photosmart>
2007-12-23 08:36:07 155648 --a------ C:\WINDOWS\system32\NeroCheck .exe <Not Verified; Ahead Software Gmbh; Ahead Software Gmbh NeroCheck>
2007-12-23 00:25:11 0 dr-h----- C:\Documents and Settings\J&L Torres\Recent
2007-12-15 06:50:54 0 d-------- C:\Documents and Settings\J&L Torres\Application Data\Snapfish
2007-11-24 08:52:04 0 d-------- C:\crayon


-- Find3M Report ---------------------------------------------------------------

2007-12-24 06:57:40 0 d-------- C:\Program Files\Mozilla Thunderbird
2007-12-23 20:27:01 0 d-------- C:\Program Files\Hijack This
2007-12-23 17:48:59 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-12-23 15:11:06 4212 --ah----- C:\WINDOWS\system32\zllictbl.dat
2007-12-23 14:29:46 0 d-------- C:\Program Files\Common Files
2007-12-23 14:24:50 0 d-------- C:\Program Files\Hewlett-Packard
2007-12-23 14:23:03 0 d-------- C:\Program Files\Microsoft ActiveSync
2007-12-23 14:22:48 0 d-------- C:\Program Files\The Learning Company
2007-12-23 12:52:18 0 d-------- C:\Program Files\QuickTime
2007-12-23 00:25:35 0 d-------- C:\Program Files\Steam
2007-12-22 01:16:15 0 d-------- C:\Documents and Settings\J&L Torres\Application Data\Adobe
2007-12-15 06:50:53 35821 --a------ C:\WINDOWS\mozver.dat
2007-11-15 12:55:52 0 d-------- C:\Documents and Settings\J&L Torres\Application Data\Roxio


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logitech Utility"="Logi_MwX.Exe" [11/08/2002 09:50 AM C:\WINDOWS\LOGI_MWX.EXE]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [12/23/2007 07:21 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" []

C:\Documents and Settings\J&L Torres\Start Menu\Programs\Startup\
TDK Launcher.lnk - C:\Program Files\TDK\TDKLauncher\TDKLauncher.exe [12/31/2003 11:07:30 AM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2/15/2003 12:00:28 AM]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
backup=C:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^CorelCENTRAL 10.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\CorelCENTRAL 10.lnk
backup=C:\WINDOWS\pss\CorelCENTRAL 10.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^CreataCard Gold 3 Forget Me Not Reminders Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\CreataCard Gold 3 Forget Me Not Reminders Tray Icon.lnk
backup=C:\WINDOWS\pss\CreataCard Gold 3 Forget Me Not Reminders Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Desktop Application Director 10.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Desktop Application Director 10.lnk
backup=C:\WINDOWS\pss\Desktop Application Director 10.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Event Planner Reminders Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Event Planner Reminders Tray Icon.lnk
backup=C:\WINDOWS\pss\Event Planner Reminders Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=C:\WINDOWS\pss\HP Image Zone Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^J&L Torres^Start Menu^Programs^Startup^Registration-Studio 8.lnk]
path=C:\Documents and Settings\J&L Torres\Start Menu\Programs\Startup\Registration-Studio 8.lnk
backup=C:\WINDOWS\pss\Registration-Studio 8.lnkStartup


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eac_cnry]
C:\DOCUME~1\J&LTOR~1\LOCALS~1\Temp\EACDownload\cnry.exe raven.veloz.com /pub/download/defscan_install.exe adteg -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ElbyCheckElbyCDFL]
"C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Internet Optimizer]
"C:\Program Files\Internet Optimizer\optimize.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
C:\WINDOWS\system32\ssttq.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
C:\Program Files\McAfee.com\Agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msbb]
C:\DOCUME~1\J&LTOR~1\LOCALS~1\Temp\msbb.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QdrModule11]
"C:\Program Files\QdrModule\QdrModule11.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QdrPack11]
"C:\Program Files\QdrPack\QdrPack11.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickFinder Scheduler]
"C:\Program Files\Corel\WordPerfect Office 2002\Programs\QFSCHD100.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioAudioCentral]
"C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
"C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RunDLL]
rundll32.exe "C:\WINDOWS\System32\bridge.dll",Load

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\runner1]
C:\WINDOWS\mrofinu72.exe 61A847B5BBF72815308B2B27128065E9C084320161C4661227A755E9C2933154389A

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\j2re1.4.2\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\systray]
C:\WINDOWS\System32\a.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VVSN]
C:\Program Files\VVSN\VVSN.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WeatherCast]
C:\PROGRA~1\WEATHE~1\Weather.exe /q

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSave]
C:\PROGRA~1\Save\Save.exe




-- End of Deckard's System Scanner: finished at 2007-12-24 17:50:47 ------------


Extra.txt:
Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: Intel® Pentium® 4 CPU 2.53GHz
Percentage of Memory in Use: 69%
Physical Memory (total/avail): 510.8 MiB / 155.44 MiB
Pagefile Memory (total/avail): 1248.17 MiB / 952.8 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1940.21 MiB

A: is Removable (No Media)
C: is Fixed (NTFS) - 76.32 GiB total, 35.06 GiB free.
D: is Removable (No Media)
E: is CDROM (No Media)
F: is CDROM (No Media)
G: is Removable (FAT32)

\\.\PHYSICALDRIVE1 - IOMEGA ZIP 100

\\.\PHYSICALDRIVE0 - Maxtor 6Y080P0 - 76.33 GiB - 1 partition
\PARTITION0 (bootable) - Installable File System - 76.32 GiB - C:

\\.\PHYSICALDRIVE2 - HP Photosmart 8200 USB Device - 478.5 MiB - 1 partition
\PARTITION0 - Unknown - 483.7 MiB - G:



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is disabled.

FW: ZoneAlarm Firewall v7.0.462.000 (Check Point, LTD.)
AV: AVG 7.5.503 v7.5.503 (Grisoft) Outdated

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\J&L Torres\Application Data
CLASSPATH=.;C:\Program Files\Java\jre1.5.0_10\lib\ext\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=CTHULHU
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\J&L Torres
LOGONSERVER=\\CTHULHU
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\Program Files\Common Files\Roxio Shared\DLLShared;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 2 Stepping 7, GenuineIntel
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=0207
ProgramFiles=C:\Program Files
PROMPT=$P$G
QTJAVA=C:\Program Files\Java\jre1.5.0_10\lib\ext\QTJava.zip
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\J&LTOR~1\LOCALS~1\Temp
TMP=C:\DOCUME~1\J&LTOR~1\LOCALS~1\Temp
tvdumpflags=8
USERDOMAIN=CTHULHU
USERNAME=J&L Torres
USERPROFILE=C:\Documents and Settings\J&L Torres
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

J&L Torres (admin)
Administrator (admin)


-- Add/Remove Programs ---------------------------------------------------------



-- Application Event Log -------------------------------------------------------

Event Record #/Type16593 / Warning
Event Submitted/Written: 12/24/2007 09:38:53 AM
Event ID/Source: 1020 / ASP.NET 2.0.50727.0
Event Description:
Updates to the IIS metabase were aborted because IIS is either not installed or is disabled on this machine. To configure ASP.NET to run in IIS, please install or enable IIS and re-register ASP.NET using aspnet_regiis.exe /i.

