View Full Version : A Malware/Virus Problem - No programs are valid win32 applications...
Hmm, not really sure what's going on here. This is going to be an extremely unhelpful post as almost all the programs I've tried have completely failed to work.
I have no logs to put up here that I know of; HijackThis isn't a valid win32 application, KAV online scanner won't work since IE isn't working, GMER doesn't install/work, AVG Free, Avast! Home, ATF Cleaner, CCleaner, KIS 7, Comodo Free AV and Avira all either fail to install or fail to start.
The only things working now are Sunbelt Firewall (which is actually being a bit temperamental, and disappearing from the system tray quite often) and Comodo BOClean, both installed after my system started playing up.
I've tried System Restore twice, but to no avail; it says it cannot restore to any previous restore points, of which there are a few from the past few days.
Any ideas?
Hi
Let's see if you can get renamed ComboFix running.
Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.
Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)
Link 3 (http://subs.geekstogo.com/ComboFix.exe)
http://i266.photobucket.com/albums/ii277/sUBs_/combofix/CF_download_FF.gif
http://i266.photobucket.com/albums/ii277/sUBs_/combofix/CF_download_rename.gif
--------------------------------------------------------------------
Double click on Combo-Fix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a HijackThis log (rename HijackThis.exe -> something.exe before running it) so we can continue cleaning the system.
Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall
OK, progress, renaming things seems to make them work again (mostly; unless they had the win32 problem). The ComboFix log is showing up a whole load of zip files in a mysterious folder called "m" in my main App Data folder; is this another effect of what I believe to be the Bagle virus?
Anywhom, some logs:
ComboFix Log
ComboFix 08-05-27.4 - User 2008-05-28 18:56:24.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1277 [GMT 1:00]
Running from: C:\Documents and Settings\User\My Documents\comfix1.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\User\Application Data\m\shared
C:\Documents and Settings\User\Application Data\m\shared\000-235 Downloadable Exam Simulator 2.1 [Crack].zip
C:\Documents and Settings\User\Application Data\m\shared\123 Hidden Sender 3.15.zip
C:\Documents and Settings\User\Application Data\m\shared\2D Ghost Forest Interactive Saver 3.0.zip
C:\Documents and Settings\User\Application Data\m\shared\310-880 - Sun Certified Senior System Support Engineer Practice Exam Questions 1.0 With Crack.zip
C:\Documents and Settings\User\Application Data\m\shared\3D Outer Space 1.zip
C:\Documents and Settings\User\Application Data\m\shared\a-40 1.4.zip
C:\Documents and Settings\User\Application Data\m\shared\A-Z Typing Test 1.1.zip
C:\Documents and Settings\User\Application Data\m\shared\A+ Screensaver Creator 3.25.zip
C:\Documents and Settings\User\Application Data\m\shared\aBetterMail 1.2.zip
C:\Documents and Settings\User\Application Data\m\shared\ABF Photo Camera 1.01 [Key+Serial].zip
C:\Documents and Settings\User\Application Data\m\shared\Aliens vs Predator 2 Single-Player Map update 1.0.zip
C:\Documents and Settings\User\Application Data\m\shared\AMI Pagan Daybook II 4.0j.zip
C:\Documents and Settings\User\Application Data\m\shared\Annalisa 1.0 KeyGen.zip
C:\Documents and Settings\User\Application Data\m\shared\ANPOP POP3 COMPONENT BUILD 7.0.zip
C:\Documents and Settings\User\Application Data\m\shared\Anti-Secure Ultimate Password Recovery 1.0.zip
C:\Documents and Settings\User\Application Data\m\shared\AnyBackup FTP Edition 1.75.zip
C:\Documents and Settings\User\Application Data\m\shared\ARELIS 4.4.2 Patch.zip
C:\Documents and Settings\User\Application Data\m\shared\Arithmetris 1.0.zip
C:\Documents and Settings\User\Application Data\m\shared\ArtRage 2.2.zip
C:\Documents and Settings\User\Application Data\m\shared\AspEasyPDF 3.3.zip
C:\Documents and Settings\User\Application Data\m\shared\Aspose.PDF.Kit for Java 2.2.0.0.zip
C:\Documents and Settings\User\Application Data\m\shared\Assessor for Teachers 6.1.zip
C:\Documents and Settings\User\Application Data\m\shared\ATM 2.0.zip
C:\Documents and Settings\User\Application Data\m\shared\Attribute Editor Wizard 1.0.zip
C:\Documents and Settings\User\Application Data\m\shared\Avatar Boy 1.0.zip
C:\Documents and Settings\User\Application Data\m\shared\Avex DVD to PSP Video Suite 4.5.02 [Serial].zip
C:\Documents and Settings\User\Application Data\m\shared\AVI Extractor 1.0 (Crack).zip
C:\Documents and Settings\User\Application Data\m\shared\Avira.AntiVir.Premium.7.01-www.anti.zip
C:\Documents and Settings\User\Application Data\m\shared\Banana Lotto Picker 1.0.zip
C:\Documents and Settings\User\Application Data\m\shared\BarSim 1.5.1.zip
C:\Documents and Settings\User\Application Data\m\shared\BatControls 1.5.zip
C:\Documents and Settings\User\Application Data\m\shared\Beautiful Coastlines 1.1 (KeyGen).zip
C:\Documents and Settings\User\Application Data\m\shared\Beautiful Sunsets 1.1 Serial.zip
C:\Documents and Settings\User\Application Data\m\shared\BigSpeed Zip DLL 3.02 (KeyGen).zip
C:\Documents and Settings\User\Application Data\m\shared\Bounty Alien 2 1.zip
C:\Documents and Settings\User\Application Data\m\shared\Button Blast 2.0.zip
C:\Documents and Settings\User\Application Data\m\shared\CAD OCX 1.0.zip
C:\Documents and Settings\User\Application Data\m\shared\Captain Mnemo Lite 1.2.zip
C:\Documents and Settings\User\Application Data\m\shared\Ccy Cookies Remover 2.0.4.zip
C:\Documents and Settings\User\Application Data\m\shared\CD Player Maximus 3.4.zip
C:\Documents and Settings\User\Application Data\m\shared\Chilkat Mail DOS Command 6.0.0 [Cracked].zip
C:\Documents and Settings\User\Application Data\m\shared\China Culture ScreenSaver 1.5.zip
C:\Documents and Settings\User\Application Data\m\shared\Chronos 1.2.2.5 [Key+Serial].zip
C:\Documents and Settings\User\Application Data\m\shared\cineSync 1.1.zip
C:\Documents and Settings\User\Application Data\m\shared\ClinicGate Standard 2.8.zip
C:\Documents and Settings\User\Application Data\m\shared\Comic Book Manager 1.11 [Patch].zip
C:\Documents and Settings\User\Application Data\m\shared\CoolWWWSearch SmartKiller MiniRemoval 1.0.zip
C:\Documents and Settings\User\Application Data\m\shared\Crocodile 1.42.zip
C:\Documents and Settings\User\Application Data\m\shared\CrossLoop 1.11 Build 20070720164151.zip
C:\Documents and Settings\User\Application Data\m\shared\CryptoNote 4.0.0.3.zip
C:\Documents and Settings\User\Application Data\m\shared\Crystal REVS for C++ 2.06 Beta.zip
C:\Documents and Settings\User\Application Data\m\shared\CS 80V 1.6 Crack.zip
C:\Documents and Settings\User\Application Data\m\shared\CX310-081 SCWCD Java 1.4 8.02.05 [Key].zip
C:\Documents and Settings\User\Application Data\m\shared\DANCE 5.0.zip
C:\Documents and Settings\User\Application Data\m\shared\Data Control Font 1.0.zip
C:\Documents and Settings\User\Application Data\m\shared\DataSafe PS Net 3.zip
C:\Documents and Settings\User\Application Data\m\shared\DB Navigator 2 build 21.zip
C:\Documents and Settings\User\Application Data\m\shared\DiskInternals NTFS Reader 2.0.zip
C:\Documents and Settings\User\Application Data\m\shared\DiskSpaceExplorer 1.1.zip
C:\Documents and Settings\User\Application Data\m\shared\Do-Not-Call List Registry Check 3.zip
C:\Documents and Settings\User\Application Data\m\shared\Doppeldirectory 1.1.0.zip
C:\Documents and Settings\User\Application Data\m\shared\Dragonball Z Desktop Buddy 1.0.zip
C:\Documents and Settings\User\Application Data\m\shared\DragToScroll 0.4.zip
C:\Documents and Settings\User\Application Data\m\shared\DropMover 1.5.2.zip
C:\Documents and Settings\User\Application Data\m\shared\Elf Bowling 6 Air Biscuits 1.zip
C:\Documents and Settings\User\Application Data\m\shared\English Danish & Dansk Engelsk Dictionary 1.0.0.15.zip
C:\Documents and Settings\User\Application Data\m\shared\ePSXe 1.60.zip
C:\Documents and Settings\User\Application Data\m\shared\ewido-setup---.zip
C:\Documents and Settings\User\Application Data\m\shared\Exl-Plan Free 2.72.zip
C:\Documents and Settings\User\Application Data\m\shared\Fantasy Fireworks Screensaver 1.0 [Key+Serial].zip
C:\Documents and Settings\User\Application Data\m\shared\File Hunter 2006 build 3.01.02.zip
C:\Documents and Settings\User\Application Data\m\shared\FlexRent 1.5.2 Key+Serial.zip
C:\Documents and Settings\User\Application Data\m\shared\FontOpt 1.1.8.zip
C:\Documents and Settings\User\Application Data\m\shared\Forum Genius 2.0.zip
C:\Documents and Settings\User\Application Data\m\shared\Free Screen Recorder 2.9.zip
C:\Documents and Settings\User\Application Data\m\shared\FXArray 1.1.zip
C:\Documents and Settings\User\Application Data\m\shared\Gabhile.zip
C:\Documents and Settings\User\Application Data\m\shared\Happy Snowman Screensaver 4.10.0510 (Crack).zip
C:\Documents and Settings\User\Application Data\m\shared\Homeland Security Threat Monitor 1.0.3.zip
C:\Documents and Settings\User\Application Data\m\shared\iDecide Personal Edition v4.11.zip
C:\Documents and Settings\User\Application Data\m\shared\IdiomaX Office Translator 4.0 [Key].zip
C:\Documents and Settings\User\Application Data\m\shared\iGetter Download Manager 1.9.5.zip
C:\Documents and Settings\User\Application Data\m\shared\ImageCoder 1.0.zip
C:\Documents and Settings\User\Application Data\m\shared\Imaging Matrix - Manual Indexer 2.1.0.zip
C:\Documents and Settings\User\Application Data\m\shared\InboxShield 3.6 (Key+Serial).zip
C:\Documents and Settings\User\Application Data\m\shared\Innovatools diskSpace Explorer Network 3.0 [With Crack].zip
C:\Documents and Settings\User\Application Data\m\shared\IPTunnelManager 1.4 (With Crack).zip
C:\Documents and Settings\User\Application Data\m\shared\Jackson 1.31.zip
C:\Documents and Settings\User\Application Data\m\shared\Janotech 2.0.zip
C:\Documents and Settings\User\Application Data\m\shared\Jazz Params 1.5.zip
C:\Documents and Settings\User\Application Data\m\shared\Jigsaw Puzzle Applets 1.1.zip
C:\Documents and Settings\User\Application Data\m\shared\JPEG Viewer 0.12.zip
C:\Documents and Settings\User\Application Data\m\shared\Kaspersky.Antivirus.Personal.v5.0.227.zip
C:\Documents and Settings\User\Application Data\m\shared\Kerika 1.1.zip
C:\Documents and Settings\User\Application Data\m\shared\Lavasoft Personal Firewall 2.0.1023.700 With Crack.zip
C:\Documents and Settings\User\Application Data\m\shared\LCD Font Maker 3.92 [Serial].zip
C:\Documents and Settings\User\Application Data\m\shared\Leow Descrambler 1.8.zip
C:\Documents and Settings\User\Application Data\m\shared\LineStats 1.1.zip
C:\Documents and Settings\User\Application Data\m\shared\Logidex Visual Studio .NET Add-in 3.5.zip
C:\Documents and Settings\User\Application Data\m\shared\MagicMessage 2.5.157 [Cracked].zip
C:\Documents and Settings\User\Application Data\m\shared\Mail Access Monitor for Kerio MailServer 3.2.zip
C:\Documents and Settings\User\Application Data\m\shared\MailBee POP3 5.2.zip
C:\Documents and Settings\User\Application Data\m\shared\Maple Messenger 1.1.zip
C:\Documents and Settings\User\Application Data\m\shared\MB Free Runes Software 1.0.zip
C:\Documents and Settings\User\Application Data\m\shared\MEDA Picture Finder 3.7.2.zip
C:\Documents and Settings\User\Application Data\m\shared\Mellitux for Palm 1.08.zip
C:\Documents and Settings\User\Application Data\m\shared\Michelangelo Art 1.0 (Patch).zip
C:\Documents and Settings\User\Application Data\m\shared\MidiSqueezer 2.0 Key.zip
C:\Documents and Settings\User\Application Data\m\shared\Mission S.E.U.C.K. 7.9.06.zip
C:\Documents and Settings\User\Application Data\m\shared\Monitor Wolf 1.52.zip
C:\Documents and Settings\User\Application Data\m\shared\MP4 Browser 1.2.0.zip
C:\Documents and Settings\User\Application Data\m\shared\MSU StegoVideo 1.0.zip
C:\Documents and Settings\User\Application Data\m\shared\MultiG 1.2.4.1 (With Crack).zip
C:\Documents and Settings\User\Application Data\m\shared\Multiquence 2.54.zip
C:\Documents and Settings\User\Application Data\m\shared\MyClubV2 2.0.3.0.zip
C:\Documents and Settings\User\Application Data\m\shared\Neuro Enhancer Vocab Edition 0.0.72.zip
C:\Documents and Settings\User\Application Data\m\shared\Nick Video Jigsaw Jam 1.zip
C:\Documents and Settings\User\Application Data\m\shared\NotesPlusPlus 5.6.zip
C:\Documents and Settings\User\Application Data\m\shared\NSIS SkinCrafter Plugin 1.0.zip
C:\Documents and Settings\User\Application Data\m\shared\Online Functions - Exchange Rates 2.1 Crack.zip
C:\Documents and Settings\User\Application Data\m\shared\Online Functions - Exchange Rates 2.1.zip
C:\Documents and Settings\User\Application Data\m\shared\Panda Quick Remover 3.5.1.11.zip
C:\Documents and Settings\User\Application Data\m\shared\Panda.Antivirus.Platinum.7.20.+.Serial.zip
C:\Documents and Settings\User\Application Data\m\shared\Password Power 2.1.zip
C:\Documents and Settings\User\Application Data\m\shared\PCQNG 2.0.zip
C:\Documents and Settings\User\Application Data\m\shared\Personal Antispy 1.3.zip
C:\Documents and Settings\User\Application Data\m\shared\Personal Digital Voice Recorder 1.20 (Key).zip
C:\Documents and Settings\User\Application Data\m\shared\Photo Builder Platinum 6.0 (Patch).zip
C:\Documents and Settings\User\Application Data\m\shared\Photo SlideShow Maker 2.9 Cracked.zip
C:\Documents and Settings\User\Application Data\m\shared\Pictures Presentation Maker 2.7 KeyGen.zip
C:\Documents and Settings\User\Application Data\m\shared\Pivo FTP Component 1.01 [Serial].zip
C:\Documents and Settings\User\Application Data\m\shared\Pizza Puzzle 1.zip
C:\Documents and Settings\User\Application Data\m\shared\Podcast Station 2.1.02.zip
C:\Documents and Settings\User\Application Data\m\shared\PolderbitS Sound Recorder and Editor 5.zip
C:\Documents and Settings\User\Application Data\m\shared\Prime95 25.4.zip
C:\Documents and Settings\User\Application Data\m\shared\Privacy Keeper 1.0.zip
C:\Documents and Settings\User\Application Data\m\shared\Proxy Change Utility 0.1.zip
C:\Documents and Settings\User\Application Data\m\shared\ProxyCommander 1.0 Patch.zip
C:\Documents and Settings\User\Application Data\m\shared\Quorum 1.00.zip
C:\Documents and Settings\User\Application Data\m\shared\QuotesTK 1.02.zip
C:\Documents and Settings\User\Application Data\m\shared\Qute 3.2.2.zip
C:\Documents and Settings\User\Application Data\m\shared\Resume Builder 4.5 (Crack).zip
C:\Documents and Settings\User\Application Data\m\shared\RPWiz 1.05 (Cracked).zip
C:\Documents and Settings\User\Application Data\m\shared\SACrypt 1.0.zip
C:\Documents and Settings\User\Application Data\m\shared\ScholarWord MLA Edition 1.0 KeyGen.zip
C:\Documents and Settings\User\Application Data\m\shared\SD-Flyout 1.0 Serial.zip
C:\Documents and Settings\User\Application Data\m\shared\ShrinkerStretcher 9.2.zip
C:\Documents and Settings\User\Application Data\m\shared\SnifMon 4.0.107.zip
C:\Documents and Settings\User\Application Data\m\shared\Solar System 3D ScreenSaver 1.zip
C:\Documents and Settings\User\Application Data\m\shared\Sothink Movie DVD Maker 1.0 Build 70424.zip
C:\Documents and Settings\User\Application Data\m\shared\Source Code Scanners for C++ Builder 6 4.0 Patch.zip
C:\Documents and Settings\User\Application Data\m\shared\SpiderZilla 1.6.0.zip
C:\Documents and Settings\User\Application Data\m\shared\SpySites Plus 2.0.zip
C:\Documents and Settings\User\Application Data\m\shared\Spytech PopupAgent 2.10.zip
C:\Documents and Settings\User\Application Data\m\shared\Stationery Selector 1.0.zip
C:\Documents and Settings\User\Application Data\m\shared\Stealth Files 4.0.zip
C:\Documents and Settings\User\Application Data\m\shared\Steelray Project Viewer 3.1.2 Key.zip
C:\Documents and Settings\User\Application Data\m\shared\Stop Watch 1.01.zip
C:\Documents and Settings\User\Application Data\m\shared\Strawberry 1.0.zip
C:\Documents and Settings\User\Application Data\m\shared\Submit It 2000 3.4.zip
C:\Documents and Settings\User\Application Data\m\shared\SuperBot 4.7.0.70 (Key).zip
C:\Documents and Settings\User\Application Data\m\shared\SWF Image Creator 1.0 (Patch).zip
C:\Documents and Settings\User\Application Data\m\shared\Symantec.PC.Anywhere.V11.0.zip
C:\Documents and Settings\User\Application Data\m\shared\Tab BarLaunch 1.45.zip
C:\Documents and Settings\User\Application Data\m\shared\TableSelector 1.0.zip
C:\Documents and Settings\User\Application Data\m\shared\TEE 03.060.zip
C:\Documents and Settings\User\Application Data\m\shared\Teroid Data Grid View Print Control 1.3.zip
C:\Documents and Settings\User\Application Data\m\shared\Test Construction Kit 2.0.zip
C:\Documents and Settings\User\Application Data\m\shared\Thalassoline Aquarium 1.0 With Crack.zip
C:\Documents and Settings\User\Application Data\m\shared\The Definitive Online Poker Strategy 1.zip
C:\Documents and Settings\User\Application Data\m\shared\The Sleuthhound 4.6.3 Serial.zip
C:\Documents and Settings\User\Application Data\m\shared\ThreatMon 1.1 Crack.zip
C:\Documents and Settings\User\Application Data\m\shared\ThumbNailer ActiveX DLL 1.0.5.zip
C:\Documents and Settings\User\Application Data\m\shared\TimeGen Timing Diagram Editor 2.3.1 Key+Serial.zip
C:\Documents and Settings\User\Application Data\m\shared\Tooling Control 1.0.zip
C:\Documents and Settings\User\Application Data\m\shared\Toonworks Deluxe 1.0.408.zip
C:\Documents and Settings\User\Application Data\m\shared\Trident Blade3D 9880 Graphics Driver (Windows 2000) 5.8064.zip
C:\Documents and Settings\User\Application Data\m\shared\Trigonometric Graphs 1.0.zip
C:\Documents and Settings\User\Application Data\m\shared\Triologic Video Player 4.zip
C:\Documents and Settings\User\Application Data\m\shared\TruePianos 1.0.1.zip
C:\Documents and Settings\User\Application Data\m\shared\Tweak Msgr 1.0.4 (Key+Serial).zip
C:\Documents and Settings\User\Application Data\m\shared\Ultralott Powerball and Mega Millions 1.1.7.zip
C:\Documents and Settings\User\Application Data\m\shared\Unreal Tournament 2003 - Daedalus skin.zip
C:\Documents and Settings\User\Application Data\m\shared\Unreal Tournament 2004 CTF Suzis Civil War Map.zip
