I was unable to scan online with Kaspersky as my internet connection is not that brilliant and I have so many drives. I downloaded the trial version and uninstalled other virus scanners and scanned. I can't find out how to print a consolidated report but problems were found as follows:
Detected
--------
Status Object
------ ------
quarantined: virus Heur.Invader (modification) File: c:\documents and settings\carolyn stewart\desktop\combofix.exe//PE_Patch.UPX/32788R22FWJFW\catchme.cfexe//PE_Patch.UPX
quarantined: virus Heur.Invader (modification) File: C:\System Volume Information\_restore{22BAC084-4C30-421C-82B5-124863A3BC71}\RP1148\A0170503.exe//PE_Patch.UPX/32788R22FWJFW\catchme.cfexe//PE_Patch.UPX
quarantined: virus Heur.Invader (modification) File: C:\System Volume Information\_restore{22BAC084-4C30-421C-82B5-124863A3BC71}\RP1157\A0171196.exe//PE_Patch.UPX/32788R22FWJFW\catchme.cfexe//PE_Patch.UPX
quarantined: Trojan program Trojan-Spy.HTML.Fraud.gen (modification) Email message: Outlook\Personal Folders\Top of Personal Folders\Inbox\Carolyn\[From
ayPal][Subject:Message has a suspicious part : New email address added to your PayPal account][Time:2004/12/17 06:32:31]/HTMLBody
These have now been deleted. Scan took over 2 hours and seems that all files were checked.
I then ran DDS and here are the logs:
DDS (Ver_09-02-01.01) - NTFSx86
Run by Carolyn Stewart at 13:33:09.31 on Tue 17/03/2009
Internet Explorer: 7.0.5730.11
Microsoft Windows XP Professional 5.1.2600.3.1252.61.1033.18.2047.1436 [GMT 10:00]
AV: Kaspersky Anti-Virus *On-access scanning enabled* (Updated)
AV: Windows Live OneCare *On-access scanning disabled* (Updated)
FW: Windows Live OneCare Firewall *enabled*
============== Running Processes ===============
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\Program Files\ASUS\Asus Probe\AsusProb.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Other Program Files\Super\SUPERAntiSpyware.exe
C:\Program Files\LG Soft India\forteManager\bin\Monitor.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Documents and Settings\Carolyn Stewart\Desktop\dds.scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://au.my.yahoo.com/
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - d:\other program files\rpbrowserrecordplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot - search & destroy\SDHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [SUPERAntiSpyware] d:\other program files\super\SUPERAntiSpyware.exe
mRun: [SiSUSBRG] c:\windows\SiSUSBrg.exe
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [OneCareUI] "c:\program files\microsoft windows onecare live\winssnotify.exe"
mRun: [ASUS Probe] c:\program files\asus\asus probe\AsusProb.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [UnlockerAssistant] "c:\program files\unlocker\UnlockerAssistant.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_05\bin\jusched.exe"
mRun: [AVP] "c:\program files\kaspersky lab\kaspersky anti-virus 7.0\avp.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\caroly~1\startm~1\programs\startup\erunt autobackup.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\fortem~1.lnk - c:\program files\lg soft india\fortemanager\bin\Monitor.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\canon\easy-webprint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\canon\easy-webprint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\canon\easy-webprint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\canon\easy-webprint\Resource.dll/RC_Print.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