Event Record #/Type16579 / Error
Event Submitted/Written: 12/24/2007 06:53:39 AM
Event ID/Source: 1094 / Userenv
Event Description:
Windows could not set the security on Group Policy Events. (The operation completed successfully. ). Processing aborted.

Event Record #/Type16547 / Warning
Event Submitted/Written: 12/23/2007 07:07:24 PM
Event ID/Source: 1015 / MsiInstaller
Event Description:
Failed to connect to server. Error: 0x8007043C

Event Record #/Type16546 / Warning
Event Submitted/Written: 12/23/2007 07:07:20 PM
Event ID/Source: 1015 / MsiInstaller
Event Description:
Failed to connect to server. Error: 0x8007043C

Event Record #/Type16545 / Warning
Event Submitted/Written: 12/23/2007 07:07:17 PM
Event ID/Source: 1015 / MsiInstaller
Event Description:
Failed to connect to server. Error: 0x8007043C



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type99324 / Error
Event Submitted/Written: 12/24/2007 05:44:37 PM
Event ID/Source: 7000 / Service Control Manager
Event Description:
The Polaroid Digital Cam Video service failed to start due to the following error:
%%1058

Event Record #/Type99320 / Error
Event Submitted/Written: 12/24/2007 05:41:07 PM
Event ID/Source: 10005 / DCOM
Event Description:
DCOM got error "%%1084" attempting to start the service EventSystem with arguments ""
in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

Event Record #/Type99317 / Error
Event Submitted/Written: 12/24/2007 05:38:30 PM
Event ID/Source: 7026 / Service Control Manager
Event Description:
The following boot-start or system-start driver(s) failed to load:
Avg7Core
Avg7RsW
Avg7RsXP
cdudf_xp
DCxxMJPG
Fips
intelppm
KLIF

Event Record #/Type99316 / Error
Event Submitted/Written: 12/24/2007 05:37:17 PM
Event ID/Source: 10005 / DCOM
Event Description:
DCOM got error "%%1084" attempting to start the service EventSystem with arguments ""
in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

Event Record #/Type99252 / Error
Event Submitted/Written: 12/24/2007 09:32:05 AM
Event ID/Source: 7000 / Service Control Manager
Event Description:
The Polaroid Digital Cam Video service failed to start due to the following error:
%%1058



-- End of Deckard's System Scanner: finished at 2007-12-24 17:50:47 ------------

[Rorschach112]

Hello

Backup Your Registry with ERUNT

• Please use the following link and scroll down to ERUNT and download it.
  http://aumha.org/freeware/freeware.php
• For version with the Installer:
  Use the setup program to install ERUNT on your computer
• For the zipped version:
  Unzip all the files into a folder of your choice.

Click Erunt.exe to backup your registry to the folder of your choice.

Note: to restore your registry, go to the folder and start ERDNT.exe



Now we need to fix your problems by making a .reg file. Copy the code below into a Notepad file. Name the file as fix.reg, change the "Save as Type" to "All files" and save it on the desktop.

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eac_cnry]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Internet Optimizer]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msbb]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QdrModule11]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QdrPack11]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RunDLL]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\runner1]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\systray]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSave]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VVSN]

Then double click on the fix.reg file, when it prompts to merge click "Yes".



Please download OTMoveIt by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt.exe to run it.
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
  
  C:\DOCUME~1\J&LTOR~1\LOCALS~1\Temp\EACDownload\cnry.exe
  C:\Program Files\Internet Optimizer
  C:\WINDOWS\system32\ssttq.exe
  C:\DOCUME~1\J&LTOR~1\LOCALS~1\Temp\msbb.exe
  C:\Program Files\QdrModule
  C:\Program Files\QdrPack
  C:\WINDOWS\System32\bridge.dll
  C:\WINDOWS\mrofinu72.exe
  C:\WINDOWS\System32\a.exe
  C:\PROGRA~1\Save\Save.exe
  C:\Program Files\VVSN
  
  
• Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
• Click the red Moveit! button.
• Close OTMoveIt

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please "Copy" the results from the "Results" window (to the right) and then "Paste" them into your next reply on the forum.

Note : If a reboot was necessary or you needed to Exit before posting the log, you will find a copy of the log at the root of the drive where OTMoveIt is installed, usually at :
C:\_OTMoveIt\MovedFiles\********_******.log
(where "********_******" is the "date_time")

Click "Exit" to close OTMoveIt.




Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.


Reboot then send me a new DSS log

[Cthulhu111]

Run Erunt in Safe Mode or boot Windows normally?

[Cthulhu111]

Actually, I guess I need to know what mode I need to boot into for all these steps.

[Rorschach112]

Do these steps in Normal Mode.

I will let you know if any steps need to be done in Safe Mode

[Cthulhu111]

Okay...I can still only connect to the Internet from Safe Mode.

OTMoveIt Results:
File/Folder C:\DOCUME~1\J&LTOR~1\LOCALS~1\Temp\EACDownload\cnry.exe not found.
File/Folder C:\Program Files\Internet Optimizer not found.
File/Folder C:\WINDOWS\system32\ssttq.exe not found.
File/Folder C:\DOCUME~1\J&LTOR~1\LOCALS~1\Temp\msbb.exe not found.
File/Folder C:\Program Files\QdrModule not found.
File/Folder C:\Program Files\QdrPack not found.
File/Folder C:\WINDOWS\System32\bridge.dll not found.
File/Folder C:\WINDOWS\mrofinu72.exe not found.
File/Folder C:\WINDOWS\System32\a.exe not found.
File/Folder C:\PROGRA~1\Save\Save.exe not found.
File/Folder C:\Program Files\VVSN not found.

Created on 12/24/2007 19:07:47

New DSS Log...only main.txt got created this time:
Deckard's System Scanner v20071014.68
Run by J&L Torres on 2007-12-24 19:12:50
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Total Physical Memory: 511 MiB (512 MiB recommended).