C:\Documents and Settings\User\Application Data\m\shared\Unreal Tournament 2004 Ego2004 map.zip
C:\Documents and Settings\User\Application Data\m\shared\VCDEasy 3.1.0.zip
C:\Documents and Settings\User\Application Data\m\shared\veerex 0.8.zip
C:\Documents and Settings\User\Application Data\m\shared\VideoCap Live ActiveX Control 2.0.zip
C:\Documents and Settings\User\Application Data\m\shared\VisionLab VCL 3.1 Beta 1.zip
C:\Documents and Settings\User\Application Data\m\shared\W32.Nimda.A@mm Removal Tool 2.0.5.zip
C:\Documents and Settings\User\Application Data\m\shared\WatchetZip! 1.2 (Key+Serial).zip
C:\Documents and Settings\User\Application Data\m\shared\Web Weaver 2005.01.zip
C:\Documents and Settings\User\Application Data\m\shared\Widget watcher 1.2.zip
C:\Documents and Settings\User\Application Data\m\shared\WISCO Word Power 2.0 (Key+Serial).zip
C:\Documents and Settings\User\Application Data\m\shared\Word Wizard Deluxe 2.2.zip
C:\Documents and Settings\User\Application Data\m\shared\YourPIM 1.1 (Patch).zip
C:\Documents and Settings\User\Application Data\m\shared\YouTube Interface 1.0.zip
C:\Documents and Settings\User\Application Data\m\shared\yvReminder 3.0.2256.zip
C:\WINDOWS\system32\ban_list.txt
C:\WINDOWS\system32\drivers\downld
C:\WINDOWS\system32\drivers\downld\113953.exe
C:\WINDOWS\system32\drivers\downld\131421.exe
C:\WINDOWS\system32\drivers\downld\133343.exe
C:\WINDOWS\system32\drivers\downld\1338390.exe
C:\WINDOWS\system32\drivers\downld\1400390.exe
C:\WINDOWS\system32\drivers\downld\1401109.exe
C:\WINDOWS\system32\drivers\downld\1405187.exe
C:\WINDOWS\system32\drivers\downld\1415843.exe
C:\WINDOWS\system32\drivers\downld\1416671.exe
C:\WINDOWS\system32\drivers\downld\1438984.exe
C:\WINDOWS\system32\drivers\downld\144953.exe
C:\WINDOWS\system32\drivers\downld\1462812.exe
C:\WINDOWS\system32\drivers\downld\147140.exe
C:\WINDOWS\system32\drivers\downld\1482687.exe
C:\WINDOWS\system32\drivers\downld\1487656.exe
C:\WINDOWS\system32\drivers\downld\1576656.exe
C:\WINDOWS\system32\drivers\downld\1576875.exe
C:\WINDOWS\system32\drivers\downld\1583140.exe
C:\WINDOWS\system32\drivers\downld\1586359.exe
C:\WINDOWS\system32\drivers\downld\159218.exe
C:\WINDOWS\system32\drivers\downld\1618406.exe
C:\WINDOWS\system32\drivers\downld\1620796.exe
C:\WINDOWS\system32\drivers\downld\164156.exe
C:\WINDOWS\system32\drivers\downld\165406.exe
C:\WINDOWS\system32\drivers\downld\1666796.exe
C:\WINDOWS\system32\drivers\downld\1668781.exe
C:\WINDOWS\system32\drivers\downld\168125.exe
C:\WINDOWS\system32\drivers\downld\1700281.exe
C:\WINDOWS\system32\drivers\downld\170156.exe
C:\WINDOWS\system32\drivers\downld\1739187.exe
C:\WINDOWS\system32\drivers\downld\1743171.exe
C:\WINDOWS\system32\drivers\downld\174562.exe
C:\WINDOWS\system32\drivers\downld\1764328.exe
C:\WINDOWS\system32\drivers\downld\1789734.exe
C:\WINDOWS\system32\drivers\downld\1793937.exe
C:\WINDOWS\system32\drivers\downld\1815843.exe
C:\WINDOWS\system32\drivers\downld\183718.exe
C:\WINDOWS\system32\drivers\downld\1844031.exe
C:\WINDOWS\system32\drivers\downld\1854125.exe
C:\WINDOWS\system32\drivers\downld\1875375.exe
C:\WINDOWS\system32\drivers\downld\187859.exe
C:\WINDOWS\system32\drivers\downld\1904375.exe
C:\WINDOWS\system32\drivers\downld\253093.exe
C:\WINDOWS\system32\drivers\downld\2614890.exe
C:\WINDOWS\system32\drivers\downld\2899546.exe
C:\WINDOWS\system32\drivers\downld\2985406.exe
C:\WINDOWS\system32\drivers\downld\300421.exe
C:\WINDOWS\system32\drivers\downld\305093.exe
C:\WINDOWS\system32\drivers\downld\313156.exe
C:\WINDOWS\system32\drivers\downld\317109.exe
C:\WINDOWS\system32\drivers\downld\361312.exe
C:\WINDOWS\system32\drivers\downld\363359.exe
C:\WINDOWS\system32\drivers\downld\372296.exe
C:\WINDOWS\system32\drivers\downld\375593.exe
C:\WINDOWS\system32\drivers\downld\489312.exe
C:\WINDOWS\system32\drivers\downld\498625.exe
C:\WINDOWS\system32\drivers\downld\501921.exe
C:\WINDOWS\system32\drivers\downld\512171.exe
C:\WINDOWS\system32\drivers\downld\551453.exe
C:\WINDOWS\system32\drivers\downld\566484.exe
C:\WINDOWS\system32\drivers\downld\668093.exe
C:\WINDOWS\system32\drivers\downld\688093.exe
C:\WINDOWS\system32\drivers\downld\900625.exe
C:\WINDOWS\system32\drivers\downld\911187.exe
C:\WINDOWS\system32\drivers\downld\916328.exe
C:\WINDOWS\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\drivers\mdelk.exe
C:\WINDOWS\system32\wintems.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_SROSA
((((((((((((((((((((((((( Files Created from 2008-04-28 to 2008-05-28 )))))))))))))))))))))))))))))))
.
2014-12-05 13:23 . 2014-12-05 13:23 315,392 --a------ C:\WINDOWS\HideWin.exe
2014-12-05 13:23 . 2005-05-03 11:43 69,632 -r------- C:\WINDOWS\Alcmtr.exe
2014-12-05 13:22 . 2006-12-26 13:31 4,864 -ra------ C:\WINDOWS\system32\drivers\PortIo.sys
2011-06-18 12:16 . 2008-05-27 14:47 <DIR> d-------- C:\Program Files\CyberLink
2011-06-18 12:16 . 2008-05-27 15:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\CyberLink
2011-06-18 12:09 . 2011-06-18 12:09 <DIR> d-------- C:\Program Files\Common Files\Nero
2011-06-18 12:05 . 2011-06-18 12:05 <DIR> d-------- C:\Program Files\Common Files\Ahead
2011-06-18 12:05 . 2011-06-18 12:05 <DIR> d-------- C:\Program Files\Ahead
2011-06-18 12:05 . 2004-07-20 16:24 1,568,768 --a------ C:\WINDOWS\system32\ImagX7.dll
2011-06-18 12:05 . 2004-07-20 16:24 476,320 --a------ C:\WINDOWS\system32\ImagXpr7.dll
2011-06-18 12:05 . 2004-07-20 16:24 471,040 --a------ C:\WINDOWS\system32\ImagXRA7.dll
2011-06-18 12:05 . 2004-07-09 08:43 364,544 --a------ C:\WINDOWS\system32\TwnLib4.dll
2011-06-18 12:05 . 2004-07-20 16:24 262,144 --a------ C:\WINDOWS\system32\ImagXR7.dll
2011-06-18 12:05 . 2001-07-09 10:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2011-06-18 12:05 . 2000-06-26 10:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2011-06-18 12:05 . 2001-06-26 07:15 38,912 --a------ C:\WINDOWS\system32\picn20.dll
2011-06-18 11:32 . 2007-12-29 16:04 <DIR> d-------- C:\Program Files\OpenOffice.org 2.0
2011-06-18 11:23 . 2011-06-18 11:23 <DIR> d-------- C:\Program Files\DivX
2011-06-18 10:53 . 2011-06-18 10:53 <DIR> d-------- C:\WINDOWS\system32\Lang
2011-06-18 10:53 . 2011-06-18 10:53 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2011-06-18 10:53 . 2011-06-18 10:53 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2011-06-18 10:50 . 2014-12-05 13:23 <DIR> d-------- C:\Program Files\Realtek
2011-06-18 10:50 . 2008-05-27 15:01 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2011-06-18 10:50 . 2007-07-05 09:08 16,380,416 -r------- C:\WINDOWS\RTHDCPL.exe
2011-06-18 10:50 . 2006-05-04 09:26 2,808,832 -r------- C:\WINDOWS\alcwzrd.exe
2011-06-18 10:50 . 2007-06-28 09:44 2,165,760 -r------- C:\WINDOWS\MicCal.exe
2011-06-18 10:50 . 2007-01-12 09:54 520,192 -r------- C:\WINDOWS\RtlExUpd.dll
2011-06-18 10:50 . 2005-09-21 03:25 299,008 -r------- C:\WINDOWS\system32\ALSndMgr.cpl
2011-06-18 10:46 . 2011-06-18 10:48 <DIR> d-------- C:\WINDOWS\nview
2011-06-18 10:46 . 2006-06-29 08:40 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe
2011-06-18 10:46 . 2008-05-28 19:05 81,191 --a------ C:\WINDOWS\system32\nvapps.xml
2011-06-18 10:46 . 2006-08-16 08:35 17,056 --a------ C:\WINDOWS\system32\nvdisp.nvu
2011-06-18 10:42 . 2006-06-28 10:38 363,008 -ra------ C:\WINDOWS\system32\idecoiins.dll
2011-06-18 10:42 . 2006-06-28 10:38 363,008 -ra------ C:\WINDOWS\system32\idecoi.dll
2011-06-18 10:42 . 2006-06-07 12:49 208,896 --a------ C:\WINDOWS\system32\nvuide.exe
2011-06-18 10:42 . 2006-06-28 10:38 105,088 -ra------ C:\WINDOWS\system32\drivers\nvata.sys
2011-06-18 10:42 . 2006-06-07 12:50 35,840 -ra------ C:\WINDOWS\system32\NVCOI.DLL
2011-06-18 10:42 . 2006-06-01 08:32 1,570 --a------ C:\WINDOWS\system32\nvide.nvu
2011-06-18 10:39 . 2006-07-06 10:39 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2011-06-18 10:38 . 2008-02-10 23:33 <DIR> d-------- C:\WINDOWS\system32\Tools
2011-06-18 10:38 . 2011-06-18 11:25 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2011-06-18 10:35 . 2004-12-29 06:57 17,505 -ra------ C:\DBI.EXE
2008-05-28 19:05 . 2008-05-28 19:05 <DIR> d-------- C:\WINDOWS\system32\drivers\downld
2008-05-28 17:28 . 2008-05-28 17:28 <DIR> d-------- C:\Program Files\Lavasoft
2008-05-28 17:28 . 2008-05-28 17:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-05-28 17:21 . 2008-05-28 17:21 <DIR> d-------- C:\WINDOWS\LastGood.Tmp
2008-05-28 17:21 . 2008-05-28 17:21 <DIR> d-------- C:\Program Files\Panda Security
2008-05-28 17:17 . 2008-05-28 17:18 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-05-28 17:17 . 2008-05-28 17:17 <DIR> d-------- C:\Documents and Settings\User\Application Data\SUPERAntiSpyware.com
2008-05-28 17:17 . 2008-05-28 17:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-05-28 17:15 . 2008-05-28 17:15 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-28 17:15 . 2008-05-28 17:15 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2008-05-28 17:15 . 2008-05-28 17:15 <DIR> d-------- C:\Documents and Settings\User\Application Data\Malwarebytes
2008-05-28 17:15 . 2008-05-28 17:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-28 17:15 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-28 17:15 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-05-28 16:44 . 2008-05-28 16:44 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-28 16:42 . 2008-05-28 17:36 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-28 16:42 . 2008-05-28 16:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-28 15:53 . 2008-05-28 15:53 <DIR> d-------- C:\Program Files\Sunbelt Software
2008-05-28 15:35 . 2008-05-28 15:35 <DIR> d-------- C:\Program Files\Zone Labs
2008-05-28 15:19 . 2008-05-28 15:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\BOC426
2008-05-28 15:19 . 2008-03-28 09:17 212,728 --a------ C:\WINDOWS\CMDLIC.DLL
2008-05-28 15:19 . 2008-03-28 09:16 205,560 --a------ C:\WINDOWS\UNBOC.EXE
2008-05-28 15:19 . 2006-02-28 13:00 22,528 --a------ C:\WINDOWS\system32\wsock32.dlb
2008-05-28 15:19 . 2008-05-28 19:06 7,760 --a------ C:\WINDOWS\BOC426.INI
2008-05-28 14:57 . 2008-05-28 17:29 <DIR> d-------- C:\Program Files\CCleaner
2008-05-28 14:49 . 2007-11-22 15:00 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx
2008-05-28 14:19 . 2008-05-28 14:47 <DIR> d-------- C:\Documents and Settings\User\Application Data\LimeWire
2008-05-27 14:46 . 2008-05-28 13:51 <DIR> d-------- C:\MyWorks
2008-05-26 20:57 . 2008-05-26 20:57 <DIR> d-------- C:\WINDOWS\system32\Adobe
2008-05-22 15:08 . 2008-05-22 15:08 <DIR> d-------- C:\Documents and Settings\User\Application Data\Greyfirst
2008-05-22 15:00 . 2008-05-22 15:00 <DIR> d-------- C:\Program Files\Celtx
2008-05-17 14:46 . 2008-05-17 14:46 <DIR> d-------- C:\Program Files\Eidos Interactive
2008-05-16 11:58 . 2008-05-16 11:58 12,632 --a------ C:\WINDOWS\system32\lsdelete.exe
2008-05-10 20:03 . 2008-05-10 20:03 <DIR> d-------- C:\Program Files\Astonsoft
2008-05-10 20:03 . 2008-05-10 20:18 <DIR> d-------- C:\Documents and Settings\User\Application Data\DeepBurner
2008-05-08 20:28 . 2008-05-08 20:28 <DIR> d-------- C:\Documents and Settings\User\dwhelper
2008-05-08 20:15 . 2008-05-08 20:15 <DIR> d-------- C:\Program Files\Red Kawa
2008-05-04 19:46 . 2008-05-04 19:46 268 --ah----- C:\sqmdata19.sqm
2008-05-04 19:46 . 2008-05-04 19:46 244 --ah----- C:\sqmnoopt19.sqm
2008-05-03 15:29 . 2008-05-03 15:29 268 --ah----- C:\sqmdata18.sqm
2008-05-03 15:29 . 2008-05-03 15:29 244 --ah----- C:\sqmnoopt18.sqm
2008-05-01 00:45 . 2008-05-01 00:45 268 --ah----- C:\sqmdata17.sqm
2008-05-01 00:45 . 2008-05-01 00:45 244 --ah----- C:\sqmnoopt17.sqm
2008-04-29 11:20 . 2008-04-29 11:20 15,648 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2008-04-29 11:19 . 2008-04-29 11:19 15,648 --a------ C:\WINDOWS\system32\drivers\Awrtrd.sys
2008-04-29 11:19 . 2008-04-29 11:19 12,960 --a------ C:\WINDOWS\system32\drivers\Awrtpd.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-16 16:14 --------- d-----w C:\Program Files\microsoft frontpage
2008-05-28 17:51 --------- d-----w C:\Documents and Settings\User\Application Data\Skype
2008-05-28 16:27 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-28 14:21 --------- d-----w C:\Program Files\COMODO
2008-05-28 14:02 --------- d-----w C:\Program Files\eMule
2008-05-28 13:49 1,136,672 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-05-28 13:10 22,681,376 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-28 12:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-05-28 12:09 --------- d-----w C:\Documents and Settings\User\Application Data\skypePM
2008-05-27 22:38 306,956 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-27 22:38 109,412 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-05-27 14:12 --------- d-----w C:\Documents and Settings\User\Application Data\CyberLink
2008-05-11 10:08 --------- d-----w C:\Program Files\Java
2008-05-11 10:01 --------- d-----w C:\Program Files\OpenOffice.org 2.3
2008-05-11 09:54 --------- d-----w C:\Documents and Settings\User\Application Data\OpenOffice.org2
2008-05-10 13:55 --------- d-----w C:\Program Files\IrfanView
2008-04-27 13:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-04-19 00:16 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-04-13 16:59 --------- d-----w C:\Documents and Settings\User\Application Data\Media Player Classic
2008-04-09 17:33 --------- d-----w C:\Program Files\Whale Communications
2008-04-06 22:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP
2008-04-06 22:10 --------- d-----w C:\Program Files\HP
2008-04-06 22:10 --------- d-----w C:\Program Files\Hewlett-Packard
2008-04-06 22:07 --------- d-----w C:\Documents and Settings\User\Application Data\HP
2008-04-03 23:11 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-02 20:07 1,086,952 ----a-w C:\WINDOWS\system32\zpeng24.dll
2008-03-30 22:12 --------- d-----w C:\Documents and Settings\Ru\Application Data\Apple Computer
2008-03-30 14:35 --------- d-----w C:\Program Files\Autodesk
2008-03-30 14:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk
2008-03-30 14:30 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-30 14:28 --------- d-----w C:\Documents and Settings\User\Application Data\Apple Computer
2008-03-30 14:27 --------- d-----w C:\Program Files\QuickTime
2008-03-30 14:27 --------- d-----w C:\Program Files\iTunes
2008-03-30 14:27 --------- d-----w C:\Program Files\iPod
2008-03-30 14:27 --------- d-----w C:\Program Files\Bonjour
2008-03-30 14:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-03-30 14:25 --------- d-----w C:\Program Files\Common Files\Apple
2008-03-30 13:52 --------- d-----w C:\Program Files\SiSoftware
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-04 18:01 6,656 ----a-w C:\WINDOWS\system32\haspvdd.dll
2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-01-07 20:12 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2004-03-07 07:30 16 ----a-w C:\Documents and Settings\User\Application Data\QNVW601P.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 13:00 15360]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-07 16:08 21686568]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2004-05-07 09:03 655360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-05-28 17:35 2097488]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-02-27 11:39 1310720]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-16 08:35 7630848]
"nwiz"="nwiz.exe" [2006-08-16 08:35 1617920 C:\WINDOWS\system32\nwiz.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-12-08 17:35 32768]
"SkyTel"="SkyTel.EXE" [2007-06-15 09:45 1826816 C:\WINDOWS\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 09:08 16380416 C:\WINDOWS\RTHDCPL.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-16 08:35 86016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]
"HPHUPD08"="c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-17 01:26 49152]
"HP Software Update"="c:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152]
"BOC-426"="C:\PROGRA~1\Comodo\CBOClean\BOC426.exe" [2008-04-10 11:08 351480]
C:\Documents and Settings\User\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 23:23:26 282624]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-02-27 11:39 282624 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.dvsd"= C:\Program Files\Common Files\Sony Shared\VideoLib\sonydv.dll
"SENTINEL"= snti386.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Kaspersky Lab\\Kaspersky Internet Security 7.0\\avp.exe"=
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XII.SP1\\Win32\\RpcDataSrv.exe"=
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XII.SP1\\RpcSandraSrv.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\CyberLink\\PowerDirector\\PDR.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 10:21]
R2 sfmgr;CaReTaKeR-CT NetMgr 1.2.1;C:\sfmgr\sfmgr.exe [2004-02-11 12:51]
R3 msloop;Microsoft Loopback Adapter Driver;C:\WINDOWS\system32\DRIVERS\loop.sys [2001-08-17 14:53]
S2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" [2007-04-26 10:21]
S3 DMService;Whale Component Manager;C:\WINDOWS\DOWNLO~1\DMService.exe [2008-04-09 18:33]
S3 ICScsiSV;Image Converter SCSI Service;C:\Program Files\Sony\IMAGE CONVERTER 3\ICScsiSV.exe [2007-01-26 12:39]
S3 IcVzMonLauncher;IcVzMonLauncher;"C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMonLauncher.exe" [2007-01-26 12:38]
S3 Image Converter video recording monitor for VAIO Entertainment;Image Converter video recording monitor for VAIO Entertainment;C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMon.exe [2007-01-26 12:38]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys []
S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\system32\svchost.exe [2006-02-28 13:00]
S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\system32\svchost.exe [2006-02-28 13:00]
S3 p2psvc;Peer Networking;C:\WINDOWS\system32\svchost.exe [2006-02-28 13:00]
S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\system32\svchost.exe [2006-02-28 13:00]
S4 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 10:21]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
Contents of the 'Scheduled Tasks' folder
"2008-02-14 22:16:41 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-28 19:05:26
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\COMODO\CBOClean\BOCore.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
.
