virtumonde
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:12:09 AM, on 1/9/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Link...ww.google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F3 - REG:win.ini: load=C:\Users\Richard\AppData\Local\Temp\efcdc.exe
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\Program Files\AIM\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Richard\AppData\Local\Temp\wvwur.dll,#1
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Winamp.lnk = C:\Program Files\Winamp\winamp.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {BD08A9D5-0E5C-4F42-99A3-C0CB5E860557} (CSolidBrowserObj Object) - http://cdn1.acclaimdownloads.com/solidstateion.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{87FC074D-D733-451F-A81F-A2037938AD69}: NameServer = 68.94.156.1,68.94.157.1
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
--
End of file - 9373 bytes
Protection
----------
Total scanned: 451690
Detected: 9
Untreated: 0
Start time: 1/9/2008 12:18:48 AM
Duration: 00:00:01
Finish time: 1/9/2008 12:18:49 AM
Detected
--------
Status Object
------ ------
deleted: Trojan program Trojan-Dropper.Win32.Agent.dgo File: c:\users\richard\appdata\local\temp\efcdc.exe
deleted: Trojan program Trojan-Dropper.Win32.Agent.dgo File: c:\program files\hp\hp software update\hpwuschd2.exe
deleted: Trojan program Trojan-Dropper.Win32.Agent.dgo File: c:\users\richard\appdata\local\temp\squcjhdt.exe
deleted: Trojan program Trojan-Dropper.Win32.Agent.dgo File: c:\users\richard\appdata\local\temp\squcjhdt .exe
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.din File: c:\users\richard\appdata\local\temp\fqgkqaie.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.din File: C:\Users\Richard\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B8799LYP\hctp[1]
deleted: Trojan program Backdoor.Win32.Agent.dbm File: C:\Users\Richard\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WCPOTSB8\gamadril20071203[1]
deleted: Trojan program Trojan-Downloader.Win32.Agent.gwe File: C:\Users\Richard\AppData\Local\Temp\TMP66E4.tmp
deleted: Trojan program Trojan-Downloader.Win32.Agent.gwe File: C:\Users\Richard\AppData\Local\Temp\TMP8D97.tmp
Events
------
Time Event
---- -----
1/9/2008 12:21:33 AM File c:\users\richard\appdata\local\temp\efcdc.exe: detected Trojan program 'Trojan-Dropper.Win32.Agent.dgo'.
1/9/2008 12:21:33 AM Security threats have been detected. You are advised to neutralize them immediately.
1/9/2008 12:21:33 AM File c:\users\richard\appdata\local\temp\efcdc.exe: is still infected, postponed.
1/9/2008 12:21:33 AM File c:\program files\hp\hp software update\hpwuschd2.exe: detected Trojan program 'Trojan-Dropper.Win32.Agent.dgo'.
1/9/2008 12:21:33 AM File c:\program files\hp\hp software update\hpwuschd2.exe: is still infected, postponed.
1/9/2008 12:21:35 AM File c:\users\richard\appdata\local\temp\squcjhdt.exe: detected Trojan program 'Trojan-Dropper.Win32.Agent.dgo'.
1/9/2008 12:21:35 AM File c:\users\richard\appdata\local\temp\squcjhdt.exe: is still infected, postponed.
1/9/2008 12:21:35 AM File c:\users\richard\appdata\local\temp\squcjhdt .exe: detected Trojan program 'Trojan-Dropper.Win32.Agent.dgo'.
1/9/2008 12:21:35 AM File c:\users\richard\appdata\local\temp\squcjhdt .exe: is still infected, postponed.
1/9/2008 12:21:36 AM File c:\users\richard\appdata\local\temp\fqgkqaie.dll: detected adware 'not-a-virus:AdWare.Win32.Virtumonde.din'.
1/9/2008 12:21:36 AM File c:\users\richard\appdata\local\temp\fqgkqaie.dll: is still infected, postponed.
1/9/2008 12:22:20 AM File c:\users\richard\appdata\local\temp\efcdc.exe: detected Trojan program 'Trojan-Dropper.Win32.Agent.dgo'.
1/9/2008 12:22:43 AM File c:\users\richard\appdata\local\temp\efcdc.exe: deleted.