-- HijackThis (run as J&L Torres.exe) ------------------------------------------

Unable to find log (file not found); running clone.
-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2007-12-24 19:12:54
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\Program Files\Iomega\System32\AppServices.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Dantz\Retrospect\retrorun.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
C:\Program Files\Intel\Intel® Active Monitor\imonNT.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Logitech\MouseWare\system\EM_EXEC.EXE
C:\Program Files\TDK\TDKLauncher\TDKLauncher.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\J&L Torres\Desktop\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat Reader 5\Acrobat\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: TDK Launcher.lnk = C:\Program Files\TDK\TDKLauncher\TDKLauncher.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.net\PartyPokerNet\RunPF.exe
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.net\PartyPokerNet\RunPF.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00000045-0000-0010-8000-00AA00389B71} () - http://codecs.micros.../i386/sg726.cab
O16 - DPF: {00000075-0000-0010-8000-00AA00389B71} () - http://codecs.micros...86/voxmsdec.CAB
O16 - DPF: {00000075-9980-0010-8000-00AA00389B71} () - http://codecs.micros...i386/voxacm.CAB
O16 - DPF: {33564D57-9980-0010-8000-00AA00389B71} () - http://codecs.micros...386/wmv9dmo.cab
O16 - DPF: {64697663-0000-0010-8000-00AA00389B71} () - http://codecs.micros...386/cinepak.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} () - http://v4.windowsupd...7875.1796990741
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSVCCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intel® Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel® Active Monitor\imonNT.exe
O23 - Service: Iomega Activity Disk2 - Unknown owner - C:\WINDOWS\system32
O23 - Service: Iomega App Services - Iomega Corporation - C:\Program Files\Iomega\System32\AppServices.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\retrorun.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe


--
End of file - 6523 bytes

-- Files created between 2007-11-24 and 2007-12-24 -----------------------------

2007-12-24 18:45:49 791393 --a------ C:\erunt-setup.exe <Not Verified; Lars Hederer; >
2007-12-23 20:25:13 251392 --a------ C:\hijackthis_sfx.exe
2007-12-23 19:21:48 0 d-------- C:\Documents and Settings\J&L Torres\Application Data\AVG7
2007-12-23 19:21:31 0 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2007-12-23 19:21:11 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-23 19:05:10 0 d-------- C:\HiJack This
2007-12-23 19:01:07 0 d-------- C:\Documents and Settings\Administrator\Application Data\Mozilla
2007-12-23 17:55:14 0 d-------- C:\VundoFix Backups
2007-12-23 17:40:46 0 d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2007-12-23 16:52:44 0 d--hs---- C:\WINDOWS\CSC
2007-12-23 15:14:15 561184 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2007-12-23 15:09:05 0 d-------- C:\WINDOWS\system32\ZoneLabs
2007-12-23 13:45:09 90112 --a------ C:\WINDOWS\system32\RegDACL.exe <Not Verified; Frank Heyne Software; RegTools>
2007-12-23 13:45:09 4096 --a------ C:\WINDOWS\system32\reboot.exe
2007-12-23 13:45:09 53248 --a------ C:\WINDOWS\system32\process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2007-12-23 13:45:09 347 --a------ C:\run2.reg
2007-12-23 13:45:09 8925 --a------ C:\clean.bat
2007-12-23 13:44:18 0 d--h----- C:\WINDOWS\PIF
2007-12-23 08:36:17 348160 --a------ C:\WINDOWS\system32\hphmon04 .exe <Not Verified; Hewlett-Packard; hp photosmart>
2007-12-23 08:36:07 155648 --a------ C:\WINDOWS\system32\NeroCheck .exe <Not Verified; Ahead Software Gmbh; Ahead Software Gmbh NeroCheck>
2007-12-23 00:25:11 0 dr-h----- C:\Documents and Settings\J&L Torres\Recent
2007-12-15 06:50:54 0 d-------- C:\Documents and Settings\J&L Torres\Application Data\Snapfish
2007-11-24 08:52:04 0 d-------- C:\crayon


-- Find3M Report ---------------------------------------------------------------

2007-12-24 06:57:40 0 d-------- C:\Program Files\Mozilla Thunderbird
2007-12-23 20:27:01 0 d-------- C:\Program Files\Hijack This
2007-12-23 17:48:59 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-12-23 15:11:06 4212 --ah----- C:\WINDOWS\system32\zllictbl.dat
2007-12-23 14:29:46 0 d-------- C:\Program Files\Common Files
2007-12-23 14:24:50 0 d-------- C:\Program Files\Hewlett-Packard
2007-12-23 14:23:03 0 d-------- C:\Program Files\Microsoft ActiveSync
2007-12-23 14:22:48 0 d-------- C:\Program Files\The Learning Company
2007-12-23 12:52:18 0 d-------- C:\Program Files\QuickTime
2007-12-23 00:25:35 0 d-------- C:\Program Files\Steam
2007-12-22 01:16:15 0 d-------- C:\Documents and Settings\J&L Torres\Application Data\Adobe
2007-12-15 06:50:53 35821 --a------ C:\WINDOWS\mozver.dat
2007-11-15 12:55:52 0 d-------- C:\Documents and Settings\J&L Torres\Application Data\Roxio


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logitech Utility"="Logi_MwX.Exe" [11/08/2002 09:50 AM C:\WINDOWS\LOGI_MWX.EXE]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [12/23/2007 07:21 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" []

C:\Documents and Settings\J&L Torres\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - C:\Program Files\ERUNT\AUTOBACK.EXE [10/20/2005 12:04:08 PM]
TDK Launcher.lnk - C:\Program Files\TDK\TDKLauncher\TDKLauncher.exe [12/31/2003 11:07:30 AM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2/15/2003 12:00:28 AM]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
backup=C:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^CorelCENTRAL 10.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\CorelCENTRAL 10.lnk
backup=C:\WINDOWS\pss\CorelCENTRAL 10.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^CreataCard Gold 3 Forget Me Not Reminders Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\CreataCard Gold 3 Forget Me Not Reminders Tray Icon.lnk
backup=C:\WINDOWS\pss\CreataCard Gold 3 Forget Me Not Reminders Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Desktop Application Director 10.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Desktop Application Director 10.lnk
backup=C:\WINDOWS\pss\Desktop Application Director 10.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Event Planner Reminders Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Event Planner Reminders Tray Icon.lnk
backup=C:\WINDOWS\pss\Event Planner Reminders Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=C:\WINDOWS\pss\HP Image Zone Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^J&L Torres^Start Menu^Programs^Startup^Registration-Studio 8.lnk]
path=C:\Documents and Settings\J&L Torres\Start Menu\Programs\Startup\Registration-Studio 8.lnk
backup=C:\WINDOWS\pss\Registration-Studio 8.lnkStartup