**************************************************************************
.
Completion time: 2008-05-28 19:15:22 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-28 18:15:17
Pre-Run: 132,876,648,448 bytes free
Post-Run: 132,257,488,896 bytes free
532 --- E O F --- 2008-05-28 14:22:55
And...
HijackThis Log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:09:06, on 28/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Comodo\CBOClean\BOCORE.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\sfmgr\sfmgr.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Comodo\CBOClean\BOC426.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
c:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\User\Application Data\m\flec006.exe
C:\Program Files\HijackThis\telering.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virginmedia.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [BOC-426] C:\PROGRA~1\Comodo\CBOClean\BOC426.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {8D9563A9-8D5F-459B-87F2-BA842255CB9A} (Whale Client Components) - https://myplace5.gdst.net/InternalSite/WhlCompMgr.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: BOCore - COMODO - C:\Program Files\Comodo\CBOClean\BOCORE.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Image Converter SCSI Service (ICScsiSV) - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\ICScsiSV.exe
O23 - Service: IcVzMonLauncher - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMonLauncher.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\RpcSandraSrv.exe
O23 - Service: CaReTaKeR-CT NetMgr 1.2.1 (sfmgr) - Unknown owner - C:\sfmgr\sfmgr.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
--
End of file - 9660 bytes
Also: before you replied with the Combofix advice, I managed to run some other programs. Don't know if that was wise or not; either way, some more logs are below:
Malwarebytes' Anti-Malware 1.12
Database version: 794
Scan type: Quick Scan
Objects scanned: 37270
Time elapsed: 3 minute(s), 21 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\mule_st_key (Trojan.Agent) -> Delete on reboot.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\system32\drivers\srosa.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mdelk.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wintems.exe (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\drivers\hldrrr.exe (Rootkit.Agent) -> Delete on reboot.
C:\Documents and Settings\User\Application Data\m\flec006.exe (Trojan.Agent) -> Delete on reboot.
SUPERAntiSpyware Scan Log
Generated 05/28/2008 at 06:47 PM
Application Version : 3.6.1000
Core Rules Database Version : 3469
Trace Rules Database Version: 1460
Scan type : Complete Scan
Total Scan Time : 01:27:37
Memory items scanned : 449
Memory threats detected : 1
Registry items scanned : 6102
Registry threats detected : 0
File items scanned : 75860
File threats detected : 2
Worm.Bagle/Beagle
C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\M\FLEC006.EXE
Trojan.Unknown Origin
C:\SYSTEM VOLUME INFORMATION\_RESTORE{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP113\A0028755.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP114\A0028877.EXE
The ComboFix log is showing up a whole load of zip files in a mysterious folder called "m" in my main App Data folder; is this another effect of what I believe to be the Bagle virus?
Hi
Yes, it is.
Open notepad and copy/paste the text in the quotebox below into it:
Folder::
C:\WINDOWS\system32\drivers\downld
C:\Documents and Settings\User\Application Data\m
Save this as
CFScript
http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif
Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.
Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.
Download ATF (Atribune Temp File) Cleaner© by Atribune (http://www.atribune.org/ccount/click.php?id=1) to your desktop.
Double-click ATF Cleaner.exe to open it
Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.
If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
Click Exit on the Main menu to close the program.
Run Kaspersky online scanner and post back its report & a fresh hjt log (without forgetting above meantioned ComboFix resultant log).
Coolio. Things are looking up; IE is working, along with a number of previously inactive anti-malware programs.
ComboFix Log
ComboFix 08-05-27.4 - User 2008-05-28 20:37:56.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1282 [GMT 1:00]
Running from: C:\Documents and Settings\User\My Documents\CmboFix.exe
Command switches used :: C:\Documents and Settings\User\My Documents\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\Documents and Settings\User\Application Data\ :#:
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\drivers\downld
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_SROSA
((((((((((((((((((((((((( Files Created from 2008-04-28 to 2008-05-28 )))))))))))))))))))))))))))))))
.
2014-12-05 13:23 . 2014-12-05 13:23 315,392 --a------ C:\WINDOWS\HideWin.exe
2014-12-05 13:23 . 2005-05-03 11:43 69,632 -r------- C:\WINDOWS\Alcmtr.exe
2014-12-05 13:22 . 2006-12-26 13:31 4,864 -ra------ C:\WINDOWS\system32\drivers\PortIo.sys
2011-06-18 12:16 . 2008-05-27 14:47 <DIR> d-------- C:\Program Files\CyberLink
2011-06-18 12:16 . 2008-05-27 15:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\CyberLink
2011-06-18 12:09 . 2011-06-18 12:09 <DIR> d-------- C:\Program Files\Common Files\Nero
2011-06-18 12:05 . 2011-06-18 12:05 <DIR> d-------- C:\Program Files\Common Files\Ahead
2011-06-18 12:05 . 2011-06-18 12:05 <DIR> d-------- C:\Program Files\Ahead
2011-06-18 12:05 . 2004-07-20 16:24 1,568,768 --a------ C:\WINDOWS\system32\ImagX7.dll
2011-06-18 12:05 . 2004-07-20 16:24 476,320 --a------ C:\WINDOWS\system32\ImagXpr7.dll
2011-06-18 12:05 . 2004-07-20 16:24 471,040 --a------ C:\WINDOWS\system32\ImagXRA7.dll
2011-06-18 12:05 . 2004-07-09 08:43 364,544 --a------ C:\WINDOWS\system32\TwnLib4.dll
2011-06-18 12:05 . 2004-07-20 16:24 262,144 --a------ C:\WINDOWS\system32\ImagXR7.dll
2011-06-18 12:05 . 2001-07-09 10:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2011-06-18 12:05 . 2000-06-26 10:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2011-06-18 12:05 . 2001-06-26 07:15 38,912 --a------ C:\WINDOWS\system32\picn20.dll
2011-06-18 11:32 . 2007-12-29 16:04 <DIR> d-------- C:\Program Files\OpenOffice.org 2.0
2011-06-18 11:23 . 2011-06-18 11:23 <DIR> d-------- C:\Program Files\DivX
2011-06-18 10:53 . 2011-06-18 10:53 <DIR> d-------- C:\WINDOWS\system32\Lang
2011-06-18 10:53 . 2011-06-18 10:53 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2011-06-18 10:53 . 2011-06-18 10:53 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2011-06-18 10:50 . 2014-12-05 13:23 <DIR> d-------- C:\Program Files\Realtek
2011-06-18 10:50 . 2008-05-27 15:01 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2011-06-18 10:50 . 2007-07-05 09:08 16,380,416 -r------- C:\WINDOWS\RTHDCPL.exe
2011-06-18 10:50 . 2006-05-04 09:26 2,808,832 -r------- C:\WINDOWS\alcwzrd.exe
2011-06-18 10:50 . 2007-06-28 09:44 2,165,760 -r------- C:\WINDOWS\MicCal.exe
2011-06-18 10:50 . 2007-01-12 09:54 520,192 -r------- C:\WINDOWS\RtlExUpd.dll
2011-06-18 10:50 . 2005-09-21 03:25 299,008 -r------- C:\WINDOWS\system32\ALSndMgr.cpl
2011-06-18 10:46 . 2011-06-18 10:48 <DIR> d-------- C:\WINDOWS\nview
2011-06-18 10:46 . 2006-06-29 08:40 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe
2011-06-18 10:46 . 2008-05-28 21:04 81,191 --a------ C:\WINDOWS\system32\nvapps.xml
2011-06-18 10:46 . 2006-08-16 08:35 17,056 --a------ C:\WINDOWS\system32\nvdisp.nvu
2011-06-18 10:42 . 2006-06-28 10:38 363,008 -ra------ C:\WINDOWS\system32\idecoiins.dll
2011-06-18 10:42 . 2006-06-28 10:38 363,008 -ra------ C:\WINDOWS\system32\idecoi.dll
2011-06-18 10:42 . 2006-06-07 12:49 208,896 --a------ C:\WINDOWS\system32\nvuide.exe
2011-06-18 10:42 . 2006-06-28 10:38 105,088 -ra------ C:\WINDOWS\system32\drivers\nvata.sys
2011-06-18 10:42 . 2006-06-07 12:50 35,840 -ra------ C:\WINDOWS\system32\NVCOI.DLL
2011-06-18 10:42 . 2006-06-01 08:32 1,570 --a------ C:\WINDOWS\system32\nvide.nvu
2011-06-18 10:39 . 2006-07-06 10:39 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2011-06-18 10:38 . 2008-02-10 23:33 <DIR> d-------- C:\WINDOWS\system32\Tools
2011-06-18 10:38 . 2011-06-18 11:25 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2011-06-18 10:35 . 2004-12-29 06:57 17,505 -ra------ C:\DBI.EXE
2008-05-28 21:04 . 2008-05-28 21:04 <DIR> d-------- C:\WINDOWS\system32\drivers\downld
2008-05-28 19:44 . 2008-05-28 19:43 73,728 --a------ C:\WINDOWS\system32\CavEmLSP.dll
2008-05-28 19:43 . 2008-05-28 19:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Comodo
2008-05-28 19:43 . 2008-05-28 19:43 434,252 --a------ C:\WINDOWS\system32\MSVCRTD.DLL
2008-05-28 19:43 . 2008-05-28 19:43 216,576 --a------ C:\WINDOWS\system32\monln.dll
2008-05-28 19:43 . 2008-05-28 19:43 102,400 --a------ C:\WINDOWS\system32\drivers\cavasm.sys
2008-05-28 17:28 . 2008-05-28 17:28 <DIR> d-------- C:\Program Files\Lavasoft
2008-05-28 17:28 . 2008-05-28 17:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-05-28 17:21 . 2008-05-28 17:21 <DIR> d-------- C:\Program Files\Panda Security
2008-05-28 17:17 . 2008-05-28 19:47 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-05-28 17:17 . 2008-05-28 17:17 <DIR> d-------- C:\Documents and Settings\User\Application Data\SUPERAntiSpyware.com
2008-05-28 17:17 . 2008-05-28 17:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-05-28 17:15 . 2008-05-28 17:15 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-28 17:15 . 2008-05-28 17:15 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2008-05-28 17:15 . 2008-05-28 17:15 <DIR> d-------- C:\Documents and Settings\User\Application Data\Malwarebytes
2008-05-28 17:15 . 2008-05-28 17:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-28 17:15 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-28 17:15 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-05-28 16:44 . 2008-05-28 16:44 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-28 16:42 . 2008-05-28 17:36 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-28 16:42 . 2008-05-28 16:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-28 15:53 . 2008-05-28 15:53 <DIR> d-------- C:\Program Files\Sunbelt Software
2008-05-28 15:35 . 2008-05-28 15:35 <DIR> d-------- C:\Program Files\Zone Labs
2008-05-28 15:19 . 2008-05-28 15:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\BOC426
2008-05-28 15:19 . 2008-03-28 09:17 212,728 --a------ C:\WINDOWS\CMDLIC.DLL
2008-05-28 15:19 . 2008-03-28 09:16 205,560 --a------ C:\WINDOWS\UNBOC.EXE
2008-05-28 15:19 . 2006-02-28 13:00 22,528 --a------ C:\WINDOWS\system32\wsock32.dlb
2008-05-28 15:19 . 2008-05-28 21:04 9,475 --a------ C:\WINDOWS\BOC426.INI
2008-05-28 14:57 . 2008-05-28 17:29 <DIR> d-------- C:\Program Files\CCleaner
2008-05-28 14:49 . 2007-11-22 15:00 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx
2008-05-28 14:19 . 2008-05-28 14:47 <DIR> d-------- C:\Documents and Settings\User\Application Data\LimeWire
2008-05-27 14:46 . 2008-05-28 13:51 <DIR> d-------- C:\MyWorks
2008-05-26 20:57 . 2008-05-26 20:57 <DIR> d-------- C:\WINDOWS\system32\Adobe
2008-05-22 15:08 . 2008-05-22 15:08 <DIR> d-------- C:\Documents and Settings\User\Application Data\Greyfirst
2008-05-22 15:00 . 2008-05-22 15:00 <DIR> d-------- C:\Program Files\Celtx
2008-05-17 14:46 . 2008-05-17 14:46 <DIR> d-------- C:\Program Files\Eidos Interactive
2008-05-16 11:58 . 2008-05-16 11:58 12,632 --a------ C:\WINDOWS\system32\lsdelete.exe
2008-05-10 20:03 . 2008-05-10 20:03 <DIR> d-------- C:\Program Files\Astonsoft
2008-05-10 20:03 . 2008-05-10 20:18 <DIR> d-------- C:\Documents and Settings\User\Application Data\DeepBurner
2008-05-08 20:28 . 2008-05-08 20:28 <DIR> d-------- C:\Documents and Settings\User\dwhelper
2008-05-08 20:15 . 2008-05-08 20:15 <DIR> d-------- C:\Program Files\Red Kawa
2008-05-04 19:46 . 2008-05-04 19:46 268 --ah----- C:\sqmdata19.sqm
2008-05-04 19:46 . 2008-05-04 19:46 244 --ah----- C:\sqmnoopt19.sqm
2008-05-03 15:29 . 2008-05-03 15:29 268 --ah----- C:\sqmdata18.sqm
2008-05-03 15:29 . 2008-05-03 15:29 244 --ah----- C:\sqmnoopt18.sqm
2008-05-01 00:45 . 2008-05-01 00:45 268 --ah----- C:\sqmdata17.sqm
2008-05-01 00:45 . 2008-05-01 00:45 244 --ah----- C:\sqmnoopt17.sqm
2008-04-29 11:20 . 2008-04-29 11:20 15,648 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2008-04-29 11:19 . 2008-04-29 11:19 15,648 --a------ C:\WINDOWS\system32\drivers\Awrtrd.sys
2008-04-29 11:19 . 2008-04-29 11:19 12,960 --a------ C:\WINDOWS\system32\drivers\Awrtpd.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-16 16:14 --------- d-----w C:\Program Files\microsoft frontpage
2008-05-28 19:49 --------- d-----w C:\Documents and Settings\User\Application Data\Skype
2008-05-28 18:43 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-05-28 18:43 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-05-28 18:43 1,060,864 ----a-w C:\WINDOWS\system32\MFC71.dll
2008-05-28 18:43 --------- d-----w C:\Program Files\COMODO
2008-05-28 16:27 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-28 14:02 --------- d-----w C:\Program Files\eMule
2008-05-28 13:49 1,136,672 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-05-28 13:10 22,681,376 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-28 12:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-05-28 12:09 --------- d-----w C:\Documents and Settings\User\Application Data\skypePM
2008-05-27 22:38 306,956 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-27 22:38 109,412 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-05-27 14:12 --------- d-----w C:\Documents and Settings\User\Application Data\CyberLink
2008-05-11 10:08 --------- d-----w C:\Program Files\Java
2008-05-11 10:01 --------- d-----w C:\Program Files\OpenOffice.org 2.3
2008-05-11 09:54 --------- d-----w C:\Documents and Settings\User\Application Data\OpenOffice.org2
2008-05-10 13:55 --------- d-----w C:\Program Files\IrfanView
2008-04-27 13:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-04-19 00:16 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-04-13 16:59 --------- d-----w C:\Documents and Settings\User\Application Data\Media Player Classic
2008-04-09 17:33 --------- d-----w C:\Program Files\Whale Communications
2008-04-06 22:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP
2008-04-06 22:10 --------- d-----w C:\Program Files\HP
2008-04-06 22:10 --------- d-----w C:\Program Files\Hewlett-Packard
2008-04-06 22:07 --------- d-----w C:\Documents and Settings\User\Application Data\HP
2008-04-03 23:11 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-02 20:07 1,086,952 ----a-w C:\WINDOWS\system32\zpeng24.dll
2008-03-30 22:12 --------- d-----w C:\Documents and Settings\Ru\Application Data\Apple Computer
2008-03-30 14:35 --------- d-----w C:\Program Files\Autodesk
2008-03-30 14:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk
2008-03-30 14:30 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-30 14:28 --------- d-----w C:\Documents and Settings\User\Application Data\Apple Computer
2008-03-30 14:27 --------- d-----w C:\Program Files\QuickTime
2008-03-30 14:27 --------- d-----w C:\Program Files\iTunes
2008-03-30 14:27 --------- d-----w C:\Program Files\iPod
2008-03-30 14:27 --------- d-----w C:\Program Files\Bonjour
2008-03-30 14:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-03-30 14:25 --------- d-----w C:\Program Files\Common Files\Apple
2008-03-30 13:52 --------- d-----w C:\Program Files\SiSoftware
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-04 18:01 6,656 ----a-w C:\WINDOWS\system32\haspvdd.dll
2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-01-07 20:12 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2004-03-07 07:30 16 ----a-w C:\Documents and Settings\User\Application Data\QNVW601P.dll
.