IE: {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - {85E0B171-04FA-11D1-B7DA-00A0C90348D6} - c:\program files\kaspersky lab\kaspersky anti-virus 7.0\SCIEPlgn.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - c:\program files\hello\PicasaCapture.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot - search & destroy\SDHelper.dll
Trusted Zone: virginmobile.com.au\www
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} - hxxp://dlmanager.akamaitools.com.edgesuite.net/dlmanager/versions/activex/dlm-activex-2.0.4.4.cab
DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc3.cab
DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} - hxxp://www.myheritage.com/Genoogle/Components/ActiveX/SearchEngineQuery.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} - hxxp://www.crucial.com/controls/cpcScanner.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Notify: !SASWinLogon - d:\other program files\super\SASWINLO.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: klogon - c:\windows\system32\klogon.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - d:\other program files\super\SASSEH.DLL
============= SERVICES / DRIVERS ===============
R0 kl1;Kl1;c:\windows\system32\drivers\kl1.sys [2007-10-31 112144]
R1 klif;Klif;c:\windows\system32\drivers\klif.sys [2007-12-28 195344]
R1 SASDIFSV;SASDIFSV;d:\other program files\super\sasdifsv.sys [2008-11-17 8944]
R1 SASKUTIL;SASKUTIL;d:\other program files\super\SASKUTIL.SYS [2008-11-17 55024]
R2 AVP;Kaspersky Anti-Virus 7.0;c:\program files\kaspersky lab\kaspersky anti-virus 7.0\avp.exe [2008-2-8 227856]
R2 OcHealthMon;Windows Live OneCare Health Monitor;c:\program files\microsoft windows onecare live\OcHealthMon.exe [2008-11-5 25968]
R2 Symantec Core LC;Symantec Core LC;c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe [2006-5-26 1174152]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2007-12-13 24592]
R3 SASENUM;SASENUM;d:\other program files\super\SASENUM.SYS [2008-11-17 7408]
S3 LGDDCDevice;LGDDCDevice;c:\program files\lg soft india\fortemanager\bin\I2CDriver.sys [2009-1-21 14336]
S3 LGII2CDevice;LGII2CDevice;c:\program files\lg soft india\fortemanager\bin\PII2CDriver.sys [2009-1-21 13312]
=============== Created Last 30 ================
2009-03-17 09:01 101,287 a------- c:\windows\system32\drivers\klin.dat
2009-03-17 09:01 89,601 a------- c:\windows\system32\drivers\klick.dat
2009-03-17 09:01 11,502,880 a--sh--- c:\windows\system32\drivers\fidbox.dat
2009-03-17 09:01 166,472 a--sh--- c:\windows\system32\drivers\fidbox.idx
2009-03-17 09:01 6,432 a--sh--- c:\windows\system32\drivers\fidbox2.dat
2009-03-17 09:01 1,508 a--sh--- c:\windows\system32\drivers\fidbox2.idx
2009-03-17 09:01 <DIR> --d----- c:\program files\Kaspersky Lab
2009-03-17 09:01 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Kaspersky Lab
2009-03-17 08:53 <DIR> --d----- C:\kav
2009-03-17 06:03 <DIR> --d----- C:\ComboFix
2009-03-16 07:25 <DIR> a-dshr-- C:\cmdcons