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ElbyCheckElbyCDFL]
"C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
C:\Program Files\McAfee.com\Agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickFinder Scheduler]
"C:\Program Files\Corel\WordPerfect Office 2002\Programs\QFSCHD100.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioAudioCentral]
"C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
"C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\j2re1.4.2\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WeatherCast]
C:\PROGRA~1\WEATHE~1\Weather.exe /q




-- End of Deckard's System Scanner: finished at 2007-12-24 19:13:43 ------------

[Rorschach112]

Well your logs are looking good..Lets do two more scans to see if we can rule out malware

Make sure to remind me about your internet connection again near the end

Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Extended (if available otherwise Standard)
  
  • Scan Options:
  Scan Archives
  Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  
  • Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

* Click here to download AVG Anti Rootkit and save it to your desktop.

• Double-click on the AVG_AntiRootkit_1.1.0.42.exe file to run it.
• Click "I Agree" to agree to the EULA.
• By default it will install to "G:\Program Files\GRISOFT\AVG Anti-Rootkit Beta".
• Click "Next" to begin the installation then click "Install".
• It will then ask you to reboot now to finish the installation.
• Click "Finish" and your computer will reboot.
• After it reboots, double-click on the AVG Anti-Rootkit Beta shortcut that is now on your desktop.
• Click on the "Perform in-depth search" button to begin the scan.
• The scan will take a while so be patient and let it complete.
• When the scan is finished, click the "Save result to file" button.
• Save the scan results to your desktop then come back here to copy and paste the results in your next reply to this thread.

[Cthulhu111]

Okay, but remember that I can only run the Webscanner in Safe Mode, if it's an online thing.

[Cthulhu111]

I don't know if it's because I'm limited to Internet access via Safe Mode or what, but I can't get the Kaspersky to run. A license agreement pops up, and when I click on 'Accept', absolutely nothing happens.

[Cthulhu111]

AVG Rootkit found nothing.

I got Kaspersky to run...finally figured out I was trying to run it in Firefox, which is a no-no.

Kaspersky results Part 1:
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Tuesday, December 25, 2007 1:23:45 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 25/12/2007
Kaspersky Anti-Virus database records: 493520
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\

Scan Statistics:
Total number of scanned objects: 108426
Number of viruses found: 27
Number of infected objects: 227
Number of suspicious objects: 32
Duration of the scan process: 02:16:21