((((((((((((((((((((((((((((( snapshot@2008-05-28_19.09.47.40 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-28 18:04:42 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-28 20:04:14 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2008-05-28 14:52:57 4,258 ----a-w C:\WINDOWS\SoftwareDistribution\EventCache\{D372A5A1-1928-4D87-97EE-B87108A85D08}.bin
+ 2008-05-28 14:52:57 5,682 ----a-w C:\WINDOWS\SoftwareDistribution\EventCache\{D372A5A1-1928-4D87-97EE-B87108A85D08}.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 13:00 15360]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-07 16:08 21686568]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2004-05-07 09:03 655360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-05-28 17:35 2097488]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-16 08:35 7630848]
"nwiz"="nwiz.exe" [2006-08-16 08:35 1617920 C:\WINDOWS\system32\nwiz.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-12-08 17:35 32768]
"SkyTel"="SkyTel.EXE" [2007-06-15 09:45 1826816 C:\WINDOWS\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 09:08 16380416 C:\WINDOWS\RTHDCPL.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-16 08:35 86016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]
"HPHUPD08"="c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-17 01:26 49152]
"HP Software Update"="c:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152]
"BOC-426"="C:\PROGRA~1\Comodo\CBOClean\BOC426.exe" [2008-04-10 11:08 351480]
"cnfgCav"="C:\Program Files\Comodo\Comodo AntiVirus\CMain.exe" [2008-05-28 19:43 110592]
C:\Documents and Settings\User\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 23:23:26 282624]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\monln]
monln.dll 2008-05-28 19:43 216576 C:\WINDOWS\system32\monln.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.dvsd"= C:\Program Files\Common Files\Sony Shared\VideoLib\sonydv.dll
"SENTINEL"= snti386.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Kaspersky Lab\\Kaspersky Internet Security 7.0\\avp.exe"=
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XII.SP1\\Win32\\RpcDataSrv.exe"=
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XII.SP1\\RpcSandraSrv.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\CyberLink\\PowerDirector\\PDR.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 10:21]
R2 sfmgr;CaReTaKeR-CT NetMgr 1.2.1;C:\sfmgr\sfmgr.exe [2004-02-11 12:51]
R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" [2007-04-26 10:21]
R3 msloop;Microsoft Loopback Adapter Driver;C:\WINDOWS\system32\DRIVERS\loop.sys [2001-08-17 14:53]
S3 DMService;Whale Component Manager;C:\WINDOWS\DOWNLO~1\DMService.exe [2008-04-09 18:33]
S3 ICScsiSV;Image Converter SCSI Service;C:\Program Files\Sony\IMAGE CONVERTER 3\ICScsiSV.exe [2007-01-26 12:39]
S3 IcVzMonLauncher;IcVzMonLauncher;"C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMonLauncher.exe" [2007-01-26 12:38]
S3 Image Converter video recording monitor for VAIO Entertainment;Image Converter video recording monitor for VAIO Entertainment;C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMon.exe [2007-01-26 12:38]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys []
S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\system32\svchost.exe [2006-02-28 13:00]
S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\system32\svchost.exe [2006-02-28 13:00]
S3 p2psvc;Peer Networking;C:\WINDOWS\system32\svchost.exe [2006-02-28 13:00]
S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\system32\svchost.exe [2006-02-28 13:00]
S4 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 10:21]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
Contents of the 'Scheduled Tasks' folder
"2008-02-14 22:16:41 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-28 21:04:42
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\COMODO\CBOClean\BOCore.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\COMODO\Common\CAVASpy\cavasm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\COMODO\Comodo AntiVirus\cavse.exe
C:\Program Files\COMODO\Comodo AntiVirus\cavse.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\COMODO\Comodo AntiVirus\CavAUD.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\verclsid.exe
.
**************************************************************************
.
Completion time: 2008-05-28 21:09:46 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-28 20:09:39
ComboFix2.txt 2008-05-28 18:15:24
Pre-Run: 132,115,300,352 bytes free
Post-Run: 132,191,006,720 bytes free
285 --- E O F --- 2008-05-28 14:22:55
Kaspersky Log is attached
HijackThis Log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:53:41, on 28/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Comodo\CBOClean\BOC426.exe
C:\Program Files\Comodo\Comodo AntiVirus\CMain.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
c:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Comodo\CBOClean\BOCORE.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Comodo\common\CAVASpy\cavasm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\sfmgr\sfmgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Comodo\Comodo AntiVirus\Cavaud.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Comodo\Comodo AntiVirus\CAVSubmit.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Documents and Settings\User\My Documents\telering.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virginmedia.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [BOC-426] C:\PROGRA~1\Comodo\CBOClean\BOC426.exe
O4 - HKLM\..\Run: [cnfgCav] "C:\Program Files\Comodo\Comodo AntiVirus\CMain.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {8D9563A9-8D5F-459B-87F2-BA842255CB9A} (Whale Client Components) - https://myplace5.gdst.net/InternalSite/WhlCompMgr.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: monln - C:\WINDOWS\SYSTEM32\monln.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: BOCore - COMODO - C:\Program Files\Comodo\CBOClean\BOCORE.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Comodo Anti-Virus and Anti-Spyware Service - Comodo Inc. - C:\Program Files\Comodo\common\CAVASpy\cavasm.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Image Converter SCSI Service (ICScsiSV) - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\ICScsiSV.exe
O23 - Service: IcVzMonLauncher - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMonLauncher.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\RpcSandraSrv.exe
O23 - Service: CaReTaKeR-CT NetMgr 1.2.1 (sfmgr) - Unknown owner - C:\sfmgr\sfmgr.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
--
End of file - 10377 bytes
A more helpful version of the Kasp Log:
KASPERSKY ONLINE SCANNER REPORT
Wednesday, May 28, 2008 10:51:01 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 28/05/2008
Kaspersky Anti-Virus database records: 808891
Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
C:\
D:\
E:\
F:\
G:\
Scan Statistics
Total number of scanned objects 92320
Number of viruses found 6
Number of infected objects 495
Number of suspicious objects 0
Duration of the scan process 01:05:58
Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\Comodo\Comodo AntiVirus\cav.lock Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Comodo\Comodo AntiVirus\Reports\CAVSubmit\submit.Log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Comodo\Comodo AntiVirus\TroubleShootLog\cavasm.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Comodo\Comodo AntiVirus\TroubleShootLog\monln.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\u6ptr2vu.default\cert8.db Object is locked skipped
C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\u6ptr2vu.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\u6ptr2vu.default\history.dat Object is locked skipped
C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\u6ptr2vu.default\key3.db Object is locked skipped
C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\u6ptr2vu.default\parent.lock Object is locked skipped
C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\u6ptr2vu.default\search.sqlite Object is locked skipped
C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\u6ptr2vu.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\User\Application Data\Skype\zed.sibanda\call256.dbb Object is locked skipped
C:\Documents and Settings\User\Application Data\Skype\zed.sibanda\callmember256.dbb Object is locked skipped
C:\Documents and Settings\User\Application Data\Skype\zed.sibanda\chat512.dbb Object is locked skipped
C:\Documents and Settings\User\Application Data\Skype\zed.sibanda\chatmember256.dbb Object is locked skipped
C:\Documents and Settings\User\Application Data\Skype\zed.sibanda\chatmsg256.dbb Object is locked skipped
C:\Documents and Settings\User\Application Data\Skype\zed.sibanda\contactgroup256.dbb Object is locked skipped
C:\Documents and Settings\User\Application Data\Skype\zed.sibanda\dyncontent\bundle.dat Object is locked skipped
C:\Documents and Settings\User\Application Data\Skype\zed.sibanda\index2.dat Object is locked skipped
C:\Documents and Settings\User\Application Data\Skype\zed.sibanda\profile256.dbb Object is locked skipped
C:\Documents and Settings\User\Application Data\Skype\zed.sibanda\user1024.dbb Object is locked skipped
C:\Documents and Settings\User\Application Data\Skype\zed.sibanda\user16384.dbb Object is locked skipped
C:\Documents and Settings\User\Application Data\Skype\zed.sibanda\voicemail256.dbb Object is locked skipped
C:\Documents and Settings\User\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Messenger\nashx@eyesonff.com\SharingMetadata\Logs\Dfsr00002.log Object is locked skipped
C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Messenger\nashx@eyesonff.com\SharingMetadata\pending.dat Object is locked skipped
C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Messenger\nashx@eyesonff.com\SharingMetadata\Working\database_1044_79CA_4479_B2D8\dfsr.db Object is locked skipped
C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Messenger\nashx@eyesonff.com\SharingMetadata\Working\database_1044_79CA_4479_B2D8\fsr.log Object is locked skipped
C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Messenger\nashx@eyesonff.com\SharingMetadata\Working\database_1044_79CA_4479_B2D8\fsrtmp.log Object is locked skipped
C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Messenger\nashx@eyesonff.com\SharingMetadata\Working\database_1044_79CA_4479_B2D8\tmp.edb Object is locked skipped
C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Windows Live Contacts\nashx@eyesonff.com\real\members.stg Object is locked skipped
C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Windows Live Contacts\nashx@eyesonff.com\shadow\members.stg Object is locked skipped
C:\Documents and Settings\User\Local Settings\Application Data\Mozilla\Firefox\Profiles\u6ptr2vu.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\User\Local Settings\Application Data\Mozilla\Firefox\Profiles\u6ptr2vu.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\User\Local Settings\Application Data\Mozilla\Firefox\Profiles\u6ptr2vu.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\User\Local Settings\Application Data\Mozilla\Firefox\Profiles\u6ptr2vu.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\User\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\User\Local Settings\History\History.IE5\MSHist012008052820080529\index.dat Object is locked skipped
C:\Documents and Settings\User\Local Settings\Temp\hpodvd09.log Object is locked skipped
C:\Documents and Settings\User\Local Settings\Temp\_hphtra07.log Object is locked skipped
C:\Documents and Settings\User\Local Settings\Temp\~DF824F.tmp Object is locked skipped
C:\Documents and Settings\User\Local Settings\Temp\~DF8277.tmp Object is locked skipped
C:\Documents and Settings\User\Local Settings\Temp\~DF8E6A.tmp Object is locked skipped
C:\Documents and Settings\User\Local Settings\Temp\~DF8EB0.tmp Object is locked skipped
C:\Documents and Settings\User\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\User\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\User\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\000-235 Downloadable Exam Simulator 2.1 [Crack].zip.vir/000-235 Downloadable Exam Simulator 2.1 [Crack].exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\000-235 Downloadable Exam Simulator 2.1 [Crack].zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\123 Hidden Sender 3.15.zip.vir/123 Hidden Sender 3.15.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\123 Hidden Sender 3.15.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\2D Ghost Forest Interactive Saver 3.0.zip.vir/2D Ghost Forest Interactive Saver 3.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\2D Ghost Forest Interactive Saver 3.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\310-880 - Sun Certified Senior System Support Engineer Practice Exam Questions 1.0 With Crack.zip.vir/310-880 - Sun Certified Senior System Support Engineer Practice Exam Questions 1.0 With Crack.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\310-880 - Sun Certified Senior System Support Engineer Practice Exam Questions 1.0 With Crack.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\3D Outer Space 1.zip.vir/3D Outer Space 1.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\3D Outer Space 1.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\A+ Screensaver Creator 3.25.zip.vir/A+ Screensaver Creator 3.25.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\A+ Screensaver Creator 3.25.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\a-40 1.4.zip.vir/a-40 1.4.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\a-40 1.4.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\A-Z Typing Test 1.1.zip.vir/A-Z Typing Test 1.1.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\A-Z Typing Test 1.1.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\aBetterMail 1.2.zip.vir/aBetterMail 1.2.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\aBetterMail 1.2.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ABF Photo Camera 1.01 [Key+Serial].zip.vir/ABF Photo Camera 1.01 [Key+Serial].exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ABF Photo Camera 1.01 [Key+Serial].zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Aliens vs Predator 2 Single-Player Map update 1.0.zip.vir/Aliens vs Predator 2 Single-Player Map update 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Aliens vs Predator 2 Single-Player Map update 1.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\AMI Pagan Daybook II 4.0j.zip.vir/AMI Pagan Daybook II 4.0j.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\AMI Pagan Daybook II 4.0j.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Annalisa 1.0 KeyGen.zip.vir/Annalisa 1.0 KeyGen.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Annalisa 1.0 KeyGen.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ANPOP POP3 COMPONENT BUILD 7.0.zip.vir/ANPOP POP3 COMPONENT BUILD 7.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ANPOP POP3 COMPONENT BUILD 7.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Anti-Secure Ultimate Password Recovery 1.0.zip.vir/Anti-Secure Ultimate Password Recovery 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Anti-Secure Ultimate Password Recovery 1.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\AnyBackup FTP Edition 1.75.zip.vir/AnyBackup FTP Edition 1.75.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\AnyBackup FTP Edition 1.75.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ARELIS 4.4.2 Patch.zip.vir/ARELIS 4.4.2 Patch.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ARELIS 4.4.2 Patch.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Arithmetris 1.0.zip.vir/Arithmetris 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Arithmetris 1.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ArtRage 2.2.zip.vir/ArtRage 2.2.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ArtRage 2.2.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\AspEasyPDF 3.3.zip.vir/AspEasyPDF 3.3.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\AspEasyPDF 3.3.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Aspose.PDF.Kit for Java 2.2.0.0.zip.vir/Aspose.PDF.Kit for Java 2.2.0.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Aspose.PDF.Kit for Java 2.2.0.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Assessor for Teachers 6.1.zip.vir/Assessor for Teachers 6.1.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Assessor for Teachers 6.1.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ATM 2.0.zip.vir/ATM 2.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ATM 2.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Attribute Editor Wizard 1.0.zip.vir/Attribute Editor Wizard 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Attribute Editor Wizard 1.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Avatar Boy 1.0.zip.vir/Avatar Boy 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Avatar Boy 1.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Avex DVD to PSP Video Suite 4.5.02 [Serial].zip.vir/Avex DVD to PSP Video Suite 4.5.02 [Serial].exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Avex DVD to PSP Video Suite 4.5.02 [Serial].zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\AVI Extractor 1.0 (Crack).zip.vir/AVI Extractor 1.0 (Crack).exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\AVI Extractor 1.0 (Crack).zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Avira.AntiVir.Premium.7.01-www.anti.zip.vir/Avira.AntiVir.Premium.7.01-www.anti.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Avira.AntiVir.Premium.7.01-www.anti.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Banana Lotto Picker 1.0.zip.vir/Banana Lotto Picker 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Banana Lotto Picker 1.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\BarSim 1.5.1.zip.vir/BarSim 1.5.1.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\BarSim 1.5.1.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\BatControls 1.5.zip.vir/BatControls 1.5.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\BatControls 1.5.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Beautiful Coastlines 1.1 (KeyGen).zip.vir/Beautiful Coastlines 1.1 (KeyGen).exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Beautiful Coastlines 1.1 (KeyGen).zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Beautiful Sunsets 1.1 Serial.zip.vir/Beautiful Sunsets 1.1 Serial.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Beautiful Sunsets 1.1 Serial.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\BigSpeed Zip DLL 3.02 (KeyGen).zip.vir/BigSpeed Zip DLL 3.02 (KeyGen).exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\BigSpeed Zip DLL 3.02 (KeyGen).zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Bounty Alien 2 1.zip.vir/Bounty Alien 2 1.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Bounty Alien 2 1.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Button Blast 2.0.zip.vir/Button Blast 2.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Button Blast 2.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\CAD OCX 1.0.zip.vir/CAD OCX 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\CAD OCX 1.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Captain Mnemo Lite 1.2.zip.vir/Captain Mnemo Lite 1.2.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Captain Mnemo Lite 1.2.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Ccy Cookies Remover 2.0.4.zip.vir/Ccy Cookies Remover 2.0.4.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Ccy Cookies Remover 2.0.4.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\CD Player Maximus 3.4.zip.vir/CD Player Maximus 3.4.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\CD Player Maximus 3.4.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Chilkat Mail DOS Command 6.0.0 [Cracked].zip.vir/Chilkat Mail DOS Command 6.0.0 [Cracked].exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Chilkat Mail DOS Command 6.0.0 [Cracked].zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\China Culture ScreenSaver 1.5.zip.vir/China Culture ScreenSaver 1.5.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\China Culture ScreenSaver 1.5.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Chronos 1.2.2.5 [Key+Serial].zip.vir/Chronos 1.2.2.5 [Key+Serial].exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Chronos 1.2.2.5 [Key+Serial].zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\cineSync 1.1.zip.vir/cineSync 1.1.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\cineSync 1.1.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ClinicGate Standard 2.8.zip.vir/ClinicGate Standard 2.8.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ClinicGate Standard 2.8.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Comic Book Manager 1.11 [Patch].zip.vir/Comic Book Manager 1.11 [Patch].exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Comic Book Manager 1.11 [Patch].zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\CoolWWWSearch SmartKiller MiniRemoval 1.0.zip.vir/CoolWWWSearch SmartKiller MiniRemoval 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\CoolWWWSearch SmartKiller MiniRemoval 1.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Crocodile 1.42.zip.vir/Crocodile 1.42.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Crocodile 1.42.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\CrossLoop 1.11 Build 20070720164151.zip.vir/CrossLoop 1.11 Build 20070720164151.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\CrossLoop 1.11 Build 20070720164151.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\CryptoNote 4.0.0.3.zip.vir/CryptoNote 4.0.0.3.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\CryptoNote 4.0.0.3.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Crystal REVS for C++ 2.06 Beta.zip.vir/Crystal REVS for C++ 2.06 Beta.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Crystal REVS for C++ 2.06 Beta.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\CS 80V 1.6 Crack.zip.vir/CS 80V 1.6 Crack.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\CS 80V 1.6 Crack.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\CX310-081 SCWCD Java 1.4 8.02.05 [Key].zip.vir/CX310-081 SCWCD Java 1.4 8.02.05 [Key].exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\CX310-081 SCWCD Java 1.4 8.02.05 [Key].zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\DANCE 5.0.zip.vir/DANCE 5.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\DANCE 5.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Data Control Font 1.0.zip.vir/Data Control Font 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Data Control Font 1.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\DataSafe PS Net 3.zip.vir/DataSafe PS Net 3.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\DataSafe PS Net 3.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\DB Navigator 2 build 21.zip.vir/DB Navigator 2 build 21.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\DB Navigator 2 build 21.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\DiskInternals NTFS Reader 2.0.zip.vir/DiskInternals NTFS Reader 2.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\DiskInternals NTFS Reader 2.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\DiskSpaceExplorer 1.1.zip.vir/DiskSpaceExplorer 1.1.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\DiskSpaceExplorer 1.1.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Do-Not-Call List Registry Check 3.zip.vir/Do-Not-Call List Registry Check 3.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Do-Not-Call List Registry Check 3.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Doppeldirectory 1.1.0.zip.vir/Doppeldirectory 1.1.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Doppeldirectory 1.1.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Dragonball Z Desktop Buddy 1.0.zip.vir/Dragonball Z Desktop Buddy 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Dragonball Z Desktop Buddy 1.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\DragToScroll 0.4.zip.vir/DragToScroll 0.4.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\DragToScroll 0.4.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\DropMover 1.5.2.zip.vir/DropMover 1.5.2.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\DropMover 1.5.2.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Elf Bowling 6 Air Biscuits 1.zip.vir/Elf Bowling 6 Air Biscuits 1.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Elf Bowling 6 Air Biscuits 1.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\English Danish & Dansk Engelsk Dictionary 1.0.0.15.zip.vir/English Danish & Dansk Engelsk Dictionary 1.0.0.15.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\English Danish & Dansk Engelsk Dictionary 1.0.0.15.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ePSXe 1.60.zip.vir/ePSXe 1.60.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ePSXe 1.60.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ewido-setup---.zip.vir/ewido-setup---.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ewido-setup---.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Exl-Plan Free 2.72.zip.vir/Exl-Plan Free 2.72.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Exl-Plan Free 2.72.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Fantasy Fireworks Screensaver 1.0 [Key+Serial].zip.vir/Fantasy Fireworks Screensaver 1.0 [Key+Serial].exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Fantasy Fireworks Screensaver 1.0 [Key+Serial].zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\File Hunter 2006 build 3.01.02.zip.vir/File Hunter 2006 build 3.01.02.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\File Hunter 2006 build 3.01.02.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\FlexRent 1.5.2 Key+Serial.zip.vir/FlexRent 1.5.2 Key+Serial.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\FlexRent 1.5.2 Key+Serial.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\FontOpt 1.1.8.zip.vir/FontOpt 1.1.8.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\FontOpt 1.1.8.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Forum Genius 2.0.zip.vir/Forum Genius 2.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Forum Genius 2.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Free Screen Recorder 2.9.zip.vir/Free Screen Recorder 2.9.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Free Screen Recorder 2.9.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\FXArray 1.1.zip.vir/FXArray 1.1.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\FXArray 1.1.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Gabhile.zip.vir/Gabhile.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Gabhile.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Happy Snowman Screensaver 4.10.0510 (Crack).zip.vir/Happy Snowman Screensaver 4.10.0510 (Crack).exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Happy Snowman Screensaver 4.10.0510 (Crack).zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Homeland Security Threat Monitor 1.0.3.zip.vir/Homeland Security Threat Monitor 1.0.3.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Homeland Security Threat Monitor 1.0.3.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\iDecide Personal Edition v4.11.zip.vir/iDecide Personal Edition v4.11.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\iDecide Personal Edition v4.11.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\IdiomaX Office Translator 4.0 [Key].zip.vir/IdiomaX Office Translator 4.0 [Key].exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\IdiomaX Office Translator 4.0 [Key].zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\iGetter Download Manager 1.9.5.zip.vir/iGetter Download Manager 1.9.5.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\iGetter Download Manager 1.9.5.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ImageCoder 1.0.zip.vir/ImageCoder 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ImageCoder 1.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Imaging Matrix - Manual Indexer 2.1.0.zip.vir/Imaging Matrix - Manual Indexer 2.1.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Imaging Matrix - Manual Indexer 2.1.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\InboxShield 3.6 (Key+Serial).zip.vir/InboxShield 3.6 (Key+Serial).exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\InboxShield 3.6 (Key+Serial).zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Innovatools diskSpace Explorer Network 3.0 [With Crack].zip.vir/Innovatools diskSpace Explorer Network 3.0 [With Crack].exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Innovatools diskSpace Explorer Network 3.0 [With Crack].zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\IPTunnelManager 1.4 (With Crack).zip.vir/IPTunnelManager 1.4 (With Crack).exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\IPTunnelManager 1.4 (With Crack).zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Jackson 1.31.zip.vir/Jackson 1.31.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Jackson 1.31.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Janotech 2.0.zip.vir/Janotech 2.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Janotech 2.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Jazz Params 1.5.zip.vir/Jazz Params 1.5.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Jazz Params 1.5.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Jigsaw Puzzle Applets 1.1.zip.vir/Jigsaw Puzzle Applets 1.1.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Jigsaw Puzzle Applets 1.1.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\JPEG Viewer 0.12.zip.vir/JPEG Viewer 0.12.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\JPEG Viewer 0.12.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Kaspersky.Antivirus.Personal.v5.0.227.zip.vir/Kaspersky.Antivirus.Personal.v5.0.227.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Kaspersky.Antivirus.Personal.v5.0.227.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Kerika 1.1.zip.vir/Kerika 1.1.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Kerika 1.1.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Lavasoft Personal Firewall 2.0.1023.700 With Crack.zip.vir/Lavasoft Personal Firewall 2.0.1023.700 With Crack.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Lavasoft Personal Firewall 2.0.1023.700 With Crack.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\LCD Font Maker 3.92 [Serial].zip.vir/LCD Font Maker 3.92 [Serial].exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\LCD Font Maker 3.92 [Serial].zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Leow Descrambler 1.8.zip.vir/Leow Descrambler 1.8.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Leow Descrambler 1.8.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\LineStats 1.1.zip.vir/LineStats 1.1.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\LineStats 1.1.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Logidex Visual Studio .NET Add-in 3.5.zip.vir/Logidex Visual Studio .NET Add-in 3.5.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Logidex Visual Studio .NET Add-in 3.5.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\MagicMessage 2.5.157 [Cracked].zip.vir/MagicMessage 2.5.157 [Cracked].exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\MagicMessage 2.5.157 [Cracked].zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Mail Access Monitor for Kerio MailServer 3.2.zip.vir/Mail Access Monitor for Kerio MailServer 3.2.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Mail Access Monitor for Kerio MailServer 3.2.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\MailBee POP3 5.2.zip.vir/MailBee POP3 5.2.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\MailBee POP3 5.2.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Maple Messenger 1.1.zip.vir/Maple Messenger 1.1.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Maple Messenger 1.1.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\MB Free Runes Software 1.0.zip.vir/MB Free Runes Software 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\MB Free Runes Software 1.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\MEDA Picture Finder 3.7.2.zip.vir/MEDA Picture Finder 3.7.2.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\MEDA Picture Finder 3.7.2.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Mellitux for Palm 1.08.zip.vir/Mellitux for Palm 1.08.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Mellitux for Palm 1.08.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Michelangelo Art 1.0 (Patch).zip.vir/Michelangelo Art 1.0 (Patch).exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Michelangelo Art 1.0 (Patch).zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\MidiSqueezer 2.0 Key.zip.vir/MidiSqueezer 2.0 Key.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\MidiSqueezer 2.0 Key.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Mission S.E.U.C.K. 7.9.06.zip.vir/Mission S.E.U.C.K. 7.9.06.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Mission S.E.U.C.K. 7.9.06.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Monitor Wolf 1.52.zip.vir/Monitor Wolf 1.52.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Monitor Wolf 1.52.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\MP4 Browser 1.2.0.zip.vir/MP4 Browser 1.2.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\MP4 Browser 1.2.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\MSU StegoVideo 1.0.zip.vir/MSU StegoVideo 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\MSU StegoVideo 1.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\MultiG 1.2.4.1 (With Crack).zip.vir/MultiG 1.2.4.1 (With Crack).exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\MultiG 1.2.4.1 (With Crack).zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Multiquence 2.54.zip.vir/Multiquence 2.54.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Multiquence 2.54.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\MyClubV2 2.0.3.0.zip.vir/MyClubV2 2.0.3.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\MyClubV2 2.0.3.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Neuro Enhancer Vocab Edition 0.0.72.zip.vir/Neuro Enhancer Vocab Edition 0.0.72.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Neuro Enhancer Vocab Edition 0.0.72.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Nick Video Jigsaw Jam 1.zip.vir/Nick Video Jigsaw Jam 1.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Nick Video Jigsaw Jam 1.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\NotesPlusPlus 5.6.zip.vir/NotesPlusPlus 5.6.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\NotesPlusPlus 5.6.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\NSIS SkinCrafter Plugin 1.0.zip.vir/NSIS SkinCrafter Plugin 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\NSIS SkinCrafter Plugin 1.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Online Functions - Exchange Rates 2.1 Crack.zip.vir/Online Functions - Exchange Rates 2.1 Crack.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Online Functions - Exchange Rates 2.1 Crack.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Online Functions - Exchange Rates 2.1.zip.vir/Online Functions - Exchange Rates 2.1.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Online Functions - Exchange Rates 2.1.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Panda Quick Remover 3.5.1.11.zip.vir/Panda Quick Remover 3.5.1.11.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Panda Quick Remover 3.5.1.11.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Panda.Antivirus.Platinum.7.20.+.Serial.zip.vir/Panda.Antivirus.Platinum.7.20.+.Serial.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Panda.Antivirus.Platinum.7.20.+.Serial.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Password Power 2.1.zip.vir/Password Power 2.1.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Password Power 2.1.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\PCQNG 2.0.zip.vir/PCQNG 2.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\PCQNG 2.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Personal Antispy 1.3.zip.vir/Personal Antispy 1.3.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Personal Antispy 1.3.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Personal Digital Voice Recorder 1.20 (Key).zip.vir/Personal Digital Voice Recorder 1.20 (Key).exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Personal Digital Voice Recorder 1.20 (Key).zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Photo Builder Platinum 6.0 (Patch).zip.vir/Photo Builder Platinum 6.0 (Patch).exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Photo Builder Platinum 6.0 (Patch).zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Photo SlideShow Maker 2.9 Cracked.zip.vir/Photo SlideShow Maker 2.9 Cracked.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Photo SlideShow Maker 2.9 Cracked.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Pictures Presentation Maker 2.7 KeyGen.zip.vir/Pictures Presentation Maker 2.7 KeyGen.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Pictures Presentation Maker 2.7 KeyGen.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Pivo FTP Component 1.01 [Serial].zip.vir/Pivo FTP Component 1.01 [Serial].exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Pivo FTP Component 1.01 [Serial].zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Pizza Puzzle 1.zip.vir/Pizza Puzzle 1.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Pizza Puzzle 1.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Podcast Station 2.1.02.zip.vir/Podcast Station 2.1.02.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Podcast Station 2.1.02.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\PolderbitS Sound Recorder and Editor 5.zip.vir/PolderbitS Sound Recorder and Editor 5.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\PolderbitS Sound Recorder and Editor 5.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Prime95 25.4.zip.vir/Prime95 25.4.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Prime95 25.4.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Privacy Keeper 1.0.zip.vir/Privacy Keeper 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Privacy Keeper 1.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Proxy Change Utility 0.1.zip.vir/Proxy Change Utility 0.1.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Proxy Change Utility 0.1.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ProxyCommander 1.0 Patch.zip.vir/ProxyCommander 1.0 Patch.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ProxyCommander 1.0 Patch.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Quorum 1.00.zip.vir/Quorum 1.00.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Quorum 1.00.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\QuotesTK 1.02.zip.vir/QuotesTK 1.02.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\QuotesTK 1.02.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Qute 3.2.2.zip.vir/Qute 3.2.2.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Qute 3.2.2.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Resume Builder 4.5 (Crack).zip.vir/Resume Builder 4.5 (Crack).exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Resume Builder 4.5 (Crack).zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\RPWiz 1.05 (Cracked).zip.vir/RPWiz 1.05 (Cracked).exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\RPWiz 1.05 (Cracked).zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\SACrypt 1.0.zip.vir/SACrypt 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\SACrypt 1.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ScholarWord MLA Edition 1.0 KeyGen.zip.vir/ScholarWord MLA Edition 1.0 KeyGen.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ScholarWord MLA Edition 1.0 KeyGen.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\SD-Flyout 1.0 Serial.zip.vir/SD-Flyout 1.0 Serial.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\SD-Flyout 1.0 Serial.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ShrinkerStretcher 9.2.zip.vir/ShrinkerStretcher 9.2.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ShrinkerStretcher 9.2.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\SnifMon 4.0.107.zip.vir/SnifMon 4.0.107.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\SnifMon 4.0.107.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Solar System 3D ScreenSaver 1.zip.vir/Solar System 3D ScreenSaver 1.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Solar System 3D ScreenSaver 1.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Sothink Movie DVD Maker 1.0 Build 70424.zip.vir/Sothink Movie DVD Maker 1.0 Build 70424.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Sothink Movie DVD Maker 1.0 Build 70424.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Source Code Scanners for C++ Builder 6 4.0 Patch.zip.vir/Source Code Scanners for C++ Builder 6 4.0 Patch.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Source Code Scanners for C++ Builder 6 4.0 Patch.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\SpiderZilla 1.6.0.zip.vir/SpiderZilla 1.6.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\SpiderZilla 1.6.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\SpySites Plus 2.0.zip.vir/SpySites Plus 2.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\SpySites Plus 2.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Spytech PopupAgent 2.10.zip.vir/Spytech PopupAgent 2.10.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Spytech PopupAgent 2.10.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Stationery Selector 1.0.zip.vir/Stationery Selector 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Stationery Selector 1.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Stealth Files 4.0.zip.vir/Stealth Files 4.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Stealth Files 4.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Steelray Project Viewer 3.1.2 Key.zip.vir/Steelray Project Viewer 3.1.2 Key.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Steelray Project Viewer 3.1.2 Key.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Stop Watch 1.01.zip.vir/Stop Watch 1.01.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Stop Watch 1.01.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Strawberry 1.0.zip.vir/Strawberry 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
...continued...
...
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Strawberry 1.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Submit It 2000 3.4.zip.vir/Submit It 2000 3.4.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Submit It 2000 3.4.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\SuperBot 4.7.0.70 (Key).zip.vir/SuperBot 4.7.0.70 (Key).exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\SuperBot 4.7.0.70 (Key).zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\SWF Image Creator 1.0 (Patch).zip.vir/SWF Image Creator 1.0 (Patch).exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\SWF Image Creator 1.0 (Patch).zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Symantec.PC.Anywhere.V11.0.zip.vir/Symantec.PC.Anywhere.V11.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Symantec.PC.Anywhere.V11.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Tab BarLaunch 1.45.zip.vir/Tab BarLaunch 1.45.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Tab BarLaunch 1.45.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\TableSelector 1.0.zip.vir/TableSelector 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\TableSelector 1.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\TEE 03.060.zip.vir/TEE 03.060.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\TEE 03.060.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Teroid Data Grid View Print Control 1.3.zip.vir/Teroid Data Grid View Print Control 1.3.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Teroid Data Grid View Print Control 1.3.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Test Construction Kit 2.0.zip.vir/Test Construction Kit 2.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Test Construction Kit 2.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Thalassoline Aquarium 1.0 With Crack.zip.vir/Thalassoline Aquarium 1.0 With Crack.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Thalassoline Aquarium 1.0 With Crack.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\The Definitive Online Poker Strategy 1.zip.vir/The Definitive Online Poker Strategy 1.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\The Definitive Online Poker Strategy 1.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\The Sleuthhound 4.6.3 Serial.zip.vir/The Sleuthhound 4.6.3 Serial.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\The Sleuthhound 4.6.3 Serial.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ThreatMon 1.1 Crack.zip.vir/ThreatMon 1.1 Crack.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ThreatMon 1.1 Crack.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ThumbNailer ActiveX DLL 1.0.5.zip.vir/ThumbNailer ActiveX DLL 1.0.5.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\ThumbNailer ActiveX DLL 1.0.5.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\TimeGen Timing Diagram Editor 2.3.1 Key+Serial.zip.vir/TimeGen Timing Diagram Editor 2.3.1 Key+Serial.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\TimeGen Timing Diagram Editor 2.3.1 Key+Serial.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Tooling Control 1.0.zip.vir/Tooling Control 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Tooling Control 1.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Toonworks Deluxe 1.0.408.zip.vir/Toonworks Deluxe 1.0.408.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Toonworks Deluxe 1.0.408.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Trident Blade3D 9880 Graphics Driver (Windows 2000) 5.8064.zip.vir/Trident Blade3D 9880 Graphics Driver (Windows 2000) 5.8064.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Trident Blade3D 9880 Graphics Driver (Windows 2000) 5.8064.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Trigonometric Graphs 1.0.zip.vir/Trigonometric Graphs 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Trigonometric Graphs 1.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Triologic Video Player 4.zip.vir/Triologic Video Player 4.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Triologic Video Player 4.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\TruePianos 1.0.1.zip.vir/TruePianos 1.0.1.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\TruePianos 1.0.1.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Tweak Msgr 1.0.4 (Key+Serial).zip.vir/Tweak Msgr 1.0.4 (Key+Serial).exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Tweak Msgr 1.0.4 (Key+Serial).zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Ultralott Powerball and Mega Millions 1.1.7.zip.vir/Ultralott Powerball and Mega Millions 1.1.7.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Ultralott Powerball and Mega Millions 1.1.7.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Unreal Tournament 2003 - Daedalus skin.zip.vir/Unreal Tournament 2003 - Daedalus skin.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Unreal Tournament 2003 - Daedalus skin.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Unreal Tournament 2004 CTF Suzis Civil War Map.zip.vir/Unreal Tournament 2004 CTF Suzis Civil War Map.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Unreal Tournament 2004 CTF Suzis Civil War Map.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Unreal Tournament 2004 Ego2004 map.zip.vir/Unreal Tournament 2004 Ego2004 map.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Unreal Tournament 2004 Ego2004 map.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\VCDEasy 3.1.0.zip.vir/VCDEasy 3.1.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\VCDEasy 3.1.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\veerex 0.8.zip.vir/veerex 0.8.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\veerex 0.8.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\VideoCap Live ActiveX Control 2.0.zip.vir/VideoCap Live ActiveX Control 2.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\VideoCap Live ActiveX Control 2.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\VisionLab VCL 3.1 Beta 1.zip.vir/VisionLab VCL 3.1 Beta 1.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\VisionLab VCL 3.1 Beta 1.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\W32.Nimda.A@mm Removal Tool 2.0.5.zip.vir/W32.Nimda.A@mm Removal Tool 2.0.5.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\W32.Nimda.A@mm Removal Tool 2.0.5.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\WatchetZip! 1.2 (Key+Serial).zip.vir/WatchetZip! 1.2 (Key+Serial).exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\WatchetZip! 1.2 (Key+Serial).zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Web Weaver 2005.01.zip.vir/Web Weaver 2005.01.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Web Weaver 2005.01.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Widget watcher 1.2.zip.vir/Widget watcher 1.2.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Widget watcher 1.2.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\WISCO Word Power 2.0 (Key+Serial).zip.vir/WISCO Word Power 2.0 (Key+Serial).exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\WISCO Word Power 2.0 (Key+Serial).zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Word Wizard Deluxe 2.2.zip.vir/Word Wizard Deluxe 2.2.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\Word Wizard Deluxe 2.2.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\YourPIM 1.1 (Patch).zip.vir/YourPIM 1.1 (Patch).exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\YourPIM 1.1 (Patch).zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\YouTube Interface 1.0.zip.vir/YouTube Interface 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\YouTube Interface 1.0.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\yvReminder 3.0.2256.zip.vir/yvReminder 3.0.2256.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\C\Documents and Settings\User\Application Data\m\shared\yvReminder 3.0.2256.zip.vir ZIP: infected - 1 skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\113953.exe.vir Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\131421.exe.vir Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\133343.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\1338390.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\1401109.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\1405187.exe.vir Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\1416671.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\144953.exe.vir Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\1462812.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\147140.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\1482687.exe.vir Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\1487656.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\159218.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\1620796.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\165406.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\1666796.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\168125.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\1700281.exe.vir Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\1743171.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\1789734.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\1815843.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\183718.exe.vir Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\187859.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\300421.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\305093.exe.vir Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\313156.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\downld\668093.exe.vir Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\QooBox\Quarantine\catchme2008-05-28_190326.81.zip/mdelk.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\QooBox\Quarantine\catchme2008-05-28_190326.81.zip ZIP: infected - 1 skipped
C:\sfmgr\BRZLIC.TXT Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP110\A0028621.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP110\A0028622.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP110\A0028655.sys Infected: Trojan-Downloader.Win32.Bagle.mm skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP111\A0028694.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP111\A0028695.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP111\A0028698.sys Infected: Trojan-Downloader.Win32.Bagle.mm skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP111\A0028721.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP112\A0028731.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP112\A0028732.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP112\A0028733.sys Infected: Trojan-Downloader.Win32.Bagle.mm skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP112\A0028735.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP113\A0028749.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP113\A0028751.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP113\A0028756.exe Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP113\A0028758.sys Infected: Trojan-Downloader.Win32.Bagle.mm skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP113\A0028759.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP113\A0028760.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP113\A0028834.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP113\A0028835.exe Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP113\A0028847.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP113\A0028848.sys Infected: Trojan-Downloader.Win32.Bagle.mm skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP113\A0028849.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP114\A0028855.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP114\A0028859.exe Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP114\A0028860.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP114\A0028861.sys Infected: Trojan-Downloader.Win32.Bagle.mm skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP114\A0028862.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP114\A0028871.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP114\A0028873.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP114\A0028878.exe Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP114\A0028940.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP114\A0028941.exe Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP114\A0028951.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP114\A0028952.sys Infected: Trojan-Downloader.Win32.Bagle.mm skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP114\A0028953.exe Infected: Trojan-Downloader.Win32.Bagle.qq skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP114\A0028956.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029260.exe Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029261.exe Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029262.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029263.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029264.exe Infected: Email-Worm.Win32.Bagle.vr skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029265.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029266.exe Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029268.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029269.exe Infected: Email-Worm.Win32.Bagle.vr skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029270.exe Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029271.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029272.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029273.exe Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029274.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029276.exe Infected: Email-Worm.Win32.Bagle.vr skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029279.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029280.exe Infected: Email-Worm.Win32.Bagle.vr skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029281.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029283.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029284.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029286.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029287.exe Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029289.exe Infected: Email-Worm.Win32.Bagle.vr skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029290.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029293.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029295.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029296.exe Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029300.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029306.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029307.exe Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029308.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP117\A0029320.exe Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\System Volume Information\_restore{D1F169F5-F80A-4A4E-ABF9-99BC982B3B6A}\RP119\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\TempFile Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
F:\autorun.inf Infected: Trojan-PSW.Win32.Nilage.bvl skipped
Scan process completed.
Hi
I see you've got at least one external drive there. Since bagle infects these I recommend reformat for all external drives (external hard drives, usb pendrives etc) you've used in the system while it was infected.
Open notepad and copy/paste the text in the quotebox below into it:
File::
F:\autorun.inf
Folder::
C:\WINDOWS\system32\drivers\downld
Save this as
CFScript
http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif
Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.
Then we have to check what firewalls and antivirus products you've installed. It's recommended to have only one of both installed in same system.
Generate an Uninstall List
* Open HijackThis
* Click on Open Misc Tools Section
* Click on Open Uninstall Manager
* Click on Save list
* Save it to your Desktop
* Post it & a fresh hjt log on your next reply.
ComboFix Log
ComboFix 08-05-27.4 - User 2008-05-29 17:01:09.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1322 [GMT 1:00]
Running from: C:\Documents and Settings\User\My Documents\CpmboFx.exe
Command switches used :: C:\Documents and Settings\User\My Documents\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
F:\autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\drivers\downld
F:\autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_SROSA
((((((((((((((((((((((((( Files Created from 2008-04-28 to 2008-05-29 )))))))))))))))))))))))))))))))
.
2014-12-05 13:23 . 2014-12-05 13:23 315,392 --a------ C:\WINDOWS\HideWin.exe
2014-12-05 13:23 . 2005-05-03 11:43 69,632 -r------- C:\WINDOWS\Alcmtr.exe
2014-12-05 13:22 . 2006-12-26 13:31 4,864 -ra------ C:\WINDOWS\system32\drivers\PortIo.sys
2011-06-18 12:16 . 2008-05-27 14:47 <DIR> d-------- C:\Program Files\CyberLink
2011-06-18 12:16 . 2008-05-27 15:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\CyberLink
2011-06-18 12:09 . 2011-06-18 12:09 <DIR> d-------- C:\Program Files\Common Files\Nero
2011-06-18 12:05 . 2011-06-18 12:05 <DIR> d-------- C:\Program Files\Common Files\Ahead
2011-06-18 12:05 . 2011-06-18 12:05 <DIR> d-------- C:\Program Files\Ahead
2011-06-18 12:05 . 2004-07-20 16:24 1,568,768 --a------ C:\WINDOWS\system32\ImagX7.dll
2011-06-18 12:05 . 2004-07-20 16:24 476,320 --a------ C:\WINDOWS\system32\ImagXpr7.dll
2011-06-18 12:05 . 2004-07-20 16:24 471,040 --a------ C:\WINDOWS\system32\ImagXRA7.dll
2011-06-18 12:05 . 2004-07-09 08:43 364,544 --a------ C:\WINDOWS\system32\TwnLib4.dll
2011-06-18 12:05 . 2004-07-20 16:24 262,144 --a------ C:\WINDOWS\system32\ImagXR7.dll
2011-06-18 12:05 . 2001-07-09 10:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2011-06-18 12:05 . 2000-06-26 10:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2011-06-18 12:05 . 2001-06-26 07:15 38,912 --a------ C:\WINDOWS\system32\picn20.dll
2011-06-18 11:32 . 2007-12-29 16:04 <DIR> d-------- C:\Program Files\OpenOffice.org 2.0
2011-06-18 11:23 . 2011-06-18 11:23 <DIR> d-------- C:\Program Files\DivX
2011-06-18 10:53 . 2011-06-18 10:53 <DIR> d-------- C:\WINDOWS\system32\Lang
2011-06-18 10:53 . 2011-06-18 10:53 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2011-06-18 10:53 . 2011-06-18 10:53 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2011-06-18 10:50 . 2014-12-05 13:23 <DIR> d-------- C:\Program Files\Realtek
2011-06-18 10:50 . 2008-05-27 15:01 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2011-06-18 10:50 . 2007-07-05 09:08 16,380,416 -r------- C:\WINDOWS\RTHDCPL.exe
2011-06-18 10:50 . 2006-05-04 09:26 2,808,832 -r------- C:\WINDOWS\alcwzrd.exe
2011-06-18 10:50 . 2007-06-28 09:44 2,165,760 -r------- C:\WINDOWS\MicCal.exe
2011-06-18 10:50 . 2007-01-12 09:54 520,192 -r------- C:\WINDOWS\RtlExUpd.dll
2011-06-18 10:50 . 2005-09-21 03:25 299,008 -r------- C:\WINDOWS\system32\ALSndMgr.cpl
2011-06-18 10:46 . 2011-06-18 10:48 <DIR> d-------- C:\WINDOWS\nview
2011-06-18 10:46 . 2006-06-29 08:40 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe
2011-06-18 10:46 . 2008-05-29 17:04 81,191 --a------ C:\WINDOWS\system32\nvapps.xml
2011-06-18 10:46 . 2006-08-16 08:35 17,056 --a------ C:\WINDOWS\system32\nvdisp.nvu
2011-06-18 10:42 . 2006-06-28 10:38 363,008 -ra------ C:\WINDOWS\system32\idecoiins.dll
2011-06-18 10:42 . 2006-06-28 10:38 363,008 -ra------ C:\WINDOWS\system32\idecoi.dll
2011-06-18 10:42 . 2006-06-07 12:49 208,896 --a------ C:\WINDOWS\system32\nvuide.exe
2011-06-18 10:42 . 2006-06-28 10:38 105,088 -ra------ C:\WINDOWS\system32\drivers\nvata.sys
2011-06-18 10:42 . 2006-06-07 12:50 35,840 -ra------ C:\WINDOWS\system32\NVCOI.DLL
2011-06-18 10:42 . 2006-06-01 08:32 1,570 --a------ C:\WINDOWS\system32\nvide.nvu
2011-06-18 10:39 . 2006-07-06 10:39 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2011-06-18 10:38 . 2008-02-10 23:33 <DIR> d-------- C:\WINDOWS\system32\Tools
2011-06-18 10:38 . 2011-06-18 11:25 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2011-06-18 10:35 . 2004-12-29 06:57 17,505 -ra------ C:\DBI.EXE
2008-05-29 17:04 . 2008-05-29 17:04 <DIR> d-------- C:\WINDOWS\system32\drivers\downld
2008-05-28 21:24 . 2015-08-04 14:33 211 --a------ C:\boot.ini.comodofirewall
2008-05-28 21:16 . 2008-05-28 21:16 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-05-28 20:37 . 2008-05-28 21:09 <DIR> d-------- C:\CmboFix
2008-05-28 19:44 . 2008-05-28 19:43 73,728 --a------ C:\WINDOWS\system32\CavEmLSP.dll
2008-05-28 19:43 . 2008-05-29 16:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Comodo
2008-05-28 19:43 . 2008-05-28 19:43 434,252 --a------ C:\WINDOWS\system32\MSVCRTD.DLL
2008-05-28 19:43 . 2008-05-28 19:43 216,576 --a------ C:\WINDOWS\system32\monln.dll
2008-05-28 19:43 . 2008-05-28 19:43 102,400 --a------ C:\WINDOWS\system32\drivers\cavasm.sys
2008-05-28 17:28 . 2008-05-28 17:28 <DIR> d-------- C:\Program Files\Lavasoft
2008-05-28 17:28 . 2008-05-28 17:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-05-28 17:21 . 2008-05-28 17:21 <DIR> d-------- C:\Program Files\Panda Security
2008-05-28 17:17 . 2008-05-28 19:47 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-05-28 17:17 . 2008-05-28 17:17 <DIR> d-------- C:\Documents and Settings\User\Application Data\SUPERAntiSpyware.com
2008-05-28 17:17 . 2008-05-28 17:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-05-28 17:15 . 2008-05-28 17:15 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-28 17:15 . 2008-05-28 17:15 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2008-05-28 17:15 . 2008-05-28 17:15 <DIR> d-------- C:\Documents and Settings\User\Application Data\Malwarebytes
2008-05-28 17:15 . 2008-05-28 17:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-28 17:15 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-28 17:15 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-05-28 16:44 . 2008-05-28 16:44 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-28 16:42 . 2008-05-28 17:36 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-28 16:42 . 2008-05-28 16:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-28 15:53 . 2008-05-28 15:53 <DIR> d-------- C:\Program Files\Sunbelt Software
2008-05-28 15:35 . 2008-05-28 15:35 <DIR> d-------- C:\Program Files\Zone Labs
2008-05-28 15:19 . 2008-05-28 15:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\BOC426
2008-05-28 15:19 . 2008-03-28 09:17 212,728 --a------ C:\WINDOWS\CMDLIC.DLL
2008-05-28 15:19 . 2008-03-28 09:16 205,560 --a------ C:\WINDOWS\UNBOC.EXE
2008-05-28 15:19 . 2006-02-28 13:00 22,528 --a------ C:\WINDOWS\system32\wsock32.dlb
2008-05-28 15:19 . 2008-05-29 17:04 8,793 --a------ C:\WINDOWS\BOC426.INI
2008-05-28 14:57 . 2008-05-28 17:29 <DIR> d-------- C:\Program Files\CCleaner
2008-05-28 14:49 . 2007-11-22 15:00 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx
2008-05-28 14:19 . 2008-05-28 14:47 <DIR> d-------- C:\Documents and Settings\User\Application Data\LimeWire
2008-05-27 14:46 . 2008-05-28 13:51 <DIR> d-------- C:\MyWorks
2008-05-26 20:57 . 2008-05-26 20:57 <DIR> d-------- C:\WINDOWS\system32\Adobe
2008-05-22 15:08 . 2008-05-22 15:08 <DIR> d-------- C:\Documents and Settings\User\Application Data\Greyfirst
2008-05-22 15:00 . 2008-05-22 15:00 <DIR> d-------- C:\Program Files\Celtx
2008-05-17 14:46 . 2008-05-17 14:46 <DIR> d-------- C:\Program Files\Eidos Interactive
2008-05-16 11:58 . 2008-05-16 11:58 12,632 --a------ C:\WINDOWS\system32\lsdelete.exe
2008-05-10 20:03 . 2008-05-10 20:03 <DIR> d-------- C:\Program Files\Astonsoft
2008-05-10 20:03 . 2008-05-10 20:18 <DIR> d-------- C:\Documents and Settings\User\Application Data\DeepBurner
2008-05-08 20:28 . 2008-05-08 20:28 <DIR> d-------- C:\Documents and Settings\User\dwhelper
2008-05-08 20:15 . 2008-05-08 20:15 <DIR> d-------- C:\Program Files\Red Kawa
2008-05-04 19:46 . 2008-05-04 19:46 268 --ah----- C:\sqmdata19.sqm
2008-05-04 19:46 . 2008-05-04 19:46 244 --ah----- C:\sqmnoopt19.sqm
2008-05-03 15:29 . 2008-05-03 15:29 268 --ah----- C:\sqmdata18.sqm
2008-05-03 15:29 . 2008-05-03 15:29 244 --ah----- C:\sqmnoopt18.sqm
2008-05-01 00:45 . 2008-05-01 00:45 268 --ah----- C:\sqmdata17.sqm
2008-05-01 00:45 . 2008-05-01 00:45 244 --ah----- C:\sqmnoopt17.sqm
2008-04-29 11:20 . 2008-04-29 11:20 15,648 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2008-04-29 11:19 . 2008-04-29 11:19 15,648 --a------ C:\WINDOWS\system32\drivers\Awrtrd.sys
2008-04-29 11:19 . 2008-04-29 11:19 12,960 --a------ C:\WINDOWS\system32\drivers\Awrtpd.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-16 16:14 --------- d-----w C:\Program Files\microsoft frontpage
2008-05-29 15:57 --------- d-----w C:\Documents and Settings\User\Application Data\Skype
2008-05-29 15:55 --------- d-----w C:\Documents and Settings\User\Application Data\skypePM
2008-05-29 15:54 --------- d-----w C:\Documents and Settings\User\Application Data\Comodo
2008-05-28 20:24 --------- d-----w C:\Program Files\COMODO
2008-05-28 20:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-05-28 16:27 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-28 14:02 --------- d-----w C:\Program Files\eMule
2008-05-28 13:49 1,136,672 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-05-28 13:10 22,681,376 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-27 22:38 306,956 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-27 22:38 109,412 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-05-27 14:12 --------- d-----w C:\Documents and Settings\User\Application Data\CyberLink
2008-05-11 10:08 --------- d-----w C:\Program Files\Java
2008-05-11 10:01 --------- d-----w C:\Program Files\OpenOffice.org 2.3
2008-05-11 09:54 --------- d-----w C:\Documents and Settings\User\Application Data\OpenOffice.org2
2008-05-10 13:55 --------- d-----w C:\Program Files\IrfanView
2008-04-27 13:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-04-19 00:16 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-04-13 16:59 --------- d-----w C:\Documents and Settings\User\Application Data\Media Player Classic
2008-04-09 17:33 --------- d-----w C:\Program Files\Whale Communications
2008-04-06 22:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP
2008-04-06 22:10 --------- d-----w C:\Program Files\HP
2008-04-06 22:10 --------- d-----w C:\Program Files\Hewlett-Packard
2008-04-06 22:07 --------- d-----w C:\Documents and Settings\User\Application Data\HP
2008-04-03 23:11 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-30 22:12 --------- d-----w C:\Documents and Settings\Ru\Application Data\Apple Computer
2008-03-30 14:35 --------- d-----w C:\Program Files\Autodesk
2008-03-30 14:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk
2008-03-30 14:30 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-30 14:28 --------- d-----w C:\Documents and Settings\User\Application Data\Apple Computer
2008-03-30 14:27 --------- d-----w C:\Program Files\QuickTime
2008-03-30 14:27 --------- d-----w C:\Program Files\iTunes
2008-03-30 14:27 --------- d-----w C:\Program Files\iPod
2008-03-30 14:27 --------- d-----w C:\Program Files\Bonjour
2008-03-30 14:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-03-30 14:25 --------- d-----w C:\Program Files\Common Files\Apple
2008-03-30 13:52 --------- d-----w C:\Program Files\SiSoftware
2008-01-07 20:12 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2004-03-07 07:30 16 ----a-w C:\Documents and Settings\User\Application Data\QNVW601P.dll
.
((((((((((((((((((((((((((((( snapshot@2008-05-28_19.09.47.40 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-28 18:04:42 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-29 16:04:00 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-28 20:24:07 75,520 ----a-w C:\WINDOWS\system32\drivers\cmdmon.sys
+ 2008-05-28 20:24:07 51,328 ----a-w C:\WINDOWS\system32\drivers\inspect.sys
+ 2005-05-24 11:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 14:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 14:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
- 2003-03-18 20:20:00 1,060,864 ----a-w C:\WINDOWS\system32\mfc71.dll
+ 2008-05-28 18:43:51 1,060,864 ----a-w C:\WINDOWS\system32\MFC71.dll
- 2003-03-18 19:14:52 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
+ 2008-05-28 18:43:51 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
- 2003-02-21 03:42:22 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
+ 2008-05-28 18:43:51 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 13:00 15360]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-07 16:08 21686568]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2004-05-07 09:03 655360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-05-28 17:35 2097488]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-16 08:35 7630848]
"nwiz"="nwiz.exe" [2006-08-16 08:35 1617920 C:\WINDOWS\system32\nwiz.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-12-08 17:35 32768]
"SkyTel"="SkyTel.EXE" [2007-06-15 09:45 1826816 C:\WINDOWS\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 09:08 16380416 C:\WINDOWS\RTHDCPL.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-16 08:35 86016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]
"HPHUPD08"="c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-17 01:26 49152]
"HP Software Update"="c:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152]
"BOC-426"="C:\PROGRA~1\Comodo\CBOClean\BOC426.exe" [2008-04-10 11:08 351480]
"cnfgCav"="C:\Program Files\Comodo\Comodo AntiVirus\CMain.exe" [2008-05-28 19:43 110592]
"COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2008-05-28 21:24 1115728]
C:\Documents and Settings\User\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 23:23:26 282624]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\monln]
monln.dll 2008-05-28 19:43 216576 C:\WINDOWS\system32\monln.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.dvsd"= C:\Program Files\Common Files\Sony Shared\VideoLib\sonydv.dll
"SENTINEL"= snti386.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Kaspersky Lab\\Kaspersky Internet Security 7.0\\avp.exe"=
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XII.SP1\\Win32\\RpcDataSrv.exe"=
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XII.SP1\\RpcSandraSrv.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\CyberLink\\PowerDirector\\PDR.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R2 sfmgr;CaReTaKeR-CT NetMgr 1.2.1;C:\sfmgr\sfmgr.exe [2004-02-11 12:51]
R3 msloop;Microsoft Loopback Adapter Driver;C:\WINDOWS\system32\DRIVERS\loop.sys [2001-08-17 14:53]
S3 DMService;Whale Component Manager;C:\WINDOWS\DOWNLO~1\DMService.exe [2008-04-09 18:33]
S3 ICScsiSV;Image Converter SCSI Service;C:\Program Files\Sony\IMAGE CONVERTER 3\ICScsiSV.exe [2007-01-26 12:39]
S3 IcVzMonLauncher;IcVzMonLauncher;"C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMonLauncher.exe" [2007-01-26 12:38]
S3 Image Converter video recording monitor for VAIO Entertainment;Image Converter video recording monitor for VAIO Entertainment;C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMon.exe [2007-01-26 12:38]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys []
S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\system32\svchost.exe [2006-02-28 13:00]
S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\system32\svchost.exe [2006-02-28 13:00]
S3 p2psvc;Peer Networking;C:\WINDOWS\system32\svchost.exe [2006-02-28 13:00]
S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\system32\svchost.exe [2006-02-28 13:00]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
Contents of the 'Scheduled Tasks' folder
"2008-02-14 22:16:41 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-29 17:04:14
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\COMODO\CBOClean\BOCore.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\COMODO\Common\CAVASpy\cavasm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\COMODO\Comodo AntiVirus\cavse.exe
C:\Program Files\COMODO\Comodo AntiVirus\cavse.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\COMODO\Comodo AntiVirus\CavAUD.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2008-05-29 17:08:43 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-29 16:08:39
ComboFix2.txt 2008-05-28 20:09:48
ComboFix3.txt 2008-05-28 18:15:24
Pre-Run: 132,120,805,376 bytes free
Post-Run: 132,099,510,272 bytes free
288 --- E O F --- 2008-05-28 14:22:55
Kaspersky Internet Security 7.0 is installed, but has succumbed to the win32 error and will not start, hence the presence of Comodo Antivirus and Firewall.
Uninstall List
Ad-Aware
Adobe Common File Installer
Adobe Flash Player ActiveX
Adobe Reader 8.1.2
Adobe Shockwave Player
Alex Buturuga - Muti ID3 Tag Editor 1.3b1
Apple Mobile Device Support
Apple Software Update
AusLogics Disk Defrag
BOClean
Bonjour
CCleaner (remove only)
Celtx (0.9.9.7)
Comodo AntiVirus Beta 2.0
COMODO Firewall Pro
DeepBurner v1.9.0.228
DFX 8 for Windows Media Player
DivX
DivX Player
eMule
GetRight
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hitman - Codename 47
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB935448)
HP Extended Capabilities 5.3
HP Imaging Device Functions 5.3
HP Photosmart 330,380,420,470,7800,8000,8200 Series
HP Software Update
HP Solution Center & Imaging Support Tools 5.3
Image Converter 3
IrfanView (remove only)
iTunes
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Kaspersky Internet Security 7.0
Kaspersky Internet Security 7.0
Kaspersky Online Scanner
Malwarebytes' Anti-Malware
Maya 8.5 Documentation (en_US)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (2.0.0.14)
Nero Suite
NVIDIA Drivers
OpenMG Limited Patch 4.7-07-14-05-01
OpenMG Secure Module 4.7.00
Panda ActiveScan 2.0
PDF Manual NW-A800 Series
PowerDirector
PowerDVD
PS3 Video 9 2.25
QuickTime
Realtek High Definition Audio Driver
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Sentinel System Driver
SiSoftware Sandra Lite XII.SP1
Skype™ 3.6
Sony Video Shared Library
SpeedFan (remove only)
Spybot - Search & Destroy
SUPERAntiSpyware Free Edition
TuneXP 1.5
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Video Downloader
Whale Communications' Client Components v3.7.1
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Live installer
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Media Encoder 9 Series
Windows Media Encoder 9 Series
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
WinZip
HijackThis Log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:13:52, on 29/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Comodo\CBOClean\BOC426.exe
C:\Program Files\Comodo\Comodo AntiVirus\CMain.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
c:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Comodo\CBOClean\BOCORE.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\Comodo\common\CAVASpy\cavasm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\sfmgr\sfmgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Comodo\Comodo AntiVirus\Cavaud.exe
c:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\User\My Documents\telering.exe
C:\Program Files\Comodo\Comodo AntiVirus\CAVSubmit.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virginmedia.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [BOC-426] C:\PROGRA~1\Comodo\CBOClean\BOC426.exe
O4 - HKLM\..\Run: [cnfgCav] "C:\Program Files\Comodo\Comodo AntiVirus\CMain.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {8D9563A9-8D5F-459B-87F2-BA842255CB9A} (Whale Client Components) - https://myplace5.gdst.net/InternalSite/WhlCompMgr.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: monln - C:\WINDOWS\SYSTEM32\monln.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: BOCore - COMODO - C:\Program Files\Comodo\CBOClean\BOCORE.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Comodo Anti-Virus and Anti-Spyware Service - Comodo Inc. - C:\Program Files\Comodo\common\CAVASpy\cavasm.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Image Converter SCSI Service (ICScsiSV) - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\ICScsiSV.exe
O23 - Service: IcVzMonLauncher - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMonLauncher.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\RpcSandraSrv.exe
O23 - Service: CaReTaKeR-CT NetMgr 1.2.1 (sfmgr) - Unknown owner - C:\sfmgr\sfmgr.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
--
End of file - 10267 bytes
Hi
It seems that some items we just deleted keeps reappearing. Please keep this machine disconnected from network if possible until we've get it clean.
Uninstall Kaspersky Internet Security 7.0 for now. You may reinstall it later after removing Comodo Antivirus & firewall.
Download GMER (http://www.gmer.net/gmer.zip) and save it your desktop:
Extract it to your desktop and double-click GMER.exe
Click rootkit-tab and then scan.
Don't check
Show All
box while scanning in progress!
When scanning is ready, click Copy.
This copies log to clipboard
Post log in your reply.
Open notepad and copy/paste the text in the quotebox below into it:
File::
C:\Documents and Settings\User\Application Data\QNVW601P.dll
Folder::
C:\WINDOWS\system32\drivers\downld
Save this as
CFScript
http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif
Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.
Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.
GMER log
GMER 1.0.14.14205 - http://www.gmer.net
Rootkit scan 2008-05-29 18:16:02
Windows 5.1.2600 Service Pack 2
---- System - GMER 1.0.14 ----
SSDT \SystemRoot\System32\DRIVERS\cmdmon.sys (Comodo Application Engine driver/Comodo Research Lab., Inc.) ZwConnectPort [0xB65AB0D2]
SSDT \SystemRoot\System32\DRIVERS\cmdmon.sys (Comodo Application Engine driver/Comodo Research Lab., Inc.) ZwCreateFile [0xB65AD302]
SSDT spru.sys ZwCreateKey [0xBA6AB0E0]
SSDT \SystemRoot\System32\DRIVERS\cmdmon.sys (Comodo Application Engine driver/Comodo Research Lab., Inc.) ZwCreatePort [0xB65AB02C]
SSDT cavasm.sys (Comodo Anti-Viruspyware Monitor Driver/Comodo Inc.) ZwCreateSection [0xBA5BE11E]
SSDT \SystemRoot\System32\DRIVERS\cmdmon.sys (Comodo Application Engine driver/Comodo Research Lab., Inc.) ZwCreateThread [0xB65AAD12]
SSDT \SystemRoot\System32\DRIVERS\cmdmon.sys (Comodo Application Engine driver/Comodo Research Lab., Inc.) ZwDeleteFile [0xB65ACCB0]
SSDT \SystemRoot\System32\DRIVERS\cmdmon.sys (Comodo Application Engine driver/Comodo Research Lab., Inc.) ZwDeleteKey [0xB65ABEC0]
SSDT \SystemRoot\System32\DRIVERS\cmdmon.sys (Comodo Application Engine driver/Comodo Research Lab., Inc.) ZwDeleteValueKey [0xB65ABDDA]
SSDT spru.sys ZwEnumerateKey [0xBA6C8CA2]
SSDT spru.sys ZwEnumerateValueKey [0xBA6C9030]
SSDT spru.sys ZwOpenKey [0xBA6AB0C0]
SSDT \SystemRoot\System32\DRIVERS\cmdmon.sys (Comodo Application Engine driver/Comodo Research Lab., Inc.) ZwOpenProcess [0xB65ABB94]
SSDT \SystemRoot\System32\DRIVERS\cmdmon.sys (Comodo Application Engine driver/Comodo Research Lab., Inc.) ZwOpenSection [0xB65AB9E0]
SSDT \SystemRoot\System32\DRIVERS\cmdmon.sys (Comodo Application Engine driver/Comodo Research Lab., Inc.) ZwOpenThread [0xB65ABCB0]
SSDT spru.sys ZwQueryKey [0xBA6C9108]
SSDT spru.sys ZwQueryValueKey [0xBA6C8F88]
SSDT \SystemRoot\System32\DRIVERS\cmdmon.sys (Comodo Application Engine driver/Comodo Research Lab., Inc.) ZwSetContextThread [0xB65AABB4]
SSDT \SystemRoot\System32\DRIVERS\cmdmon.sys (Comodo Application Engine driver/Comodo Research Lab., Inc.) ZwSetInformationFile [0xB65ACDE0]
SSDT \SystemRoot\System32\DRIVERS\cmdmon.sys (Comodo Application Engine driver/Comodo Research Lab., Inc.) ZwSetValueKey [0xB65AB26A]
SSDT \SystemRoot\System32\DRIVERS\cmdmon.sys (Comodo Application Engine driver/Comodo Research Lab., Inc.) ZwShutdownSystem [0xB65ABFA0]
SSDT \SystemRoot\System32\DRIVERS\cmdmon.sys (Comodo Application Engine driver/Comodo Research Lab., Inc.) ZwTerminateProcess [0xB65AAF66]
SSDT \SystemRoot\System32\DRIVERS\cmdmon.sys (Comodo Application Engine driver/Comodo Research Lab., Inc.) ZwWriteFile [0xB65AD14A]
SSDT \SystemRoot\System32\DRIVERS\cmdmon.sys (Comodo Application Engine driver/Comodo Research Lab., Inc.) ZwWriteFileGather [0xB65ACFB4]
INT 0x06 \??\C:\WINDOWS\system32\drivers\Haspnt.sys BAADB16D
INT 0x0E \??\C:\WINDOWS\system32\drivers\Haspnt.sys BAADAFC2
---- Kernel code sections - GMER 1.0.14 ----
.text ntkrnlpa.exe!ZwCallbackReturn + 2C08 805039BC 2 Bytes [ D2, B0 ]
.text ntkrnlpa.exe!ZwCallbackReturn + 2C44 805039F8 2 Bytes [ 2C, B0 ]
.text ntkrnlpa.exe!ZwCallbackReturn + 2D80 80503B34 2 Bytes [ E0, B9 ]
? spru.sys The system cannot find the file specified. !
? Combo-Fix.sys The system cannot find the file specified. !
.text USBPORT.SYS!DllUnload B9DAF62C 5 Bytes JMP 8A3DE4E0
.text adifhbtt.SYS B97F3384 1 Byte [ 20 ]
.text adifhbtt.SYS B97F3386 35 Bytes [ 00, 68, 00, 00, 00, 00, 00, ... ]
.text adifhbtt.SYS B97F33AA 24 Bytes [ 00, 00, 20, 00, 00, E0, 00, ... ]
.text adifhbtt.SYS B97F33C4 3 Bytes [ 00, 00, 00 ]
.text adifhbtt.SYS B97F33C9 1 Byte [ 00 ]
.text ...
? C:\CpmboFx\catchme.sys The system cannot find the path specified. !
? C:\WINDOWS\system32\Drivers\PROCEXP90.SYS The system cannot find the file specified. !
---- User code sections - GMER 1.0.14 ----
.text C:\Program Files\Comodo\Firewall\CPF.exe[1248] ntdll.dll!LdrLoadDll 7C9161CA 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Comodo\Firewall\CPF.exe[1248] ntdll.dll!LdrLoadDll + 4 7C9161CE 2 Bytes [ 05, 5F ]
.text C:\Program Files\Comodo\Firewall\CPF.exe[1248] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F08001E
---- Kernel IAT/EAT - GMER 1.0.14 ----
IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [BA6AC040] spru.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [BA6AC13C] spru.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [BA6AC0BE] spru.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [BA6AC7FC] spru.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [BA6AC6D2] spru.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [BA6BBD92] spru.sys
IAT \SystemRoot\System32\Drivers\adifhbtt.SYS[HAL.dll!KfAcquireSpinLock] 0A64D90F
IAT \SystemRoot\System32\Drivers\adifhbtt.SYS[HAL.dll!READ_PORT_UCHAR] 046FD406
IAT \SystemRoot\System32\Drivers\adifhbtt.SYS[HAL.dll!KeGetCurrentIrql] 1672C31D
IAT \SystemRoot\System32\Drivers\adifhbtt.SYS[HAL.dll!KfRaiseIrql] 1879CE14
IAT \SystemRoot\System32\Drivers\adifhbtt.SYS[HAL.dll!KfLowerIrql] 3248ED2B
IAT \SystemRoot\System32\Drivers\adifhbtt.SYS[HAL.dll!HalGetInterruptVector] 3C43E022
IAT \SystemRoot\System32\Drivers\adifhbtt.SYS[HAL.dll!HalTranslateBusAddress] 2E5EF739
IAT \SystemRoot\System32\Drivers\adifhbtt.SYS[HAL.dll!KeStallExecutionProcessor] 2055FA30
IAT \SystemRoot\System32\Drivers\adifhbtt.SYS[HAL.dll!KfReleaseSpinLock] EC01B79A
IAT \SystemRoot\System32\Drivers\adifhbtt.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] E20ABA93
IAT \SystemRoot\System32\Drivers\adifhbtt.SYS[HAL.dll!READ_PORT_USHORT] F017AD88
IAT \SystemRoot\System32\Drivers\adifhbtt.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] FE1CA081
IAT \SystemRoot\System32\Drivers\adifhbtt.SYS[HAL.dll!WRITE_PORT_UCHAR] D42D83BE
IAT \SystemRoot\System32\Drivers\adifhbtt.SYS[WMILIB.SYS!WmiSystemControl] C83B99AC
IAT \SystemRoot\System32\Drivers\adifhbtt.SYS[WMILIB.SYS!WmiCompleteRequest] C63094A5
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisCloseAdapter] [BA90B6D0] inspect.sys (Comodo Personal Firewall Stateful Inspection Engine/COMODO)
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisOpenAdapter] [BA90B730] inspect.sys (Comodo Personal Firewall Stateful Inspection Engine/COMODO)
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisDeregisterProtocol] [BA90B950] inspect.sys (Comodo Personal Firewall Stateful Inspection Engine/COMODO)
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisRegisterProtocol] [BA90B910] inspect.sys (Comodo Personal Firewall Stateful Inspection Engine/COMODO)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] [BA90B910] inspect.sys (Comodo Personal Firewall Stateful Inspection Engine/COMODO)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] [BA90B730] inspect.sys (Comodo Personal Firewall Stateful Inspection Engine/COMODO)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] [BA90B6D0] inspect.sys (Comodo Personal Firewall Stateful Inspection Engine/COMODO)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] [BA90B950] inspect.sys (Comodo Personal Firewall Stateful Inspection Engine/COMODO)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol] [BA90B950] inspect.sys (Comodo Personal Firewall Stateful Inspection Engine/COMODO)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] [BA90B910] inspect.sys (Comodo Personal Firewall Stateful Inspection Engine/COMODO)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter] [BA90B730] inspect.sys (Comodo Personal Firewall Stateful Inspection Engine/COMODO)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter] [BA90B6D0] inspect.sys (Comodo Personal Firewall Stateful Inspection Engine/COMODO)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] [BA90B910] inspect.sys (Comodo Personal Firewall Stateful Inspection Engine/COMODO)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] [BA90B6D0] inspect.sys (Comodo Personal Firewall Stateful Inspection Engine/COMODO)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] [BA90B730] inspect.sys (Comodo Personal Firewall Stateful Inspection Engine/COMODO)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] [BA90B950] inspect.sys (Comodo Personal Firewall Stateful Inspection Engine/COMODO)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [BA90B6D0] inspect.sys (Comodo Personal Firewall Stateful Inspection Engine/COMODO)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [BA90B730] inspect.sys (Comodo Personal Firewall Stateful Inspection Engine/COMODO)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [BA90B910] inspect.sys (Comodo Personal Firewall Stateful Inspection Engine/COMODO)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] [BA90B950] inspect.sys (Comodo Personal Firewall Stateful Inspection Engine/COMODO)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [BA90B910] inspect.sys (Comodo Personal Firewall Stateful Inspection Engine/COMODO)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [BA90B730] inspect.sys (Comodo Personal Firewall Stateful Inspection Engine/COMODO)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [BA90B6D0] inspect.sys (Comodo Personal Firewall Stateful Inspection Engine/COMODO)
---- User IAT/EAT - GMER 1.0.14 ----
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [01C673CC] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [01C67376] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [01C67376] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [01C673CC] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [01C673CC] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [01C67376] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryA] [01C67376] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [01C673CC] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [01C673CC] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!LoadLibraryA] [01C67376] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [01C67376] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [01C673CC] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [01C673CC] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [01C67376] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [01C673CC] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [01C67376] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [01C673CC] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [01C67376] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [01C67376] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [01C673CC] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [01C673CC] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!LoadLibraryA] [01C67376] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!LoadLibraryA] [01C67376] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!SetUnhandledExceptionFilter] [01C673CC] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [01C673CC] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryA] [01C67376] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA] [01C67376] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [01C673CC] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [01C673CC] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryA] [01C67376] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryA] [01C67376] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[2840] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [01C673CC] C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.)
---- Devices - GMER 1.0.14 ----
Device \FileSystem\Ntfs \Ntfs 8A6D81F8
AttachedDevice \FileSystem\Ntfs \Ntfs cavasm.sys (Comodo Anti-Viruspyware Monitor Driver/Comodo Inc.)
Device \FileSystem\Fastfat \FatCdrom 8A2C41F8
AttachedDevice \Driver\Tcpip \Device\Ip cmdmon.sys (Comodo Application Engine driver/Comodo Research Lab., Inc.)
Device \Driver\usbohci \Device\USBPDO-0 8A3DF500
Device \Driver\usbehci \Device\USBPDO-1 8A3E0500
AttachedDevice \Driver\Tcpip \Device\Tcp cmdmon.sys (Comodo Application Engine driver/Comodo Research Lab., Inc.)
Device \Driver\Ftdisk \Device\HarddiskVolume1 8A6DA1F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{16C192DA-054F-4269-8646-8AEB1166FAA4} 892011F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 8A7491F8
Device \Driver\atapi \Device\Ide\IdePort0 8A7491F8
Device \Driver\atapi \Device\Ide\IdePort1 8A7491F8
Device \Driver\USBSTOR \Device\00000082 890ED500
Device \Driver\NetBT \Device\NetBt_Wins_Export 892011F8
Device \Driver\USBSTOR \Device\00000078 890ED500
Device \Driver\USBSTOR \Device\00000085 890ED500
Device \Driver\NetBT \Device\NetbiosSmb 892011F8
Device \Driver\PCI_PNP0006 \Device\0000004d spru.sys
Device \Driver\sptd \Device\2466488756 spru.sys
AttachedDevice \Driver\Tcpip \Device\Udp cmdmon.sys (Comodo Application Engine driver/Comodo Research Lab., Inc.)
AttachedDevice \Driver\Tcpip \Device\RawIp cmdmon.sys (Comodo Application Engine driver/Comodo Research Lab., Inc.)
Device \Driver\NetBT \Device\NetBT_Tcpip_{C9D28E27-C970-4173-A13F-6EF9A45EF45C} 892011F8
Device \Driver\usbohci \Device\USBFDO-0 8A3DF500
Device \Driver\usbehci \Device\USBFDO-1 8A3E0500
Device \Driver\nvata \Device\NvAta0 8A6D91F8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 891FE1F8
Device \Driver\nvata \Device\0000006f 8A6D91F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 891FE1F8
Device \Driver\Ftdisk \Device\FtControl 8A6DA1F8
Device \Driver\USBSTOR \Device\0000007f 890ED500
Device \Driver\adifhbtt \Device\Scsi\adifhbtt1 8A38D1F8
Device \Driver\adifhbtt \Device\Scsi\adifhbtt1Port3Path0Target0Lun0 8A38D1F8
Device \FileSystem\Fastfat \Fat 8A2C41F8
AttachedDevice \FileSystem\Fastfat \Fat cavasm.sys (Comodo Anti-Viruspyware Monitor Driver/Comodo Inc.)
Device \FileSystem\Cdfs \Cdfs 890F4500
---- Services - GMER 1.0.14 ----
Service system32\drivers\kl1.sys (*** hidden *** ) [BOOT] kl1 <-- ROOTKIT !!!
Service C:\WINDOWS\system32\drivers\klif.sys (*** hidden *** ) [SYSTEM] klif <-- ROOTKIT !!!
---- Registry - GMER 1.0.14 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x67 0x12 0x6F 0xC2 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xEA 0x0C 0x74 0x03 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x40 0x85 0xA7 0xB2 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x67 0x12 0x6F 0xC2 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xEA 0x0C 0x74 0x03 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x40 0x85 0xA7 0xB2 ...
---- EOF - GMER 1.0.14 ----
ComboFix Log
ComboFix 08-05-27.4 - User 2008-05-29 18:17:32.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1326 [GMT 1:00]
Running from: C:\Documents and Settings\User\My Documents\CpmboFx.exe
Command switches used :: C:\Documents and Settings\User\My Documents\CFScript.txt
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\Documents and Settings\User\Application Data\QNVW601P.dll
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\User\Application Data\QNVW601P.dll
C:\WINDOWS\system32\drivers\downld
.
((((((((((((((((((((((((( Files Created from 2008-04-28 to 2008-05-29 )))))))))))))))))))))))))))))))
.