2009-03-16 07:23 161,792 a------- c:\windows\SWREG.exe
2009-03-16 07:23 98,816 a------- c:\windows\sed.exe
2009-03-14 07:01 <DIR> --d----- c:\windows\pss
2009-03-13 19:58 <DIR> --d----- c:\program files\Trend Micro
2009-03-13 16:42 <DIR> --d----- c:\docume~1\caroly~1\applic~1\Desktopicon
2009-03-13 16:42 <DIR> --d----- c:\program files\Unlocker
2009-03-13 13:20 102,664 a------- c:\windows\system32\drivers\tmcomm.sys
2009-03-13 13:19 <DIR> --d----- c:\documents and settings\carolyn stewart\.housecall6.6
2009-03-13 09:10 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-03-13 08:14 <DIR> --d----- c:\program files\ThreatExpert Memory Scanner
2009-03-12 19:00 28 a------- c:\windows\Lic.xxx
2009-03-12 19:00 28,672 a------- c:\windows\system32\eEmpty.exe
2009-03-12 19:00 522 a------- c:\windows\system32\Microsoft.VC80.CRT.manifest
2009-03-12 19:00 146,432 a------- c:\windows\R.COM
2009-03-12 19:00 135,680 a------- c:\windows\system32\T.COM
2009-03-12 19:00 <DIR> --d----- c:\program files\common files\MicroWorld
2009-03-12 19:00 <DIR> --d----- c:\docume~1\alluse~1\applic~1\MicroWorld
2009-02-24 19:31 <DIR> --d----- c:\docume~1\caroly~1\applic~1\Malwarebytes
2009-02-24 19:31 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-02-24 19:31 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-24 19:31 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-02-24 19:31 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-02-23 08:35 552 a------- c:\windows\system32\DO_NOT_DELETE.backupSetID
==================== Find3M ====================
2009-03-17 11:11 112,144 a------- c:\windows\system32\drivers\kl1.sys
2009-02-09 21:13 1,846,784 a------- c:\windows\system32\win32k.sys
2008-12-31 17:04 691,560 a------- c:\windows\system32\OGACheckControl.dll
2008-12-31 17:04 528,744 a------- c:\windows\system32\OGAVerify.exe
2008-12-31 17:04 502,120 a------- c:\windows\system32\OGAAddin.dll
2008-12-25 10:15 1,882 a------- c:\windows\eReg.dat
2008-12-21 09:15 826,368 a------- c:\windows\system32\wininet.dll
2008-08-15 09:49 0 a------- c:\docume~1\alluse~1\applic~1\PKP_DLbx.DAT
2006-05-14 10:39 20 ----h--- c:\docume~1\alluse~1\applic~1\PKP_DLea.DAT
2002-07-28 23:40 1,059,840 a------- c:\program files\DS_Bonus_Plugin.8bf
2008-12-12 14:11 2,932 a--sh--- c:\windows\system32\KGyGaAvL.sys
2008-05-29 06:43 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008052920080530\index.dat
============= FINISH: 13:34:26.73 ===============
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-02-01.01)
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume3
Install Date: 28/02/2006 5:23:30 PM
System Uptime: 17/03/2009 1:18:26 PM (0 hours ago)
Motherboard: ASUSTeK Computer INC. | | P5S800-VM
Processor: Intel(R) Pentium(R) 4 CPU 3.20GHz | CPU 1 | 3192/200mhz
==== Disk Partitions =========================
A: is Removable
C: is FIXED (NTFS) - 30 GiB total, 6.911 GiB free.
D: is FIXED (NTFS) - 29 GiB total, 15.83 GiB free.
E: is FIXED (NTFS) - 127 GiB total, 54.16 GiB free.
F: is FIXED (NTFS) - 98 GiB total, 73.087 GiB free.
G: is FIXED (NTFS) - 135 GiB total, 1.761 GiB free.
H: is FIXED (NTFS) - 279 GiB total, 244.994 GiB free.
J: is CDROM ()
==== Disabled Device Manager Items =============
==== System Restore Points ===================