Infected Object Name / Virus Name / Last Action
C:\BS435.exe/WISE0022.BIN/data0001.cab/Save.exe Infected: not-a-virus:AdWare.Win32.SaveNow.c skipped
C:\BS435.exe/WISE0022.BIN/data0001.cab/SaveUninst.exe Infected: not-a-virus:AdWare.Win32.SaveNow.af skipped
C:\BS435.exe/WISE0022.BIN/data0001.cab Infected: not-a-virus:AdWare.Win32.SaveNow.af skipped
C:\BS435.exe/WISE0022.BIN/data0002.cab/Weather.exe Infected: not-a-virus:AdWare.Win32.SaveNow.ay skipped
C:\BS435.exe/WISE0022.BIN/data0002.cab/Uninst.exe Infected: not-a-virus:AdWare.Win32.SaveNow.f skipped
C:\BS435.exe/WISE0022.BIN/data0002.cab Infected: not-a-virus:AdWare.Win32.SaveNow.f skipped
C:\BS435.exe/WISE0022.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.f skipped
C:\BS435.exe WiseSFX: infected - 7 skipped
C:\BS435.exe WiseSFXDropper: infected - 7 skipped
C:\BSINSTALL.exe/WISE0024.BIN Infected: not-a-virus:AdTool.Win32.WhenU.a skipped
C:\BSINSTALL.exe WiseSFX: infected - 1 skipped
C:\BSINSTALL.exe WiseSFXDropper: infected - 1 skipped
C:\BSINSTALL1.exe/WISE0038.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.bx skipped
C:\BSINSTALL1.exe WiseSFX: infected - 1 skipped
C:\BSINSTALL1.exe WiseSFXDropper: infected - 1 skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Firefox\Profiles\lrr5hjau.default\cert8.db Object is locked skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Firefox\Profiles\lrr5hjau.default\history.dat Object is locked skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Firefox\Profiles\lrr5hjau.default\key3.db Object is locked skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Firefox\Profiles\lrr5hjau.default\parent.lock Object is locked skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Firefox\Profiles\lrr5hjau.default\search.sqlite Object is locked skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Firefox\Profiles\lrr5hjau.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected] . ... /[From Regions Bank Customer Service Center <[email protected]>][Date Wed, 30 Mar 2005 16:13:17 -0300]/html Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected] ... /[From " ... /[From from multipart/alternative by demime 0.98e][Date Wed, 30 Mar 2005 10:35:50 -0500 (EST)]/text Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected] ... /[From "Automated T. B ... /[From Andy Zavalla <[email protected]>][Date Wed, 23 Mar 2005 17:36:55 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected] ... /[From "Automated T. Bal ... /[From Ben Ellen <[email protected]>][Date Wed, 23 Mar 2005 14:39:33 +0300]/text Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected] ... /[From "Automated T. Balsaming" <[email protected]>][Date Wed, 23 Mar 2005 03:24:07 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date W ... /[From People First <[email protected]>][Date Tue, 22 Mar 2005 21:08:43 -0600 (CST)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date We ... /[F . ... /[From Linette Torres <[email protected]>][Date Tue, 22 Mar 2005 20:15:59 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date We ... /[F ... /[Fr ... /[From [email protected]][Date Tue, 22 Mar 2005 00:01:15 -0600 (CST)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date We ... /[F ... /[From Vicodin Ambien <[email protected]>][Date Mon, 21 Mar 2005 19:38:36 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date We ... /[F ... /[From from multipart/alternative by demime 0.98e][Date Mon, 21 Mar 2005 13:13:42 -0500]/text Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date We ... /[From "Layout C. Unrelated" <[email protected]>][Date Mon, 21 Mar 2005 03:32:23 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date We ... /[From Online Pharmacy-Wholesale <[email protected]>][Date Mon, 21 Mar 2005 06:11:57 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date Wed, 2 ... ... /[From Stacie Frey <[email protected]>][Date Mon, 21 Mar 2005 01:45:19 -0200]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date Wed, 2 ... /[From Hilary Flores <[email protected]>][Date Sat, 05 Mar 2005 00:52:49 +0800]/text Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date Wed, 21 Apr ... ... /[From Gilda Vinson <[email protected]>][Date Fri, 04 Mar 2005 20:50:43 +0600]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 ... /[From h=received:message-id:date:from:repl ... /[Fro . ... /[From from multipart/alternative by demime 0.98e][Date Sat, 16 Apr 2005 10:47:15 -0400 ( ... /1.exe Infected: Email-Worm.Win32.Bagle.bj skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 ... /[From h=received:message-id:date:from:repl ... /[Fro . ... /[From from multipart/alternative by demime 0.98e][Date Sat, 16 Apr 2005 10:47:15 -0400 (EDT)]/7.zip Infected: Email-Worm.Win32.Bagle.bj skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 ... /[From h=received:message-id:date:from:repl ... /[Fro ... /[F ... /[ ... /[From Linette Torres <[email protected]>][Date Fri, 15 Apr 2005 20:38:47 -0400]/text Infected: Email-Worm.Win32.Bagle.bj skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 ... /[From h=received:message-id:date:from:repl ... /[Fro ... /[F ... /[From Jonathan Kessler <[email protected]>][Date Fri, 15 Apr 2005 07:03:51 -0700 (PDT)]/text Infected: Email-Worm.Win32.Bagle.bj skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 ... /[From h=received:message-id:date:from:repl ... /[Fro ... /[From =?utf-8?q?Wat Vio?= <[email protected]>][Date Thu, 14 Apr 2005 19:04:10 +0000]/UNNAMED Infected: Email-Worm.Win32.Bagle.bj skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 ... /[From h=received:message-id:date:from:repl ... /[From "Unerringly B. Vividness" <[email protected]>][Date Thu, 14 Apr 2005 11:16:34 -0700]/UNNAMED Infected: Email-Worm.Win32.Bagle.bj skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 ... /[From h=received:message-id:date:from:reply-to:to:subject: ... ... /[From "Wieneke, Myron" <[email protected]>][Date Thu, 14 Apr 2005 16:39:55 +0100]/text Infected: Email-Worm.Win32.Bagle.bj skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 ... /[From h=received:message-id:date:from:reply-to:to:subject: ... /[From "Po ... /[From from text/html by demime 0.98e][Date Tue, 12 Apr 2005 04:58:55 +0000]/html Infected: Email-Worm.Win32.Bagle.bj skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 ... /[From h=received:message-id:date:from:reply-to:to:subject: ... /[From "Portray O. Rosiness" <[email protected]>][Date Tue, 12 Apr 2005 01:44:40 -0700]/UNNAMED Infected: Email-Worm.Win32.Bagle.bj skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 ... /[From h=received:message-id:date:from:reply-to:to:subject:in-reply-to:mime-v][Date h=received:message-id:date:from:reply-to:to:subject:in-reply-to:mime-v]/text Infected: Email-Worm.Win32.Bagle.bj skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date W ... /[From "We ... /[From Valium Soma <[email protected]>][Date Mon, 11 Apr 2005 13:49:17 -0800]/UNNAMED Infected: Email-Worm.Win32.Bagle.bj skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date W ... /[From "Weak D. Morse" <[email protected]>][Date Sat, 09 Apr 2005 16:31:53 -0700]/UNNAMED Infected: Email-Worm.Win32.Bagle.bj skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date Wed, 21 A ... /[From Moses Draper <[email protected]>][Date Fri, 03 Jun 2005 00:38:40 - ... /pics.scr Infected: Trojan-Downloader.Win32.Small.axr skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date Wed, 21 A ... /[From Moses Draper <[email protected]>][Date Fri, 03 Jun 2005 00:38:40 -0300]/pics.zip Infected: Trojan-Downloader.Win32.Small.axr skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date Wed, 21 Apr ... /[From Terrance Wong <[email protected]>][Date Thu, 13 May 2004 17:22:41 -0400]/text Infected: Trojan-Downloader.Win32.Small.axr skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date Wed, 21 Apr 2004 16:26:27 -0400]/text Infected: Trojan-Downloader.Win32.Small.axr skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text Infected: Trojan-Downloader.Win32.Small.axr skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED Infected: Trojan-Downloader.Win32.Small.axr skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED Infected: Trojan-Downloader.Win32.Small.axr skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED Infected: Trojan-Downloader.Win32.Small.axr skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\lordvader\2lkswxbo.slt\Mail\pop-server.cfl.rr.com\Inbox Mail Berkeley mbox: infected - 35 skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\ltorres1\29evwjiw.slt\Mail\pop-server.cfl.rr.com\Inbox/[From =?iso-8859-1?B?c2VydmljZXNAcGF5cGFsLmNvbQ==?= <[email protected]>][Date Thu, 04 Aug 2005 02:40:02 +0000]/UNNAMED/html Infected: Trojan-Spy.HTML.Bankfraud.iz skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\ltorres1\29evwjiw.slt\Mail\pop-server.cfl.rr.com\Inbox/[From =?iso-8859-1?B?c2VydmljZXNAcGF5cGFsLmNvbQ==?= <[email protected]>][Date Thu, 04 Aug 2005 02:40:02 +0000]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.iz skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\ltorres1\29evwjiw.slt\Mail\pop-server.cfl.rr.com\Inbox/[From "[email protected]" <[email protected]>][Date Sat, 06 Aug 2005 03:53:39 +0200]/html Infected: Trojan-Spy.HTML.Bayfraud.dc skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\ltorres1\29evwjiw.slt\Mail\pop-server.cfl.rr.com\Inbox Mail Berkeley mbox: infected - 3 skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\ltorres1\29evwjiw.slt\Mail\pop3-server.cfl.rr.com\Inbox/[From "lowell sasser" <[email protected]>][Date Tue, 25 Mar 2003 12:46:09 -0500]/UNNAMED/[From "Terri Leverette" <[email protected]>][Date Tue, 25 Mar 2003 22:34:32 -0500]/UNNAMED/[From "lowell sasser" <[email protected]>][Date Fri, 28 Mar 2003 22:49:49 -0500]/UNNAMED/[From "Connie Parrish" <[email protected]>][Date Fri, 04 Apr 03 22:10:45 GMT]/UNNAMED/[From "Sal Rush" <[email protected] ... /[From territotten <[email protected]>][Date Sat, 5 Apr 2003 19:11:32 -0500]/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\ltorres1\29evwjiw.slt\Mail\pop3-server.cfl.rr.com\Inbox/[From "lowell sasser" <[email protected]>][Date Tue, 25 Mar 2003 12:46:09 -0500]/UNNAMED/[From "Terri Leverette" <[email protected]>][Date Tue, 25 Mar 2003 22:34:32 -0500]/UNNAMED/[From "lowell sasser" <[email protected]>][Date Fri, 28 Mar 2003 22:49:49 -0500]/UNNAMED/[From "Connie Parrish" <[email protected]>][Date Fri, 04 Apr 03 22:10:45 GMT]/UNNAMED/[From "Sal Rush" <[email protected]>][Date Sat, 05 Apr 03 09:30:10 GMT]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\ltorres1\29evwjiw.slt\Mail\pop3-server.cfl.rr.com\Inbox/[From "lowell sasser" <[email protected]>][Date Tue, 25 Mar 2003 12:46:09 -0500]/UNNAMED/[From "Terri Leverette" <[email protected]>][Date Tue, 25 Mar 2003 22:34:32 -0500]/UNNAMED/[From "lowell sasser" <[email protected]>][Date Fri, 28 Mar 2003 22:49:49 -0500]/UNNAMED/[From "Connie Parrish" <[email protected]>][Date Fri, 04 Apr 03 22:10:45 GMT]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\ltorres1\29evwjiw.slt\Mail\pop3-server.cfl.rr.com\Inbox/[From "lowell sasser" <[email protected]>][Date Tue, 25 Mar 2003 12:46:09 -0500]/UNNAMED/[From "Terri Leverette" <[email protected]>][Date Tue, 25 Mar 2003 22:34:32 -0500]/UNNAMED/[From "lowell sasser" <[email protected]>][Date Fri, 28 Mar 2003 22:49:49 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\ltorres1\29evwjiw.slt\Mail\pop3-server.cfl.rr.com\Inbox/[From "lowell sasser" <[email protected]>][Date Tue, 25 Mar 2003 12:46:09 -0500]/UNNAMED/[From "Terri Leverette" <[email protected]>][Date Tue, 25 Mar 2003 22:34:32 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\ltorres1\29evwjiw.slt\Mail\pop3-server.cfl.rr.com\Inbox/[From "lowell sasser" <[email protected]>][Date Tue, 25 Mar 2003 12:46:09 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\J&L Torres\Application Data\Mozilla\Profiles\ltorres1\29evwjiw.slt\Mail\pop3-server.cfl.rr.com\Inbox Mail Berkeley mbox: suspicious - 6 skipped