2014-12-05 13:23 . 2014-12-05 13:23 315,392 --a------ C:\WINDOWS\HideWin.exe
2014-12-05 13:23 . 2005-05-03 11:43 69,632 -r------- C:\WINDOWS\Alcmtr.exe
2014-12-05 13:22 . 2006-12-26 13:31 4,864 -ra------ C:\WINDOWS\system32\drivers\PortIo.sys
2011-06-18 12:16 . 2008-05-27 14:47 <DIR> d-------- C:\Program Files\CyberLink
2011-06-18 12:16 . 2008-05-27 15:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\CyberLink
2011-06-18 12:09 . 2011-06-18 12:09 <DIR> d-------- C:\Program Files\Common Files\Nero
2011-06-18 12:05 . 2011-06-18 12:05 <DIR> d-------- C:\Program Files\Common Files\Ahead
2011-06-18 12:05 . 2011-06-18 12:05 <DIR> d-------- C:\Program Files\Ahead
2011-06-18 12:05 . 2004-07-20 16:24 1,568,768 --a------ C:\WINDOWS\system32\ImagX7.dll
2011-06-18 12:05 . 2004-07-20 16:24 476,320 --a------ C:\WINDOWS\system32\ImagXpr7.dll
2011-06-18 12:05 . 2004-07-20 16:24 471,040 --a------ C:\WINDOWS\system32\ImagXRA7.dll
2011-06-18 12:05 . 2004-07-09 08:43 364,544 --a------ C:\WINDOWS\system32\TwnLib4.dll
2011-06-18 12:05 . 2004-07-20 16:24 262,144 --a------ C:\WINDOWS\system32\ImagXR7.dll
2011-06-18 12:05 . 2001-07-09 10:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2011-06-18 12:05 . 2000-06-26 10:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2011-06-18 12:05 . 2001-06-26 07:15 38,912 --a------ C:\WINDOWS\system32\picn20.dll
2011-06-18 11:32 . 2007-12-29 16:04 <DIR> d-------- C:\Program Files\OpenOffice.org 2.0
2011-06-18 11:23 . 2011-06-18 11:23 <DIR> d-------- C:\Program Files\DivX
2011-06-18 10:53 . 2011-06-18 10:53 <DIR> d-------- C:\WINDOWS\system32\Lang
2011-06-18 10:53 . 2011-06-18 10:53 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2011-06-18 10:53 . 2011-06-18 10:53 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2011-06-18 10:50 . 2014-12-05 13:23 <DIR> d-------- C:\Program Files\Realtek
2011-06-18 10:50 . 2008-05-27 15:01 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2011-06-18 10:50 . 2007-07-05 09:08 16,380,416 -r------- C:\WINDOWS\RTHDCPL.exe
2011-06-18 10:50 . 2006-05-04 09:26 2,808,832 -r------- C:\WINDOWS\alcwzrd.exe
2011-06-18 10:50 . 2007-06-28 09:44 2,165,760 -r------- C:\WINDOWS\MicCal.exe
2011-06-18 10:50 . 2007-01-12 09:54 520,192 -r------- C:\WINDOWS\RtlExUpd.dll
2011-06-18 10:50 . 2005-09-21 03:25 299,008 -r------- C:\WINDOWS\system32\ALSndMgr.cpl
2011-06-18 10:46 . 2011-06-18 10:48 <DIR> d-------- C:\WINDOWS\nview
2011-06-18 10:46 . 2006-06-29 08:40 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe
2011-06-18 10:46 . 2008-05-29 17:04 81,191 --a------ C:\WINDOWS\system32\nvapps.xml
2011-06-18 10:46 . 2006-08-16 08:35 17,056 --a------ C:\WINDOWS\system32\nvdisp.nvu
2011-06-18 10:42 . 2006-06-28 10:38 363,008 -ra------ C:\WINDOWS\system32\idecoiins.dll
2011-06-18 10:42 . 2006-06-28 10:38 363,008 -ra------ C:\WINDOWS\system32\idecoi.dll
2011-06-18 10:42 . 2006-06-07 12:49 208,896 --a------ C:\WINDOWS\system32\nvuide.exe
2011-06-18 10:42 . 2006-06-28 10:38 105,088 -ra------ C:\WINDOWS\system32\drivers\nvata.sys
2011-06-18 10:42 . 2006-06-07 12:50 35,840 -ra------ C:\WINDOWS\system32\NVCOI.DLL
2011-06-18 10:42 . 2006-06-01 08:32 1,570 --a------ C:\WINDOWS\system32\nvide.nvu
2011-06-18 10:39 . 2006-07-06 10:39 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2011-06-18 10:38 . 2008-02-10 23:33 <DIR> d-------- C:\WINDOWS\system32\Tools
2011-06-18 10:38 . 2011-06-18 11:25 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2011-06-18 10:35 . 2004-12-29 06:57 17,505 -ra------ C:\DBI.EXE
2008-05-28 21:24 . 2015-08-04 14:33 211 --a------ C:\boot.ini.comodofirewall
2008-05-28 21:16 . 2008-05-28 21:16 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-05-28 20:37 . 2008-05-28 21:09 <DIR> d-------- C:\CmboFix
2008-05-28 19:44 . 2008-05-28 19:43 73,728 --a------ C:\WINDOWS\system32\CavEmLSP.dll
2008-05-28 19:43 . 2008-05-29 16:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Comodo
2008-05-28 19:43 . 2008-05-28 19:43 434,252 --a------ C:\WINDOWS\system32\MSVCRTD.DLL
2008-05-28 19:43 . 2008-05-28 19:43 216,576 --a------ C:\WINDOWS\system32\monln.dll
2008-05-28 19:43 . 2008-05-28 19:43 102,400 --a------ C:\WINDOWS\system32\drivers\cavasm.sys
2008-05-28 17:28 . 2008-05-28 17:28 <DIR> d-------- C:\Program Files\Lavasoft
2008-05-28 17:28 . 2008-05-28 17:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-05-28 17:21 . 2008-05-28 17:21 <DIR> d-------- C:\Program Files\Panda Security
2008-05-28 17:17 . 2008-05-28 19:47 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-05-28 17:17 . 2008-05-28 17:17 <DIR> d-------- C:\Documents and Settings\User\Application Data\SUPERAntiSpyware.com
2008-05-28 17:17 . 2008-05-28 17:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-05-28 17:15 . 2008-05-28 17:15 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-28 17:15 . 2008-05-28 17:15 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2008-05-28 17:15 . 2008-05-28 17:15 <DIR> d-------- C:\Documents and Settings\User\Application Data\Malwarebytes
2008-05-28 17:15 . 2008-05-28 17:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-28 17:15 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-28 17:15 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-05-28 16:44 . 2008-05-28 16:44 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-28 16:42 . 2008-05-28 17:36 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-28 16:42 . 2008-05-28 16:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-28 15:53 . 2008-05-28 15:53 <DIR> d-------- C:\Program Files\Sunbelt Software
2008-05-28 15:35 . 2008-05-28 15:35 <DIR> d-------- C:\Program Files\Zone Labs
2008-05-28 15:19 . 2008-05-28 15:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\BOC426
2008-05-28 15:19 . 2008-03-28 09:17 212,728 --a------ C:\WINDOWS\CMDLIC.DLL
2008-05-28 15:19 . 2008-03-28 09:16 205,560 --a------ C:\WINDOWS\UNBOC.EXE
2008-05-28 15:19 . 2006-02-28 13:00 22,528 --a------ C:\WINDOWS\system32\wsock32.dlb
2008-05-28 15:19 . 2008-05-29 17:08 8,775 --a------ C:\WINDOWS\BOC426.INI
2008-05-28 14:57 . 2008-05-28 17:29 <DIR> d-------- C:\Program Files\CCleaner
2008-05-28 14:49 . 2007-11-22 15:00 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx
2008-05-28 14:19 . 2008-05-28 14:47 <DIR> d-------- C:\Documents and Settings\User\Application Data\LimeWire
2008-05-27 14:46 . 2008-05-28 13:51 <DIR> d-------- C:\MyWorks
2008-05-26 20:57 . 2008-05-26 20:57 <DIR> d-------- C:\WINDOWS\system32\Adobe
2008-05-22 15:08 . 2008-05-22 15:08 <DIR> d-------- C:\Documents and Settings\User\Application Data\Greyfirst
2008-05-22 15:00 . 2008-05-22 15:00 <DIR> d-------- C:\Program Files\Celtx
2008-05-17 14:46 . 2008-05-17 14:46 <DIR> d-------- C:\Program Files\Eidos Interactive
2008-05-16 11:58 . 2008-05-16 11:58 12,632 --a------ C:\WINDOWS\system32\lsdelete.exe
2008-05-10 20:03 . 2008-05-10 20:03 <DIR> d-------- C:\Program Files\Astonsoft
2008-05-10 20:03 . 2008-05-10 20:18 <DIR> d-------- C:\Documents and Settings\User\Application Data\DeepBurner
2008-05-08 20:28 . 2008-05-08 20:28 <DIR> d-------- C:\Documents and Settings\User\dwhelper
2008-05-08 20:15 . 2008-05-08 20:15 <DIR> d-------- C:\Program Files\Red Kawa
2008-05-04 19:46 . 2008-05-04 19:46 268 --ah----- C:\sqmdata19.sqm
2008-05-04 19:46 . 2008-05-04 19:46 244 --ah----- C:\sqmnoopt19.sqm
2008-05-03 15:29 . 2008-05-03 15:29 268 --ah----- C:\sqmdata18.sqm
2008-05-03 15:29 . 2008-05-03 15:29 244 --ah----- C:\sqmnoopt18.sqm
2008-05-01 00:45 . 2008-05-01 00:45 268 --ah----- C:\sqmdata17.sqm
2008-05-01 00:45 . 2008-05-01 00:45 244 --ah----- C:\sqmnoopt17.sqm
2008-04-29 11:20 . 2008-04-29 11:20 15,648 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2008-04-29 11:19 . 2008-04-29 11:19 15,648 --a------ C:\WINDOWS\system32\drivers\Awrtrd.sys
2008-04-29 11:19 . 2008-04-29 11:19 12,960 --a------ C:\WINDOWS\system32\drivers\Awrtpd.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-16 16:14 --------- d-----w C:\Program Files\microsoft frontpage
2008-05-29 17:09 --------- d-----w C:\Program Files\Kaspersky Lab
2008-05-29 17:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-05-29 17:04 --------- d-----w C:\Documents and Settings\User\Application Data\Skype
2008-05-29 16:07 --------- d-----w C:\Documents and Settings\User\Application Data\skypePM
2008-05-29 15:54 --------- d-----w C:\Documents and Settings\User\Application Data\Comodo
2008-05-28 20:24 --------- d-----w C:\Program Files\COMODO
2008-05-28 18:43 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-05-28 18:43 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-05-28 18:43 1,060,864 ----a-w C:\WINDOWS\system32\MFC71.dll
2008-05-28 16:27 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-28 14:02 --------- d-----w C:\Program Files\eMule
2008-05-28 13:49 1,136,672 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-05-28 13:10 22,681,376 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-27 22:38 306,956 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-27 22:38 109,412 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-05-27 14:12 --------- d-----w C:\Documents and Settings\User\Application Data\CyberLink
2008-05-11 10:08 --------- d-----w C:\Program Files\Java
2008-05-11 10:01 --------- d-----w C:\Program Files\OpenOffice.org 2.3
2008-05-11 09:54 --------- d-----w C:\Documents and Settings\User\Application Data\OpenOffice.org2
2008-05-10 13:55 --------- d-----w C:\Program Files\IrfanView
2008-04-27 13:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-04-19 00:16 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-04-13 16:59 --------- d-----w C:\Documents and Settings\User\Application Data\Media Player Classic
2008-04-09 17:33 --------- d-----w C:\Program Files\Whale Communications
2008-04-06 22:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP
2008-04-06 22:10 --------- d-----w C:\Program Files\HP
2008-04-06 22:10 --------- d-----w C:\Program Files\Hewlett-Packard
2008-04-06 22:07 --------- d-----w C:\Documents and Settings\User\Application Data\HP
2008-04-03 23:11 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-02 20:07 1,086,952 ----a-w C:\WINDOWS\system32\zpeng24.dll
2008-03-30 22:12 --------- d-----w C:\Documents and Settings\Ru\Application Data\Apple Computer
2008-03-30 14:35 --------- d-----w C:\Program Files\Autodesk
2008-03-30 14:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk
2008-03-30 14:30 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-30 14:28 --------- d-----w C:\Documents and Settings\User\Application Data\Apple Computer
2008-03-30 14:27 --------- d-----w C:\Program Files\QuickTime
2008-03-30 14:27 --------- d-----w C:\Program Files\iTunes
2008-03-30 14:27 --------- d-----w C:\Program Files\iPod
2008-03-30 14:27 --------- d-----w C:\Program Files\Bonjour
2008-03-30 14:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-03-30 14:25 --------- d-----w C:\Program Files\Common Files\Apple
2008-03-30 13:52 --------- d-----w C:\Program Files\SiSoftware
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-04 18:01 6,656 ----a-w C:\WINDOWS\system32\haspvdd.dll
2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-01-07 20:12 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
.
((((((((((((((((((((((((((((( snapshot@2008-05-28_19.09.47.40 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-28 18:04:42 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-29 16:04:00 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-29 17:08:45 819,200 ----a-w C:\WINDOWS\gmer.dll
+ 2008-05-28 20:24:07 75,520 ----a-w C:\WINDOWS\system32\drivers\cmdmon.sys
+ 2008-05-29 17:08:46 86,097 ----a-w C:\WINDOWS\system32\drivers\gmer.sys
+ 2008-05-28 20:24:07 51,328 ----a-w C:\WINDOWS\system32\drivers\inspect.sys
+ 2005-05-24 11:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 14:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 14:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 13:00 15360]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-07 16:08 21686568]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2004-05-07 09:03 655360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-05-28 17:35 2097488]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-16 08:35 7630848]
"nwiz"="nwiz.exe" [2006-08-16 08:35 1617920 C:\WINDOWS\system32\nwiz.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-12-08 17:35 32768]
"SkyTel"="SkyTel.EXE" [2007-06-15 09:45 1826816 C:\WINDOWS\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 09:08 16380416 C:\WINDOWS\RTHDCPL.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-16 08:35 86016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]
"HPHUPD08"="c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-17 01:26 49152]
"HP Software Update"="c:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152]
"BOC-426"="C:\PROGRA~1\Comodo\CBOClean\BOC426.exe" [2008-04-10 11:08 351480]
"cnfgCav"="C:\Program Files\Comodo\Comodo AntiVirus\CMain.exe" [2008-05-28 19:43 110592]
"COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2008-05-28 21:24 1115728]
C:\Documents and Settings\User\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 23:23:26 282624]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\monln]
monln.dll 2008-05-28 19:43 216576 C:\WINDOWS\system32\monln.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.dvsd"= C:\Program Files\Common Files\Sony Shared\VideoLib\sonydv.dll
"SENTINEL"= snti386.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XII.SP1\\Win32\\RpcDataSrv.exe"=
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XII.SP1\\RpcSandraSrv.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\CyberLink\\PowerDirector\\PDR.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R2 sfmgr;CaReTaKeR-CT NetMgr 1.2.1;C:\sfmgr\sfmgr.exe [2004-02-11 12:51]
R3 msloop;Microsoft Loopback Adapter Driver;C:\WINDOWS\system32\DRIVERS\loop.sys [2001-08-17 14:53]
S3 DMService;Whale Component Manager;C:\WINDOWS\DOWNLO~1\DMService.exe [2008-04-09 18:33]
S3 ICScsiSV;Image Converter SCSI Service;C:\Program Files\Sony\IMAGE CONVERTER 3\ICScsiSV.exe [2007-01-26 12:39]
S3 IcVzMonLauncher;IcVzMonLauncher;"C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMonLauncher.exe" [2007-01-26 12:38]
S3 Image Converter video recording monitor for VAIO Entertainment;Image Converter video recording monitor for VAIO Entertainment;C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMon.exe [2007-01-26 12:38]
S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\system32\svchost.exe [2006-02-28 13:00]
S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\system32\svchost.exe [2006-02-28 13:00]
S3 p2psvc;Peer Networking;C:\WINDOWS\system32\svchost.exe [2006-02-28 13:00]
S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\system32\svchost.exe [2006-02-28 13:00]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
*Newly Created Service* - GMER
.
Contents of the 'Scheduled Tasks' folder
"2008-02-14 22:16:41 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-29 18:18:26
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\klogon.dll
.
Completion time: 2008-05-29 18:19:00
ComboFix-quarantined-files.txt 2008-05-29 17:18:45
ComboFix2.txt 2008-05-29 16:08:44
ComboFix3.txt 2008-05-28 20:09:48
ComboFix4.txt 2008-05-28 18:15:24
Pre-Run: 132,092,067,840 bytes free
Post-Run: 132,075,520,000 bytes free
266 --- E O F --- 2008-05-28 14:22:55
Looks quite good. :)
May I see a fresh hjt log too, please?
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:05:57, on 29/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Comodo\CBOClean\BOC426.exe
C:\Program Files\Comodo\Comodo AntiVirus\CMain.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
c:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Comodo\CBOClean\BOCORE.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\Comodo\common\CAVASpy\cavasm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\sfmgr\sfmgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Comodo\Comodo AntiVirus\Cavaud.exe
c:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\User\My Documents\telering.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virginmedia.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [BOC-426] C:\PROGRA~1\Comodo\CBOClean\BOC426.exe
O4 - HKLM\..\Run: [cnfgCav] "C:\Program Files\Comodo\Comodo AntiVirus\CMain.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {8D9563A9-8D5F-459B-87F2-BA842255CB9A} (Whale Client Components) - https://myplace5.gdst.net/InternalSite/WhlCompMgr.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: monln - C:\WINDOWS\SYSTEM32\monln.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BOCore - COMODO - C:\Program Files\Comodo\CBOClean\BOCORE.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Comodo Anti-Virus and Anti-Spyware Service - Comodo Inc. - C:\Program Files\Comodo\common\CAVASpy\cavasm.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Image Converter SCSI Service (ICScsiSV) - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\ICScsiSV.exe
O23 - Service: IcVzMonLauncher - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMonLauncher.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\RpcSandraSrv.exe
O23 - Service: CaReTaKeR-CT NetMgr 1.2.1 (sfmgr) - Unknown owner - C:\sfmgr\sfmgr.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
--
End of file - 9926 bytes
Good. Time to clear other Kaspersky findings by resetting system restore and uninstalling ComboFix :)
Well congrats, it appears your system is all clean Are you still noticing any problems? If not, it's time to secure your system to prevent against further intrusions.
THESE STEPS ARE VERY IMPORTANT
Let's reset system restore
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: You will lose all previous restore points which are likely to be infected. Please note you need Administrator Access to do clean the restore points.
1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
2. Reboot.
3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
NOTE: only do this ONCE,NOT on a regular basis
Now lets uninstall ComboFix:
Click START then RUN
Now type "C:\Documents and Settings\User\My Documents\CpmboFx.exe" /u in the runbox and click OK
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...
Updating Java:
Download the latest version of Java Runtime Environment (JRE) 6 Update 6 (http://java.sun.com/javase/downloads/index.jsp).
Scroll down to where it says
The J2SE Runtime Environment (JRE) allows end-users to run Java applications.
Click the
Download
button to the right.
Select Windows on platform combobox and check the box that says:
Accept License Agreement. Click continue.
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u6-windows-i586-p.exe to install the newest version.
UPDATING WINDOWS AND INTERNET EXPLORER
IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site (http://windowsupdate.microsoft.com/) to get the critical updates.
If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.
Make your Internet Explorer more secure
This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.
The following are recommended third party programs that are designed to keep your computer clean. A link as well as a brief description is included with each item.
Download SpywareBlaster
Spyware blaster is a program that stops known malicious activex controls from installing on your computer. It works by changing settings in your registry. It makes
kill bits
in the registry, so that certain activex controls can't install.
If you don't know what activex controls are, see here (http://www.webopedia.com/TERM/A/ActiveX_control.html)
You can download SpywareBlaster here here (http://majorgeeks.com/downloadget.php?id=2859&file=11&evp=61b0e8ad41924a03c37615f4682b4cef)
SpywareBlaster tutorial (http://www.bleepingcomputer.com/forums/tutorial49.html)
Download iespyad
It puts many bad webpages on your restricted zones list. This means that you can still view the
bad
webpages, but the webpages cannot do certain things (such as use javascripts and cookies).
If you need help understanding how it works, there is a tutorial here (http://www.bleepingcomputer.com/tutorials/tutorial53.html)
Download it here (http://www.spywarewarrior.com/uiuc/res/ie-spyad.exe)
hosts file:
Every version of windows has a hosts file as part of them. In a very basic sense, they are used to locate webpages. We can customize a hosts file so that it blocks certain webpages. However, it can slow down certain computers. This is why using a hosts file is optional!!
Download it here (http://www.mvps.org/winhelp2002/hosts.htm). Make sure you read the instructions on how to install the hosts file. There is a good tutorial here (http://www.bleepingcomputer.com/forums/tutorial51.html)
If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps:
Click the start button (at the lower left hand corner of your screen) Click run In the dialog box, type services.msc hit enter, then locate dns client Highlight it, then double-click it. On the dropdown box, change the setting from automatic to manual. Click ok
Just a final reminder for you. I am trying to stress these two points.
UPDATE UPDATE UPDATE!!! Make sure you do this about every 1-2 weeks.
Make sure all of your security programs are up to date.
Run the spybot and adaware regularly. (Once or twice a week minimum.)
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Once again, please post and tell me how things are going with your system... problems etc.
Have a great day,
Blade :cool:
Wow, marvellous; thanks so very much for all your help!!
Everything seems to be running smoothly; all the updates and extra protective methods are in place and running. I'll let this be a lesson in keeping my computer spotless :).
Thanks again, Blade81!
Since this issue appears to be resolved ... this Topic has been closed. Glad I could help. :)
Note:If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.
If it has been less than five days since your last response and you need the thread re-opened, please send me or your helper a private message (pm). A valid, working link to the closed topic is required.