1/9/2008 12:22:43 AM File c:\program files\hp\hp software update\hpwuschd2.exe: detected Trojan program 'Trojan-Dropper.Win32.Agent.dgo'.
1/9/2008 12:23:04 AM File c:\program files\hp\hp software update\hpwuschd2.exe: deleted.
1/9/2008 12:23:04 AM File c:\users\richard\appdata\local\temp\squcjhdt.exe: detected Trojan program 'Trojan-Dropper.Win32.Agent.dgo'.
1/9/2008 12:23:08 AM File c:\users\richard\appdata\local\temp\squcjhdt.exe: deleted.
1/9/2008 12:23:08 AM File c:\users\richard\appdata\local\temp\squcjhdt .exe: detected Trojan program 'Trojan-Dropper.Win32.Agent.dgo'.
1/9/2008 12:23:10 AM File c:\users\richard\appdata\local\temp\squcjhdt .exe: deleted.
1/9/2008 12:23:10 AM File c:\users\richard\appdata\local\temp\fqgkqaie.dll: detected adware 'not-a-virus:AdWare.Win32.Virtumonde.din'.
1/9/2008 12:23:18 AM File c:\users\richard\appdata\local\temp\fqgkqaie.dll: deleted.
1/9/2008 1:59:57 AM File C:\ProgramData\Spybot - Search & Destroy\Recovery\Virtumonde.zip/sbRecovery.reg: is password protected.
1/9/2008 1:59:57 AM File C:\ProgramData\Spybot - Search & Destroy\Recovery\Virtumonde.zip/sbRecovery.ini: is password protected.
1/9/2008 1:59:57 AM File C:\ProgramData\Spybot - Search & Destroy\Recovery\Virtumonde1.zip/sbRecovery.reg: is password protected.
1/9/2008 1:59:57 AM File C:\ProgramData\Spybot - Search & Destroy\Recovery\Virtumonde1.zip/sbRecovery.ini: is password protected.
1/9/2008 2:14:57 AM File C:\Users\All Users\Spybot - Search & Destroy\Recovery\Virtumonde.zip/sbRecovery.reg: is password protected.
1/9/2008 2:14:57 AM File C:\Users\All Users\Spybot - Search & Destroy\Recovery\Virtumonde.zip/sbRecovery.ini: is password protected.
1/9/2008 2:14:57 AM File C:\Users\All Users\Spybot - Search & Destroy\Recovery\Virtumonde1.zip/sbRecovery.reg: is password protected.
1/9/2008 2:14:57 AM File C:\Users\All Users\Spybot - Search & Destroy\Recovery\Virtumonde1.zip/sbRecovery.ini: is password protected.
1/9/2008 2:15:55 AM File C:\Users\Richard\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B8799LYP\hctp[1]: detected adware 'not-a-virus:AdWare.Win32.Virtumonde.din'.
1/9/2008 2:15:55 AM Security threats have been detected. You are advised to neutralize them immediately.
1/9/2008 2:15:55 AM File C:\Users\Richard\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B8799LYP\hctp[1]: is still infected, postponed.
1/9/2008 2:16:22 AM File C:\Users\Richard\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WCPOTSB8\gamadril20071203[1]: detected Trojan program 'Backdoor.Win32.Agent.dbm'.
1/9/2008 2:16:22 AM File C:\Users\Richard\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WCPOTSB8\gamadril20071203[1]: is still infected, postponed.
1/9/2008 2:18:01 AM File C:\Users\Richard\AppData\Local\Temp\efcdc.exe: detected Trojan program 'Trojan-Dropper.Win32.Agent.dgo'.
1/9/2008 2:18:01 AM File C:\Users\Richard\AppData\Local\Temp\efcdc.exe: is still infected, postponed.
1/9/2008 2:18:01 AM File C:\Users\Richard\AppData\Local\Temp\TMP66E4.tmp: detected Trojan program 'Trojan-Downloader.Win32.Agent.gwe'.
1/9/2008 2:18:01 AM File C:\Users\Richard\AppData\Local\Temp\TMP66E4.tmp: is still infected, postponed.
1/9/2008 2:18:01 AM File C:\Users\Richard\AppData\Local\Temp\TMP8D97.tmp: detected Trojan program 'Trojan-Downloader.Win32.Agent.gwe'.
1/9/2008 2:18:01 AM File C:\Users\Richard\AppData\Local\Temp\TMP8D97.tmp: is still infected, postponed.
1/9/2008 2:34:22 AM File c:\users\richard\appdata\local\microsoft\windows\temporary internet files\content.ie5\b8799lyp\hctp[1]: detected adware 'not-a-virus:AdWare.Win32.Virtumonde.din'.
1/9/2008 2:34:35 AM File c:\users\richard\appdata\local\microsoft\windows\temporary internet files\content.ie5\b8799lyp\hctp[1]: deleted.
1/9/2008 2:34:35 AM File c:\users\richard\appdata\local\microsoft\windows\temporary internet files\content.ie5\wcpotsb8\gamadril20071203[1]: detected Trojan program 'Backdoor.Win32.Agent.dbm'.
1/9/2008 2:34:35 AM File c:\users\richard\appdata\local\microsoft\windows\temporary internet files\content.ie5\wcpotsb8\gamadril20071203[1]: deleted.
1/9/2008 2:34:35 AM File c:\users\richard\appdata\local\temp\efcdc.exe: detected Trojan program 'Trojan-Dropper.Win32.Agent.dgo'.
1/9/2008 2:34:35 AM File c:\users\richard\appdata\local\temp\efcdc.exe: deleted.
1/9/2008 2:34:35 AM File c:\users\richard\appdata\local\temp\tmp66e4.tmp: detected Trojan program 'Trojan-Downloader.Win32.Agent.gwe'.
1/9/2008 2:34:35 AM File c:\users\richard\appdata\local\temp\tmp66e4.tmp: deleted.
1/9/2008 2:34:35 AM File c:\users\richard\appdata\local\temp\tmp8d97.tmp: detected Trojan program 'Trojan-Downloader.Win32.Agent.gwe'.
1/9/2008 2:34:35 AM File c:\users\richard\appdata\local\temp\tmp8d97.tmp: deleted.
Reports
-------
Component Status Start Finish Size
--------- ------ ----- ------ ----
Update completed 1/9/2008 12:16:01 AM 1/9/2008 12:17:06 AM 123.7 KB
Scan My Computer completed 1/9/2008 12:19:44 AM 1/9/2008 2:34:35 AM 94.8 MB
Scan startup objects completed 1/9/2008 12:20:59 AM 1/9/2008 12:23:18 AM 745.7 KB
Quarantine
----------
Status Object Size Added
------ ------ ---- -----
Backup
------
Status Object Size
------ ------ ----
Infected: Trojan program Trojan-Downloader.Win32.Agent.gwe c:\users\richard\appdata\local\temp\tmp66e4.tmp 72.6 KB
Infected: Trojan program Trojan-Downloader.Win32.Agent.gwe c:\users\richard\appdata\local\temp\tmp8d97.tmp 72.6 KB
Infected: adware not-a-virus:AdWare.Win32.Virtumonde.din c:\users\richard\appdata\local\temp\fqgkqaie.dll 88 KB
Infected: adware not-a-virus:AdWare.Win32.Virtumonde.din c:\users\richard\appdata\local\microsoft\windows\temporary internet files\content.ie5\b8799lyp\hctp[1] 88 KB
Infected: Trojan program Trojan-Dropper.Win32.Agent.dgo c:\program files\hp\hp software update\hpwuschd2.exe 370.5 KB
Infected: Trojan program Trojan-Dropper.Win32.Agent.dgo c:\users\richard\appdata\local\temp\squcjhdt .exe 394 KB
Infected: Trojan program Trojan-Dropper.Win32.Agent.dgo c:\users\richard\appdata\local\temp\efcdc.exe 320.5 KB
Infected: Trojan program Backdoor.Win32.Agent.dbm c:\users\richard\appdata\local\microsoft\windows\temporary internet files\content.ie5\wcpotsb8\gamadril20071203[1] 72.5 KB
Infected: Trojan program Trojan-Dropper.Win32.Agent.dgo c:\users\richard\appdata\local\temp\squcjhdt.exe 394 KB