[Cthulhu111]

Kaspersky Part II:
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected] . ... /[From Regions Bank Customer Service Center <[email protected]>][Date Wed, 30 Mar 2005 16:13:17 -0300]/html Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected] ... /[From " ... /[From from multipart/alternative by demime 0.98e][Date Wed, 30 Mar 2005 10:35:50 -0500 (EST)]/text Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected] ... /[From "Automated T. B ... /[From Andy Zavalla <[email protected]>][Date Wed, 23 Mar 2005 17:36:55 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected] ... /[From "Automated T. Bal ... /[From Ben Ellen <[email protected]>][Date Wed, 23 Mar 2005 14:39:33 +0300]/text Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected] ... /[From "Automated T. Balsaming" <[email protected]>][Date Wed, 23 Mar 2005 03:24:07 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date W ... /[From People First <[email protected]>][Date Tue, 22 Mar 2005 21:08:43 -0600 (CST)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date We ... /[F . ... /[From Linette Torres <[email protected]>][Date Tue, 22 Mar 2005 20:15:59 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date We ... /[F ... /[Fr ... /[From [email protected]][Date Tue, 22 Mar 2005 00:01:15 -0600 (CST)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date We ... /[F ... /[From Vicodin Ambien <[email protected]>][Date Mon, 21 Mar 2005 19:38:36 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date We ... /[F ... /[From from multipart/alternative by demime 0.98e][Date Mon, 21 Mar 2005 13:13:42 -0500]/text Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date We ... /[From "Layout C. Unrelated" <[email protected]>][Date Mon, 21 Mar 2005 03:32:23 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date We ... /[From Online Pharmacy-Wholesale <[email protected]>][Date Mon, 21 Mar 2005 06:11:57 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date Wed, 2 ... ... /[From Stacie Frey <[email protected]>][Date Mon, 21 Mar 2005 01:45:19 -0200]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date Wed, 2 ... /[From Hilary Flores <[email protected]>][Date Sat, 05 Mar 2005 00:52:49 +0800]/text Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date Wed, 21 Apr ... ... /[From Gilda Vinson <[email protected]>][Date Fri, 04 Mar 2005 20:50:43 +0600]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.cm skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 ... /[From h=received:message-id:date:from:repl ... /[Fro . ... /[From from multipart/alternative by demime 0.98e][Date Sat, 16 Apr 2005 10:47:15 -0400 ( ... /1.exe Infected: Email-Worm.Win32.Bagle.bj skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 ... /[From h=received:message-id:date:from:repl ... /[Fro . ... /[From from multipart/alternative by demime 0.98e][Date Sat, 16 Apr 2005 10:47:15 -0400 (EDT)]/7.zip Infected: Email-Worm.Win32.Bagle.bj skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 ... /[From h=received:message-id:date:from:repl ... /[Fro ... /[F ... /[ ... /[From Linette Torres <[email protected]>][Date Fri, 15 Apr 2005 20:38:47 -0400]/text Infected: Email-Worm.Win32.Bagle.bj skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 ... /[From h=received:message-id:date:from:repl ... /[Fro ... /[F ... /[From Jonathan Kessler <[email protected]>][Date Fri, 15 Apr 2005 07:03:51 -0700 (PDT)]/text Infected: Email-Worm.Win32.Bagle.bj skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 ... /[From h=received:message-id:date:from:repl ... /[Fro ... /[From =?utf-8?q?Wat Vio?= <[email protected]>][Date Thu, 14 Apr 2005 19:04:10 +0000]/UNNAMED Infected: Email-Worm.Win32.Bagle.bj skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 ... /[From h=received:message-id:date:from:repl ... /[From "Unerringly B. Vividness" <[email protected]>][Date Thu, 14 Apr 2005 11:16:34 -0700]/UNNAMED Infected: Email-Worm.Win32.Bagle.bj skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 ... /[From h=received:message-id:date:from:reply-to:to:subject: ... ... /[From "Wieneke, Myron" <[email protected]>][Date Thu, 14 Apr 2005 16:39:55 +0100]/text Infected: Email-Worm.Win32.Bagle.bj skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 ... /[From h=received:message-id:date:from:reply-to:to:subject: ... /[From "Po ... /[From from text/html by demime 0.98e][Date Tue, 12 Apr 2005 04:58:55 +0000]/html Infected: Email-Worm.Win32.Bagle.bj skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 ... /[From h=received:message-id:date:from:reply-to:to:subject: ... /[From "Portray O. Rosiness" <[email protected]>][Date Tue, 12 Apr 2005 01:44:40 -0700]/UNNAMED Infected: Email-Worm.Win32.Bagle.bj skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 ... /[From h=received:message-id:date:from:reply-to:to:subject:in-reply-to:mime-v][Date h=received:message-id:date:from:reply-to:to:subject:in-reply-to:mime-v]/text Infected: Email-Worm.Win32.Bagle.bj skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date W ... /[From "We ... /[From Valium Soma <[email protected]>][Date Mon, 11 Apr 2005 13:49:17 -0800]/UNNAMED Infected: Email-Worm.Win32.Bagle.bj skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date W ... /[From "Weak D. Morse" <[email protected]>][Date Sat, 09 Apr 2005 16:31:53 -0700]/UNNAMED Infected: Email-Worm.Win32.Bagle.bj skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date Wed, 21 A ... /[From Moses Draper <[email protected]>][Date Fri, 03 Jun 2005 00:38:40 - ... /pics.scr Infected: Trojan-Downloader.Win32.Small.axr skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date Wed, 21 A ... /[From Moses Draper <[email protected]>][Date Fri, 03 Jun 2005 00:38:40 -0300]/pics.zip Infected: Trojan-Downloader.Win32.Small.axr skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date Wed, 21 Apr ... /[From Terrance Wong <[email protected]>][Date Thu, 13 May 2004 17:22:41 -0400]/text Infected: Trojan-Downloader.Win32.Small.axr skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text/[From Aldon Asher <[email protected]>][Date Wed, 21 Apr 2004 16:26:27 -0400]/text Infected: Trojan-Downloader.Win32.Small.axr skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED/[From Ray Terry <[email protected]>][Date Tue, 13 Apr 2004 08:06:09 -0700 (PDT)]/text Infected: Trojan-Downloader.Win32.Small.axr skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Thu, 01 Apr 2004 09:25:25 -0500]/UNNAMED Infected: Trojan-Downloader.Win32.Small.axr skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED/[From Andy Zavalla <[email protected]>][Date Tue, 30 Mar 2004 12:48:49 -0500]/UNNAMED Infected: Trojan-Downloader.Win32.Small.axr skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox/[From Andy Zavalla <[email protected]>][Date Thu, 25 Mar 2004 10:10:12 -0500]/UNNAMED Infected: Trojan-Downloader.Win32.Small.axr skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\1mycvnav.default\Mail\pop-server.cfl.rr.com\Inbox Mail Berkeley mbox: infected - 35 skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\3kpwttek.ltorres1\Mail\pop3-server.cfl.rr.com\Inbox/[From "lowell sasser" <[email protected]>][Date Tue, 25 Mar 2003 12:46:09 -0500]/UNNAMED/[From "Terri