RP1054: 7/02/2009 11:53:38 AM - System Checkpoint
RP1055: 7/02/2009 2:44:45 PM - Software Distribution Service 3.0
RP1056: 7/02/2009 9:48:17 PM - Software Distribution Service 3.0
RP1057: 8/02/2009 9:15:28 PM - Software Distribution Service 3.0
RP1058: 9/02/2009 9:35:00 PM - Software Distribution Service 3.0
RP1059: 10/02/2009 11:59:39 AM - Software Distribution Service 3.0
RP1060: 10/02/2009 10:30:44 PM - Software Distribution Service 3.0
RP1061: 12/02/2009 6:18:15 AM - Software Distribution Service 3.0
RP1062: 12/02/2009 9:43:51 PM - Software Distribution Service 3.0
RP1063: 13/02/2009 8:53:37 PM - Software Distribution Service 3.0
RP1064: 14/02/2009 10:12:33 PM - Software Distribution Service 3.0
RP1065: 15/02/2009 8:58:36 PM - Software Distribution Service 3.0
RP1066: 16/02/2009 7:45:43 AM - Software Distribution Service 3.0
RP1067: 16/02/2009 2:34:53 PM - Software Distribution Service 3.0
RP1068: 16/02/2009 9:36:37 PM - Software Distribution Service 3.0
RP1069: 17/02/2009 2:20:31 PM - Software Distribution Service 3.0
RP1070: 17/02/2009 8:55:48 PM - Software Distribution Service 3.0
RP1071: 18/02/2009 9:23:31 AM - Software Distribution Service 3.0
RP1072: 18/02/2009 5:56:33 PM - Software Distribution Service 3.0
RP1073: 18/02/2009 9:04:42 PM - Software Distribution Service 3.0
RP1074: 19/02/2009 12:29:48 PM - Software Distribution Service 3.0
RP1075: 19/02/2009 8:26:24 PM - Software Distribution Service 3.0
RP1076: 20/02/2009 2:36:40 PM - Software Distribution Service 3.0
RP1077: 20/02/2009 9:50:21 PM - Software Distribution Service 3.0
RP1078: 21/02/2009 9:49:56 AM - Software Distribution Service 3.0
RP1079: 21/02/2009 11:26:24 PM - Software Distribution Service 3.0
RP1080: 22/02/2009 6:07:04 PM - Software Distribution Service 3.0
RP1081: 22/02/2009 10:29:39 PM - Software Distribution Service 3.0
RP1082: 23/02/2009 11:28:39 AM - Software Distribution Service 3.0
RP1083: 23/02/2009 9:29:34 PM - Software Distribution Service 3.0
RP1084: 24/02/2009 12:06:00 PM - Software Distribution Service 3.0
RP1085: 24/02/2009 9:08:26 PM - Software Distribution Service 3.0
RP1086: 25/02/2009 11:01:30 AM - Software Distribution Service 3.0
RP1087: 25/02/2009 9:28:54 PM - Software Distribution Service 3.0
RP1088: 26/02/2009 6:14:40 AM - Software Distribution Service 3.0
RP1089: 26/02/2009 7:58:59 PM - Software Distribution Service 3.0
RP1090: 27/02/2009 8:00:01 PM - Software Distribution Service 3.0
RP1091: 27/02/2009 9:47:48 PM - Software Distribution Service 3.0
RP1092: 28/02/2009 9:44:26 PM - Software Distribution Service 3.0
RP1093: 1/03/2009 9:38:18 PM - Software Distribution Service 3.0
RP1094: 2/03/2009 9:35:49 PM - Software Distribution Service 3.0
RP1095: 3/03/2009 1:08:15 PM - Software Distribution Service 3.0
RP1096: 3/03/2009 9:23:22 PM - Software Distribution Service 3.0
RP1097: 4/03/2009 9:42:48 PM - Software Distribution Service 3.0
RP1098: 5/03/2009 10:02:31 PM - Software Distribution Service 3.0
RP1099: 6/03/2009 3:48:57 PM - Software Distribution Service 3.0
RP1100: 6/03/2009 9:24:42 PM - Software Distribution Service 3.0
RP1101: 7/03/2009 9:36:15 PM - Software Distribution Service 3.0
RP1102: 8/03/2009 4:16:42 PM - Software Distribution Service 3.0
RP1103: 8/03/2009 9:13:41 PM - Software Distribution Service 3.0
RP1104: 9/03/2009 11:17:12 AM - Software Distribution Service 3.0
RP1105: 9/03/2009 9:59:56 PM - Software Distribution Service 3.0
RP1106: 10/03/2009 11:07:05 AM - Software Distribution Service 3.0
RP1107: 10/03/2009 8:35:41 PM - Software Distribution Service 3.0
RP1108: 10/03/2009 9:19:51 PM - Software Distribution Service 3.0
RP1109: 11/03/2009 9:15:01 PM - Software Distribution Service 3.0
RP1110: 12/03/2009 3:30:00 PM - Microsoft OneCare Protection Checkpoint
RP1111: 12/03/2009 3:33:11 PM - Software Distribution Service 3.0
RP1112: 12/03/2009 3:46:34 PM - Microsoft OneCare Protection Checkpoint
RP1113: 12/03/2009 3:51:14 PM - Microsoft OneCare Protection Checkpoint
RP1114: 12/03/2009 5:29:00 PM - Microsoft OneCare Protection Checkpoint
RP1115: 12/03/2009 5:37:33 PM - Installed Antispyware2008
RP1116: 12/03/2009 6:05:36 PM - Microsoft OneCare Protection Checkpoint
RP1117: 12/03/2009 8:25:22 PM - Software Distribution Service 3.0
RP1118: 12/03/2009 8:40:26 PM - Microsoft OneCare Protection Checkpoint
RP1119: 12/03/2009 9:13:03 PM - Software Distribution Service 3.0
RP1120: 13/03/2009 6:01:49 AM - Microsoft OneCare Protection Checkpoint
RP1121: 13/03/2009 6:08:46 AM - Microsoft OneCare Protection Checkpoint
RP1122: 13/03/2009 7:41:33 AM - Microsoft OneCare Protection Checkpoint
RP1123: 13/03/2009 9:19:44 AM - Removed Ad-Aware
RP1124: 13/03/2009 9:33:11 AM - Removed Ad-Aware
RP1125: 13/03/2009 9:57:55 AM - Removed Ad-Aware
RP1126: 13/03/2009 10:06:46 AM - Microsoft OneCare Protection Checkpoint
RP1127: 13/03/2009 11:59:40 AM - Removed Ad-Aware
RP1128: 13/03/2009 12:30:55 PM - Microsoft OneCare Protection Checkpoint
RP1129: 13/03/2009 12:55:59 PM - Microsoft OneCare Protection Checkpoint
RP1130: 13/03/2009 2:06:47 PM - Avira AntiVir Personal - 13/03/2009 14:06
RP1131: 13/03/2009 5:09:00 PM - Software Distribution Service 3.0
RP1132: 13/03/2009 5:18:25 PM - Microsoft OneCare Protection Checkpoint
RP1133: 13/03/2009 5:46:20 PM - Removed Ad-Aware
RP1134: 13/03/2009 7:47:06 PM - Microsoft OneCare Protection Checkpoint
RP1135: 13/03/2009 11:14:37 PM - Software Distribution Service 3.0
RP1136: 14/03/2009 5:53:31 AM - Microsoft OneCare Protection Checkpoint
RP1137: 14/03/2009 6:30:42 AM - Software Distribution Service 3.0
RP1138: 14/03/2009 6:50:44 AM - Microsoft OneCare Protection Checkpoint
RP1139: 14/03/2009 9:34:01 AM - Software Distribution Service 3.0
RP1140: 14/03/2009 10:25:49 AM - Microsoft OneCare Protection Checkpoint
RP1141: 14/03/2009 9:12:25 PM - Software Distribution Service 3.0
RP1142: 15/03/2009 10:50:18 AM - Removed Ad-Aware
RP1143: 15/03/2009 10:25:45 PM - Software Distribution Service 3.0
RP1144: 16/03/2009 7:24:05 AM - ComboFix created restore point
RP1145: 16/03/2009 10:12:31 AM - Software Distribution Service 3.0
RP1146: 16/03/2009 4:19:55 PM - Removed Ad-Aware
RP1147: 16/03/2009 5:49:50 PM - Software Distribution Service 3.0
RP1148: 16/03/2009 9:21:17 PM - Software Distribution Service 3.0
RP1149: 17/03/2009 6:04:15 AM - ComboFix created restore point
RP1150: 17/03/2009 6:14:01 AM - Removed Adobe Reader 7.1.0
RP1151: 17/03/2009 6:15:55 AM - Removed Adobe Reader Chinese Simplified Fonts
RP1152: 17/03/2009 6:28:54 AM - Installed Adobe Reader 9.1.
RP1153: 17/03/2009 6:34:21 AM - Removed J2SE Runtime Environment 5.0 Update 5
RP1154: 17/03/2009 6:34:49 AM - Removed J2SE Runtime Environment 5.0 Update 6
RP1155: 17/03/2009 6:35:20 AM - Removed J2SE Runtime Environment 5.0 Update 9
RP1156: 17/03/2009 8:54:41 AM - Avira AntiVir Personal - 17/03/2009 8:54
RP1157: 17/03/2009 9:00:58 AM - Installed Kaspersky Anti-Virus 7.0.
==== Installed Programs ======================
abrViewer.NET 1.0.1
ACDSee 9 Photo Manager
Adobe Flash Player 10 ActiveX
Adobe Reader 9.1
Advanced SystemCare 3
Alien Skin Snap Art
AM-DeadLink
ArtRage 2
ASUS Probe V2.24.09
ASUSDVD
ATI - Software Uninstall Utility
ATI Catalyst Control Center
ATI Display Driver
Better Homes and Gardens Home Designer Suite 6.0
Canon iP4200
Canon MP Navigator 2.0
Canon MP150
Canon Setup Utility 2.0
Canon Utilities Easy-PhotoPrint
Canon Utilities Easy-PrintToolBox
CD-LabelPrint
CD Stomper 32 bit
CEP - Color Enable Package
Compatibility Pack for the 2007 Office system
Corel Paint Shop Pro X
Corel Photo Album 6
Critical Update for Windows Media Player 11 (KB959772)
CutePDF Writer 2.7
DiMAGE Scan Dual4 ver.1.0
DVD Decrypter (Remove Only)
DVD Shrink 3.2
Easy-WebPrint
ERUNT 1.1j
Eye Candy 3
Fashion Solitaire
Fishdom
FixerBundle
Focus Magic 3.02
forteManager
Free CD to MP3 Converter
Free Notes 3.02
GTOneCare
Harry's Filters 3.01
Hello (remove only)
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
iPod for Windows 2005-09-23
iPod for Windows 2006-06-28
iTunes
Jasc Paint Shop Photo Album 5
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Kaspersky Anti-Virus 7.0
Legacy 7.0
Legacy Charting 7.0
LightScribe 1.4.39.1
Livestation
LiveUpdate Notice (Symantec Corporation)
Luxor 2
Mah Jong Quest II™
Malwarebytes' Anti-Malware
Mavis Beacon Teaches Typing 17
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Application Error Reporting
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft Office Project Professional 2003
Microsoft Office Visio Professional 2003
Microsoft Protection Service
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Windows Live OneCare Resources v2.5.2900.20
Microsoft Windows OneCare Live AntiSpyware and AntiVirus
Microsoft Windows OneCare Live v2.5.2900.20
Microsoft Windows OneCare Live v2.5.2900.20 Idcrl Install
MoRUN.net Sticker
MotionDV STUDIO 5.1E LE for DV
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MyHeritage Family Tree Builder
Nero Suite
Nikon Message Center
OGA Notifier 1.7.0105.35.0
OLYMPUS CAMEDIA Master 4.2
OmniPage SE 2.0
Opanda IExif 2.3
OpenAL
PartitionMagic
PhotoFilter 1.0
PictureProject
PowerQuest PartitionMagic 8.0
PX Engine
Quicken 2002 Personal Plus SE
QuickTime
RawShooter essentials 2005
RealPlayer
Realtek AC'97 Audio
Realtek RTL8139/810x Fast Ethernet NIC Driver Setup
SAMSUNG CDMA Modem Driver Set
SAMSUNG Mobile USB Modem ^^
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung PC Studio
SD Viewer for DV
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Shadow Illuminator Home
SimCity 4
Spybot - Search & Destroy
SUPERAntiSpyware Free Edition
Symantec KB-DocID:2003093015493306
The Font Thing
The Sims 2
The Sims 2 Open For Business
The Sims 2 Pets
The Sims Makin' Magic
The Sims™ 2 Apartment Life
The Sims™ 2 Bon Voyage
The Sims™ 2 FreeTime
The Sims™ 2 Seasons
ThreatExpert Memory Scanner 1.0
Topaz Adjust
Tradewinds Caravans™
Uninstall DreamSuite Bonus
Uninstall MysticalTTC
Uninstall MysticalTTCDEMO
Unlocker 1.8.7
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Video Stream Driver for Panasonic DVC
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Live OneCare
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
WinRAR archiver
Wisdom-soft ScreenHunter 4.0 Free
X-Lite 3.0
==== Event Viewer Messages From Past Week ========
12/03/2009 6:05:36 PM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {8C14249C-C284-46D5-B9DE-123937980CE7} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Remove Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
12/03/2009 5:29:00 PM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {205C679E-E402-4B49-BB76-D1AD502AC09A} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Remove Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
12/03/2009 4:28:14 PM, error: Disk [11] - The driver detected a controller error on \Device\Harddisk0\D.
12/03/2009 4:26:44 PM, error: atapi [9] - The device, \Device\Ide\IdePort2, did not respond within the timeout period.
12/03/2009 3:51:14 PM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {6888D1E8-6E04-4E81-BCD0-836F48BE10D6} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Remove Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
12/03/2009 3:46:34 PM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {7395AEA1-82D1-42B9-8452-C1D271665761} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Remove Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
12/03/2009 3:30:12 PM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {441C32AC-52A2-470D-9E79-61284676CF1E} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Remove Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
12/03/2009 3:30:00 PM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=Virus:JS/Xilos&threatid=2147596274 Scan ID: {1B7CB19D-7D4D-4DD8-9DF9-9E801F88FC5C} User: CAROLYN-212D4EF\Carolyn Stewart Name: Virus:JS/Xilos ID: 2147596274 Severity: Severe Category: Virus Path: file:\\?\C:\Documents and Settings\Carolyn Stewart\Local Settings\Temporary Internet Files\Content.IE5\F3Y91CDL\clicksagent2[1].htm Alert Type: Action: Clean Error Code: 0x80508017 Error description: Some actions couldn't be applied to potentially harmful items. The items might be stored in a read-only location. Delete the files or folders that contains the items or, for information on removing read-only permissions from files and folders, see Help and Support.
12/03/2009 8:40:26 PM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {EA20026A-2332-4156-BC91-81F96E6BD772} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Remove Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
13/03/2009 6:01:49 AM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {DC8E1E66-60B5-45AF-963C-5B71D8CC41FB} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Remove Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
13/03/2009 6:08:46 AM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {1DC0BE5C-F73E-4F9D-A69B-1A6094F401E9} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Quarantine Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
13/03/2009 7:41:33 AM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {7A9DB99F-349A-4DB4-8B1C-D9A8B383BA76} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Quarantine Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
13/03/2009 8:43:02 AM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {8515DEE7-C581-43A9-A3A1-64ED2C92B453} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Remove Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
13/03/2009 10:03:57 AM, error: Print [19] - Sharing printer failed + 1722, Printer Canon iP4200 share name Canon iP4200.
13/03/2009 10:06:46 AM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {82C622C9-EE19-43E7-9365-00930D3B1398} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Quarantine Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
13/03/2009 12:22:04 PM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {49368223-B042-44C9-96C9-B4929079EC27} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Remove Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
13/03/2009 12:30:55 PM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {D47FC076-D9A2-44C9-B812-1617DA14B878} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Quarantine Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
13/03/2009 12:55:59 PM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {202EA27B-5334-4EDD-A54C-06A2E2FD37BD} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Remove Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
13/03/2009 2:21:25 PM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {968B8E82-847B-45B9-B603-2A54BD718081} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Remove Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
13/03/2009 4:44:04 PM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {2AD36B72-A529-4F78-B727-309D01008B20} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Remove Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
13/03/2009 4:45:27 PM, error: atapi [5] - A parity error was detected on \Device\Ide\IdePort2.
13/03/2009 5:00:51 PM, error: MSFWDrv [9] - The device, , did not respond within the timeout period.
13/03/2009 5:18:25 PM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {21F42A91-11DC-4ADB-8B21-D0070B98E54C} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Remove Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
13/03/2009 7:01:55 PM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {98E0F733-2E49-48DF-8CCC-EC60C4D2A908} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Quarantine Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
13/03/2009 7:47:07 PM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {7C47596B-6CFF-4062-B931-A3F675EFB5E7} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Quarantine Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
13/03/2009 8:39:53 PM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {A534B4B8-554E-44B8-A59D-3E7471611A2C} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Remove Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
14/03/2009 5:53:31 AM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {801C533E-5DA1-484E-B85F-8D8DDFCFF4F6} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Remove Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
14/03/2009 6:05:54 AM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {81A95EA5-F32C-4B52-93A4-4BC383ED28F5} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Remove Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
14/03/2009 6:50:44 AM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {50EBACE5-9207-4860-842D-7745B6569812} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Remove Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
14/03/2009 6:51:37 AM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {D6D3063B-B7F1-4686-AB74-90180373E881} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Remove Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
14/03/2009 7:08:44 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
14/03/2009 7:08:45 AM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
14/03/2009 7:08:45 AM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
14/03/2009 7:08:45 AM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
14/03/2009 7:08:45 AM, error: Service Control Manager [7001] - The IP Traffic Filter Driver service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
14/03/2009 7:08:45 AM, error: Service Control Manager [7001] - The MSFWDrv service depends on the IP Traffic Filter Driver service which failed to start because of the following error: The dependency service or group failed to start.
14/03/2009 7:08:45 AM, error: Service Control Manager [7001] - The OneCare Firewall service depends on the MSFWDrv service which failed to start because of the following error: The dependency service or group failed to start.
14/03/2009 7:08:45 AM, error: Service Control Manager [7001] - The Network Location Awareness (NLA) service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
14/03/2009 7:08:45 AM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
14/03/2009 7:08:45 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD aslm75 avgio avipbb eeCtrl Fips intelppm IPSec MRxSmb MSFWHLPR NetBIOS NetBT RasAcd Rdbss SASDIFSV SASKUTIL ssmdrv Tcpip WS2IFSL
14/03/2009 7:08:59 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
14/03/2009 7:15:02 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
14/03/2009 7:23:45 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
14/03/2009 10:23:34 AM, error: Print [19] - Sharing printer failed + 1722, Printer Canon MP150 Series Printer share name Canon MP150 Series Printer.
14/03/2009 10:25:50 AM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {C70714E6-B720-408C-A7E3-41895AA639C8} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Remove Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
14/03/2009 3:01:15 PM, error: OneCareMP [1008] - Windows OneCare Live has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {251EE402-E2C0-42A5-99B1-0AAE58351132} Scan Type: AntiMalware User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Action: Remove Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
14/03/2009 4:20:35 PM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {821E08CF-D5CD-4905-9794-E41DBB8D785B} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Remove Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
14/03/2009 4:42:31 PM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {E0E5832C-A46F-46BF-BAEE-1C1071F25DEB} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Remove Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
14/03/2009 6:57:04 PM, error: OneCareMP [3006] - Windows OneCare Live Real-Time Protection agent has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:Win32/Obitel&threatid=2147617719 Scan ID: {7A63454D-5A25-4091-A15A-673FCB322097} User: CAROLYN-212D4EF\Carolyn Stewart Name: TrojanDownloader:Win32/Obitel ID: 2147617719 Severity: Severe Category: Trojan Downloader Path: Alert Type: Action: Remove Error Code: 0x80508022 Error description: To finish removing spyware and other potentially unwanted software, restart the computer.
15/03/2009 1:06:52 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer SONIA-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{35C52376-D70E-45AA-. The master browser is stopping or an election is being forced.
14/03/2009 6:07:45 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file userinit.exe. This file was restored to the original version to maintain system stability. The file version of the system file is 5.1.2600.5512.
==== End Of File ===========================
Thanks so much for your help. It is so appreciated!!