Leverette" <[email protected]>][Date Tue, 25 Mar 2003 22:34:32 -0500]/UNNAMED/[From "lowell sasser" <[email protected]>][Date Fri, 28 Mar 2003 22:49:49 -0500]/UNNAMED/[From "Connie Parrish" <[email protected]>][Date Fri, 04 Apr 03 22:10:45 GMT]/UNNAMED/[From "Sal Rush" <[email protected] ... /[From territotten <[email protected]>][Date Sat, 5 Apr 2003 19:11:32 -0500]/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\3kpwttek.ltorres1\Mail\pop3-server.cfl.rr.com\Inbox/[From "lowell sasser" <[email protected]>][Date Tue, 25 Mar 2003 12:46:09 -0500]/UNNAMED/[From "Terri Leverette" <[email protected]>][Date Tue, 25 Mar 2003 22:34:32 -0500]/UNNAMED/[From "lowell sasser" <[email protected]>][Date Fri, 28 Mar 2003 22:49:49 -0500]/UNNAMED/[From "Connie Parrish" <[email protected]>][Date Fri, 04 Apr 03 22:10:45 GMT]/UNNAMED/[From "Sal Rush" <[email protected]>][Date Sat, 05 Apr 03 09:30:10 GMT]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\3kpwttek.ltorres1\Mail\pop3-server.cfl.rr.com\Inbox/[From "lowell sasser" <[email protected]>][Date Tue, 25 Mar 2003 12:46:09 -0500]/UNNAMED/[From "Terri Leverette" <[email protected]>][Date Tue, 25 Mar 2003 22:34:32 -0500]/UNNAMED/[From "lowell sasser" <[email protected]>][Date Fri, 28 Mar 2003 22:49:49 -0500]/UNNAMED/[From "Connie Parrish" <[email protected]>][Date Fri, 04 Apr 03 22:10:45 GMT]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\3kpwttek.ltorres1\Mail\pop3-server.cfl.rr.com\Inbox/[From "lowell sasser" <[email protected]>][Date Tue, 25 Mar 2003 12:46:09 -0500]/UNNAMED/[From "Terri Leverette" <[email protected]>][Date Tue, 25 Mar 2003 22:34:32 -0500]/UNNAMED/[From "lowell sasser" <[email protected]>][Date Fri, 28 Mar 2003 22:49:49 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\3kpwttek.ltorres1\Mail\pop3-server.cfl.rr.com\Inbox/[From "lowell sasser" <[email protected]>][Date Tue, 25 Mar 2003 12:46:09 -0500]/UNNAMED/[From "Terri Leverette" <[email protected]>][Date Tue, 25 Mar 2003 22:34:32 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\3kpwttek.ltorres1\Mail\pop3-server.cfl.rr.com\Inbox/[From "lowell sasser" <[email protected]>][Date Tue, 25 Mar 2003 12:46:09 -0500]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\J&L Torres\Application Data\Thunderbird\Profiles\3kpwttek.ltorres1\Mail\pop3-server.cfl.rr.com\Inbox Mail Berkeley mbox: suspicious - 6 skipped
C:\Documents and Settings\J&L Torres\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\J&L Torres\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\J&L Torres\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\J&L Torres\Local Settings\Application Data\Mozilla\Firefox\Profiles\lrr5hjau.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\J&L Torres\Local Settings\Application Data\Mozilla\Firefox\Profiles\lrr5hjau.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\J&L Torres\Local Settings\Application Data\Mozilla\Firefox\Profiles\lrr5hjau.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\J&L Torres\Local Settings\Application Data\Mozilla\Firefox\Profiles\lrr5hjau.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\J&L Torres\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\J&L Torres\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\J&L Torres\My Documents\Inbox/[From Disney Sponsor Offer <[email protected]>][Date Wed, 12 Feb 2003 18:10:27 -0500 (EST)]/UNNAMED/[From [email protected]][Date Wed, 12 Feb 2003 20:02:42 -0500 (EST)]/UNNAMED/[From Ileana Mendez<[email protected]>][Date Thu, 13 Feb 2003 04:52:53 -0500 (EST)]/text/[From "Oliarien"<[email protected]>][Date Sat, 8 Feb 2003 07:00:49 GMT]/text/[From Autel12 ... /[From webmaster <[email protected]>][Date Thu, 13 Feb 2003 17:05:27 -0500 (EST)]/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\J&L Torres\My Documents\Inbox/[From Disney Sponsor Offer <[email protected]>][Date Wed, 12 Feb 2003 18:10:27 -0500 (EST)]/UNNAMED/[From [email protected]][Date Wed, 12 Feb 2003 20:02:42 -0500 (EST)]/UNNAMED/[From Ileana Mendez<[email protected]>][Date Thu, 13 Feb 2003 04:52:53 -0500 (EST)]/text/[From "Oliarien"<[email protected]>][Date Sat, 8 Feb 2003 07:00:49 GMT]/text/[From [email protected]][Date Thu, 13 ... /[From <[email protected]>][Date Thu, 13 Feb 2003 16:42:26]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\J&L Torres\My Documents\Inbox/[From Disney Sponsor Offer <[email protected]>][Date Wed, 12 Feb 2003 18:10:27 -0500 (EST)]/UNNAMED/[From [email protected]][Date Wed, 12 Feb 2003 20:02:42 -0500 (EST)]/UNNAMED/[From Ileana Mendez<[email protected]>][Date Thu, 13 Feb 2003 04:52:53 -0500 (EST)]/text/[From "Oliarien"<[email protected]>][Date Sat, 8 Feb 2003 07:00:49 GMT]/text/[From [email protected]][Date Thu, 13 Feb 2003 09:51:52 EST]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\J&L Torres\My Documents\Inbox/[From Disney Sponsor Offer <[email protected]>][Date Wed, 12 Feb 2003 18:10:27 -0500 (EST)]/UNNAMED/[From [email protected]][Date Wed, 12 Feb 2003 20:02:42 -0500 (EST)]/UNNAMED/[From Ileana Mendez<[email protected]>][Date Thu, 13 Feb 2003 04:52:53 -0500 (EST)]/text/[From "Oliarien"<[email protected]>][Date Sat, 8 Feb 2003 07:00:49 GMT]/text Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\J&L Torres\My Documents\Inbox/[From Disney Sponsor Offer <[email protected]>][Date Wed, 12 Feb 2003 18:10:27 -0500 (EST)]/UNNAMED/[From [email protected]][Date Wed, 12 Feb 2003 20:02:42 -0500 (EST)]/UNNAMED/[From Ileana Mendez<[email protected]>][Date Thu, 13 Feb 2003 04:52:53 -0500 (EST)]/text Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\J&L Torres\My Documents\Inbox/[From Disney Sponsor Offer <[email protected]>][Date Wed, 12 Feb 2003 18:10:27 -0500 (EST)]/UNNAMED/[From [email protected]][Date Wed, 12 Feb 2003 20:02:42 -0500 (EST)]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\J&L Torres\My Documents\Inbox/[From Disney Sponsor Offer <[email protected]>][Date Wed, 12 Feb 2003 18:10:27 -0500 (EST)]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\J&L Torres\My Documents\Inbox Mail Berkeley mbox: suspicious - 7 skipped
C:\Documents and Settings\J&L Torres\ntuser.dat Object is locked skipped
C:\Documents and Settings\J&L Torres\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Inbox/[From <[email protected]>][Date Wed, 12 Feb 2003 00:33:16 +0800]/html/[From sipix <[email protected]>][Date Wed, 12 Feb 2003 09:46:36 -0500 (EST)]/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Inbox/[From <[email protected]>][Date Wed, 12 Feb 2003 00:33:16 +0800]/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Inbox Mail Berkeley mbox: suspicious - 2 skipped
C:\kf141.zip/keyfinder.exe/data.rar/xpkey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\kf141.zip/keyfinder.exe/data.rar/officekey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\kf141.zip/keyfinder.exe/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\kf141.zip/keyfinder.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\kf141.zip ZIP: infected - 4 skipped
C:\mirc616.exe/data0001.bin Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped
C:\mirc616.exe mIRC: infected - 1 skipped
C:\OiUninstaller.exe/data0002 Infected: not-a-virus:AdWare.Win32.PurityScan.gn skipped
C:\OiUninstaller.exe NSIS: infected - 1 skipped

[Cthulhu111]

Kaspersky Part III:
C:\Program Files\mIRC\backup\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.603 skipped
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.603 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000035.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000036.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000038.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000039.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000040.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000042.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000043.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000044.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000045.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000046.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000047.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000048.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000049.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000050.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000051.EXE Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000052.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000053.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000054.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000055.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000056.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000057.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000058.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000059.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000072.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000073.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000075.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000076.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000077.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000079.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000080.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000081.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000082.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000083.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000084.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000085.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000086.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000087.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000088.EXE Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000089.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000090.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000091.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000093.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000094.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000095.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000096.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000107.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000108.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000110.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000111.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000112.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000113.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000114.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000115.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000116.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000117.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000118.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000119.EXE Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000120.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000121.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000122.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000123.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000124.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000125.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000126.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000128.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000130.exe Infected: Trojan-Downloader.Win32.PurityScan.eg skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000131.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000132.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000133.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000134.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000135.exe Infected: Trojan-Downloader.Win32.Agent.erf skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000136.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000344.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000346.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000348.exe Infected: not-a-virus:AdWare.Win32.Agent.vv skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000399.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000401.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000514.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP1\A0000751.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP12\change.log Object is locked skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP3\A0001245.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP4\A0001248.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.clz skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP4\A0001268.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP4\A0001283.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP4\A0001284.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP4\A0001285.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP4\A0001324.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP4\A0001409.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{CBC3A138-361B-4209-8CC5-6194C5CF9A97}\RP4\A0001435.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped