xlibgfl254.dll

robmarreel · Oct 6, 2007

Hey guys, I tried to follow some similar steps in your other posts but couldn't get it cleaned up.

I am getting the Bad Windows Image error on xlibgfl254.dll.

Tried running SmitFraudFix and SDFix. The two logs are below and I really appreciate the help.

Rob

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:30:17 PM, on 10/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5700.0006)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Citrix\GoToMyPC\g2svc.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\Program Files\Citrix\GoToMyPC\g2comm.exe
C:\Program Files\Norton Ghost\Agent\VProSvc.exe
C:\Program Files\Citrix\GoToMyPC\g2pre.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Citrix\GoToMyPC\g2tray.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jucheck.exe
C:\Program Files\Common Files\AOL\1135184755\ee\AOLSoftware.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\PROGRA~1\mcafee.com\agent\McAgent.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton Ghost\Agent\GhostTray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Cloudmark\SpamNet\OE\snoe.exe
C:\Program Files\NETGEAR\WG511v2\wlancfg5.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.BIN
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: XBTP03102 - {B1C35173-632F-4DD7-815D-5B497866957B} - C:\PROGRA~1\SOFTOM~1\TOOLBA~1\INSTAL~1\{47D21~1\0\toolbar.dll (file missing)
O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\PROGRA~1\SOFTOM~1\TOOLBA~1\bin\tbcore3U.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1135184755\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton Ghost\Agent\GhostTray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [GoToMyPC] C:\Program Files\Citrix\GoToMyPC\g2svc.exe -logon
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx2\PXConsole.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Cloudmark Desktop for Outlook Express.lnk = ?
O4 - Global Startup: NETGEAR WG511v2 Smart Wizard.lnk = C:\Program Files\NETGEAR\WG511v2\wlancfg5.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {2D72C39D-53F6-4AEA-A9DB-1298429DA974} (3DVista Viewer Control) - http://www.3dvista.com/downloads/viewer3dv.cab
O16 - DPF: {2DEF4530-8CE6-41C9-84B6-A54536C90213} (Crystal Report Viewer Control 9) - https://www.libertytax.net/crystalreportviewers/activeXViewer/activexviewer.cab
O16 - DPF: {40F8967E-34A6-474A-837A-CEC1E7DAC54C} - https://accounting.quickbooks.com/c1/v16.548/qboax9.cab
O16 - DPF: {41289E02-198A-4034-8CF9-5A8739A80D0D} (ReportPromptInfoDlg Class) - https://www.libertytax.net/crystalreportviewers/activeXViewer/reportparameterdialog.cab
O16 - DPF: {4B5C9C28-3806-47B5-89A9-93063323160F} (ReportExport Class) - https://www.libertytax.net/crystalreportviewers/activeXViewer/activexviewer.cab
O16 - DPF: {843EE768-3A97-455C-9076-741BA3AD7B62} (QuickBooks Online Edition Utilities Class v10) - https://accounting.quickbooks.com/c6/v16.607/qboax10.cab
O16 - DPF: {8CE3BAE6-AB66-40B6-9019-41E5282FF1E2} - https://accounting.quickbooks.com/c8/v14.174/qboax8.cab
O16 - DPF: {934CC260-C5AA-43C4-A657-7B70C5B3DAE1} (Crystal Report Web Report Source Control 9) - https://www.libertytax.net/crystalreportviewers/activeXViewer/activexviewer.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://aolsvc.aol.com/onlinegames/pandacraze/gpcontrol.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: GoToMyPC - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToMyPC\g2svc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: PREVXAgent - Prevx - C:\Program Files\Prevx2\PXAgent.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Apache Tomcat (Tomcat5) - Apache Software Foundation - C:\Program Files\Apache Software Foundation\Tomcat 5.5\bin\tomcat5.exe

--
End of file - 11674 bytes

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Friday, October 05, 2007 5:34:46 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.1
Kaspersky Anti-Virus database last update: 6/10/2007
Kaspersky Anti-Virus database records: 428099
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - Critical Areas:
C:\WINDOWS
C:\DOCUME~1\ROBMAR~1\LOCALS~1\Temp\

Scan Statistics:
Total number of scanned objects: 16953
Number of viruses found: 0
Number of infected objects: 0
Number of suspicious objects: 0
Duration of the scan process: 00:32:41

Infected Object Name / Virus Name / Last Action
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\gotomon.log Object is locked skipped
C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_144.dat Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_d4.dat Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\DOCUME~1\ROBMAR~1\LOCALS~1\Temp\Perflib_Perfdata_804.dat Object is locked skipped
C:\DOCUME~1\ROBMAR~1\LOCALS~1\Temp\sqlite_j4Vm66F7UE5qXb9 Object is locked skipped
C:\DOCUME~1\ROBMAR~1\LOCALS~1\Temp\~DF3BAB.tmp Object is locked skipped
C:\DOCUME~1\ROBMAR~1\LOCALS~1\Temp\~DFD8.tmp Object is locked skipped

Scan process completed.

Shaba · Oct 7, 2007

Hi robmarreel

1. Download combofix from one of these links:
Link1
Link2
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Post:

- a fresh HijackThis log
- combofix report

robmarreel · Oct 9, 2007

New logs attached

Thanks for the help. I still get the error. New logs below.

Rob

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:23:54 PM, on 10/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5700.0006)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Citrix\GoToMyPC\g2svc.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\Program Files\Citrix\GoToMyPC\g2comm.exe
C:\Program Files\Norton Ghost\Agent\VProSvc.exe
C:\Program Files\Citrix\GoToMyPC\g2pre.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Citrix\GoToMyPC\g2tray.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\AOL\1135184755\ee\AOLSoftware.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jucheck.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\PROGRA~1\mcafee.com\agent\McAgent.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton Ghost\Agent\GhostTray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Cloudmark\SpamNet\OE\snoe.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\NETGEAR\WG511v2\wlancfg5.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.BIN
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: XBTP03102 - {B1C35173-632F-4DD7-815D-5B497866957B} - C:\PROGRA~1\SOFTOM~1\TOOLBA~1\INSTAL~1\{47D21~1\0\toolbar.dll (file missing)
O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\PROGRA~1\SOFTOM~1\TOOLBA~1\bin\tbcore3U.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1135184755\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton Ghost\Agent\GhostTray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [GoToMyPC] C:\Program Files\Citrix\GoToMyPC\g2svc.exe -logon
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx2\PXConsole.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Cloudmark Desktop for Outlook Express.lnk = ?
O4 - Global Startup: NETGEAR WG511v2 Smart Wizard.lnk = C:\Program Files\NETGEAR\WG511v2\wlancfg5.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {2D72C39D-53F6-4AEA-A9DB-1298429DA974} (3DVista Viewer Control) - http://www.3dvista.com/downloads/viewer3dv.cab
O16 - DPF: {2DEF4530-8CE6-41C9-84B6-A54536C90213} (Crystal Report Viewer Control 9) - https://www.libertytax.net/crystalreportviewers/activeXViewer/activexviewer.cab
O16 - DPF: {40F8967E-34A6-474A-837A-CEC1E7DAC54C} - https://accounting.quickbooks.com/c1/v16.548/qboax9.cab
O16 - DPF: {41289E02-198A-4034-8CF9-5A8739A80D0D} (ReportPromptInfoDlg Class) - https://www.libertytax.net/crystalreportviewers/activeXViewer/reportparameterdialog.cab
O16 - DPF: {4B5C9C28-3806-47B5-89A9-93063323160F} (ReportExport Class) - https://www.libertytax.net/crystalreportviewers/activeXViewer/activexviewer.cab
O16 - DPF: {843EE768-3A97-455C-9076-741BA3AD7B62} (QuickBooks Online Edition Utilities Class v10) - https://accounting.quickbooks.com/c6/v16.607/qboax10.cab
O16 - DPF: {8CE3BAE6-AB66-40B6-9019-41E5282FF1E2} - https://accounting.quickbooks.com/c8/v14.174/qboax8.cab
O16 - DPF: {934CC260-C5AA-43C4-A657-7B70C5B3DAE1} (Crystal Report Web Report Source Control 9) - https://www.libertytax.net/crystalreportviewers/activeXViewer/activexviewer.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://aolsvc.aol.com/onlinegames/pandacraze/gpcontrol.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: GoToMyPC - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToMyPC\g2svc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: PREVXAgent - Prevx - C:\Program Files\Prevx2\PXAgent.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Apache Tomcat (Tomcat5) - Apache Software Foundation - C:\Program Files\Apache Software Foundation\Tomcat 5.5\bin\tomcat5.exe

--
End of file - 11678 bytes

robmarreel · Oct 9, 2007

ComboFix

The BB wouldn't let me post both logs in the same msg, so here is the other.

ComboFix 07-10-09.3 - Rob Marreel 2007-10-08 22:05:52.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.174 [GMT -7:00]
Running from: C:\Documents and Settings\Rob Marreel\Local Settings\Temporary Internet Files\Content.IE5\UK1HG3C3\ComboFix[1].exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Rob Marreel\Application Data\unins000.exe
C:\WINDOWS\system32\drivers\fad.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

-------\nm

((((((((((((((((((((((((( Files Created from 2007-09-09 to 2007-10-09 )))))))))))))))))))))))))))))))
.

2007-10-08 22:04 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-05 16:33 <DIR> d-------- C:\WINDOWS\SYSTEM32\Kaspersky Lab
2007-10-05 16:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-10-05 15:57 <DIR> d-------- C:\WINDOWS\ERUNT
2007-10-05 15:25 3,676 --a------ C:\WINDOWS\SYSTEM32\tmp.reg
2007-10-05 10:48 <DIR> d-------- C:\Documents and Settings\Rob Marreel\Application Data\Prevx
2007-10-05 10:45 <DIR> d-------- C:\Program Files\Prevx2
2007-10-05 10:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Prevx
2007-10-05 10:21 <DIR> d-------- C:\Program Files\Trend Micro

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-09 00:54 --------- d-----w C:\Documents and Settings\Rob Marreel\Application Data\OpenOffice.org2
2007-10-05 16:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-04 17:19 --------- d-----w C:\Documents and Settings\Rob Marreel\Application Data\AdobeUM
2007-08-17 06:17 --------- d-----w C:\Program Files\LucasOldies
2007-08-12 04:26 --------- d-----w C:\Program Files\FileZilla
2007-04-07 19:47 29,184 ----a-w C:\Documents and Settings\Rob Marreel\us48info.exe
2007-02-12 03:47 722,176 ----a-w C:\Documents and Settings\Rob Marreel\gotomypc_428.exe
2007-01-18 04:09 3,167,744 ----a-w C:\Documents and Settings\Rob Marreel\gosetup.exe
2007-01-10 04:05 563,712 ----a-w C:\Documents and Settings\Rob Marreel\gotomypc_370.exe
2006-12-04 18:38 53,248 ----a-w C:\WINDOWS\INF\WG511v2\snetcfg .exe
2006-12-04 18:38 265,984 ----a-w C:\WINDOWS\INF\WG511v2\WG511v2XP.sys
2006-12-04 18:38 265,856 ----a-w C:\WINDOWS\INF\WG511v2\WG511v2.sys
2006-12-04 18:38 249,856 ----a-w C:\WINDOWS\INF\WG511v2\InsDrvlh.exe
2006-12-04 18:38 212,992 ----a-w C:\WINDOWS\INF\WG511v2\CopyWHQLDriver.exe
2006-12-04 18:38 21,376 ----a-w C:\WINDOWS\INF\WG511v2\wlndis51.sys
2006-11-12 05:17 774,144 ----a-w C:\Program Files\RngInterstitial.dll
2006-10-02 05:43 6,759 ----a-w C:\Documents and Settings\Rob Marreel\Application Data\unins000.dat
2005-09-10 02:55 7,155,864 ----a-w C:\Program Files\NGhost10.msi
2005-09-10 02:55 37,766,164 ----a-w C:\Program Files\Data1.cab
2005-09-10 02:55 35 ----a-w C:\Program Files\SCSSDist.ini
2005-07-22 03:17 30,816 ----a-w C:\Documents and Settings\Rob Marreel\g2mdlhlpx.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B1C35173-632F-4DD7-815D-5B497866957B}]
C:\PROGRA~1\SOFTOM~1\TOOLBA~1\INSTAL~1\{47D21~1\0\toolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 12:42]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-19 08:59]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-19 08:59]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 15:48]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-05 23:05]
"HostManager"="C:\Program Files\Common Files\AOL\1135184755\ee\AOLSoftware.exe" [2006-05-09 17:24]
"type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 01:51]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-04-11 03:12]
"IPHSend"="C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe" [2006-02-17 09:59]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [2004-08-17 16:29]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\McAgent.exe" [2004-08-17 16:26]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-12-13 15:30]
"Norton Ghost 10.0"="C:\Program Files\Norton Ghost\Agent\GhostTray.exe" [2005-09-09 19:09]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 18:34]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 10:36]
"GoToMyPC"="C:\Program Files\Citrix\GoToMyPC\g2svc.exe" [2007-01-12 18:45]
"PrevxOne"="C:\Program Files\Prevx2\PXConsole.exe" [2007-09-27 19:19]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24]
"Aim6"="C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" [2006-05-09 17:24]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2006-01-24 11:37]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

C:\Documents and Settings\Rob Marreel\Start Menu\Programs\Startup\
OpenOffice.org 2.1.lnk - C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe [2006-11-27 17:45:48]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Cloudmark Desktop for Outlook Express.lnk - C:\WINDOWS\Installer\{44BD5DAF-71F0-4963-AFDC-3039B003CA84}\SC_1.ico [2006-11-08 23:55:42]
NETGEAR WG511v2 Smart Wizard.lnk - C:\Program Files\NETGEAR\WG511v2\wlancfg5.exe [2006-08-03 20:36:56]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToMyPC]
C:\Program Files\Citrix\GoToMyPC\G2WinLogon.dll 2007-01-12 18:45 10800 C:\Program Files\Citrix\GoToMyPC\G2WinLogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, xlibgfl254.dll

R1 V2IMount;V2IMount;C:\WINDOWS\system32\drivers\V2IMount.sys
R2 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
R3 NaiFiltr;NaiFiltr;C:\WINDOWS\system32\DRIVERS\NaiFiltr.sys
S3 MEMSWEEP2;MEMSWEEP2;\??\C:\WINDOWS\system32\86E.tmp
S3 Tomcat5;Apache Tomcat;"C:\Program Files\Apache Software Foundation\Tomcat 5.5\bin\tomcat5.exe" //RS//Tomcat5

.
Contents of the 'Scheduled Tasks' folder
"2007-10-04 20:25:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-10-07 07:27:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(1).job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-08 05:30:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(10).job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-08 05:30:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(11).job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-07 10:00:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(12).job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-07 10:00:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(13).job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-07 10:00:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(14).job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-07 07:27:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(2).job"
"2007-10-07 07:27:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(3).job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-07 07:27:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(4).job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-07 07:27:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(5).job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-07 07:27:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(6).job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-07 07:27:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(7).job"
"2007-10-07 07:27:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(8).job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-07 07:27:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(9).job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-07 07:27:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC.job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-06 01:30:00 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (1) (ROBDESKTOP-Rob Marreel).job"
- c:\program files\mcafee.com\vso\mcmnhdlr.exe
"2007-10-06 01:30:00 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (ROBDESKTOP-Rob Marreel).job"
"2007-10-09 05:18:00 C:\WINDOWS\Tasks\McAfee.com Update Check (DF98B871-Owner).job"
- c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
"2007-10-09 05:20:17 C:\WINDOWS\Tasks\McAfee.com Update Check (ROBDESKTOP-Rob Marreel).job"
- C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-08 22:17:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-08 22:22:24 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-10-08 22:22
.
--- E O F ---

Shaba · Oct 9, 2007

Hi

First we'll need to backup registry:

Start -> Run -> regedit -> ok. Then File -> Export. Give it a name and press Save.

Save text below as fix.reg on Notepad (save it as all files (*.*)) on Desktop

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

It should look like this ->

Doubleclick fix.reg, press Yes and ok.

(In case you are unsure how to create a reg file, take a look here with screenshots.)

Re-run combofix

Post:

- a fresh HijackThis log
- combofix report

robmarreel · Oct 9, 2007

New logs

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:59:48 PM, on 10/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5700.0006)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Citrix\GoToMyPC\g2svc.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\Program Files\Citrix\GoToMyPC\g2comm.exe
C:\Program Files\Norton Ghost\Agent\VProSvc.exe
C:\Program Files\Citrix\GoToMyPC\g2pre.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Citrix\GoToMyPC\g2tray.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\AOL\1135184755\ee\AOLSoftware.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jucheck.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\PROGRA~1\mcafee.com\agent\McAgent.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton Ghost\Agent\GhostTray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Cloudmark\SpamNet\OE\snoe.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\NETGEAR\WG511v2\wlancfg5.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.BIN
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\vssvc.exe
C:\Program Files\Citrix\GoToMyPC\g2mainh.exe
C:\Program Files\Citrix\GoToMyPC\g2host.exe
C:\Program Files\Citrix\GoToMyPC\g2printh.exe
C:\Program Files\Citrix\GoToMyPC\g2audioh.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: XBTP03102 - {B1C35173-632F-4DD7-815D-5B497866957B} - C:\PROGRA~1\SOFTOM~1\TOOLBA~1\INSTAL~1\{47D21~1\0\toolbar.dll (file missing)
O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\PROGRA~1\SOFTOM~1\TOOLBA~1\bin\tbcore3U.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1135184755\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton Ghost\Agent\GhostTray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [GoToMyPC] C:\Program Files\Citrix\GoToMyPC\g2svc.exe -logon
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx2\PXConsole.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Cloudmark Desktop for Outlook Express.lnk = ?
O4 - Global Startup: NETGEAR WG511v2 Smart Wizard.lnk = C:\Program Files\NETGEAR\WG511v2\wlancfg5.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {2D72C39D-53F6-4AEA-A9DB-1298429DA974} (3DVista Viewer Control) - http://www.3dvista.com/downloads/viewer3dv.cab
O16 - DPF: {2DEF4530-8CE6-41C9-84B6-A54536C90213} (Crystal Report Viewer Control 9) - https://www.libertytax.net/crystalreportviewers/activeXViewer/activexviewer.cab
O16 - DPF: {40F8967E-34A6-474A-837A-CEC1E7DAC54C} - https://accounting.quickbooks.com/c1/v16.548/qboax9.cab
O16 - DPF: {41289E02-198A-4034-8CF9-5A8739A80D0D} (ReportPromptInfoDlg Class) - https://www.libertytax.net/crystalreportviewers/activeXViewer/reportparameterdialog.cab
O16 - DPF: {4B5C9C28-3806-47B5-89A9-93063323160F} (ReportExport Class) - https://www.libertytax.net/crystalreportviewers/activeXViewer/activexviewer.cab
O16 - DPF: {843EE768-3A97-455C-9076-741BA3AD7B62} (QuickBooks Online Edition Utilities Class v10) - https://accounting.quickbooks.com/c6/v16.607/qboax10.cab
O16 - DPF: {8CE3BAE6-AB66-40B6-9019-41E5282FF1E2} - https://accounting.quickbooks.com/c8/v14.174/qboax8.cab
O16 - DPF: {934CC260-C5AA-43C4-A657-7B70C5B3DAE1} (Crystal Report Web Report Source Control 9) - https://www.libertytax.net/crystalreportviewers/activeXViewer/activexviewer.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://aolsvc.aol.com/onlinegames/pandacraze/gpcontrol.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: GoToMyPC - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToMyPC\g2svc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: PREVXAgent - Prevx - C:\Program Files\Prevx2\PXAgent.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Apache Tomcat (Tomcat5) - Apache Software Foundation - C:\Program Files\Apache Software Foundation\Tomcat 5.5\bin\tomcat5.exe

--
End of file - 11986 bytes

robmarreel · Oct 9, 2007

Combofix log

ComboFix 07-10-09.3 - Rob Marreel 2007-10-09 13:45:03.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.116 [GMT -7:00]
Running from: C:\Documents and Settings\Rob Marreel\Local Settings\Temporary Internet Files\Content.IE5\NZIR24DF\ComboFix[1].exe
.

((((((((((((((((((((((((( Files Created from 2007-09-09 to 2007-10-09 )))))))))))))))))))))))))))))))
.

2007-10-09 13:35 88,448,056 --a------ C:\temp\RegBackup_10-09-07.reg
2007-10-09 11:47 <DIR> d-------- C:\WINDOWS\LastGood
2007-10-08 22:04 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-05 16:33 <DIR> d-------- C:\WINDOWS\SYSTEM32\Kaspersky Lab
2007-10-05 16:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-10-05 15:57 <DIR> d-------- C:\WINDOWS\ERUNT
2007-10-05 15:25 3,676 --a------ C:\WINDOWS\SYSTEM32\tmp.reg
2007-10-05 10:48 <DIR> d-------- C:\Documents and Settings\Rob Marreel\Application Data\Prevx
2007-10-05 10:45 <DIR> d-------- C:\Program Files\Prevx2
2007-10-05 10:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Prevx
2007-10-05 10:21 <DIR> d-------- C:\Program Files\Trend Micro

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-09 05:20 --------- d-----w C:\Documents and Settings\Rob Marreel\Application Data\OpenOffice.org2
2007-10-05 16:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-04 17:19 --------- d-----w C:\Documents and Settings\Rob Marreel\Application Data\AdobeUM
2007-08-17 06:17 --------- d-----w C:\Program Files\LucasOldies
2007-08-12 04:26 --------- d-----w C:\Program Files\FileZilla
2007-07-31 02:19 92,504 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\cdm.dll
2007-07-31 02:19 92,504 ----a-w C:\WINDOWS\SYSTEM32\cdm.dll
2007-07-31 02:19 549,720 ----a-w C:\WINDOWS\SYSTEM32\wuapi.dll
2007-07-31 02:19 549,720 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuapi.dll
2007-07-31 02:19 53,080 ----a-w C:\WINDOWS\SYSTEM32\wuauclt.exe
2007-07-31 02:19 53,080 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuauclt.exe
2007-07-31 02:19 43,352 ----a-w C:\WINDOWS\SYSTEM32\wups2.dll
2007-07-31 02:19 325,976 ----a-w C:\WINDOWS\SYSTEM32\wucltui.dll
2007-07-31 02:19 325,976 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wucltui.dll
2007-07-31 02:19 203,096 ----a-w C:\WINDOWS\SYSTEM32\wuweb.dll
2007-07-31 02:19 203,096 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuweb.dll
2007-07-31 02:19 1,712,984 ----a-w C:\WINDOWS\SYSTEM32\wuaueng.dll
2007-07-31 02:19 1,712,984 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuaueng.dll
2007-07-31 02:18 33,624 ----a-w C:\WINDOWS\SYSTEM32\wups.dll
2007-07-31 02:18 33,624 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wups.dll
2007-04-07 19:47 29,184 ----a-w C:\Documents and Settings\Rob Marreel\us48info.exe
2007-02-12 03:47 722,176 ----a-w C:\Documents and Settings\Rob Marreel\gotomypc_428.exe
2007-01-18 04:09 3,167,744 ----a-w C:\Documents and Settings\Rob Marreel\gosetup.exe
2007-01-10 04:05 563,712 ----a-w C:\Documents and Settings\Rob Marreel\gotomypc_370.exe
2006-12-04 18:38 53,248 ----a-w C:\WINDOWS\INF\WG511v2\snetcfg .exe
2006-12-04 18:38 265,984 ----a-w C:\WINDOWS\INF\WG511v2\WG511v2XP.sys
2006-12-04 18:38 265,856 ----a-w C:\WINDOWS\INF\WG511v2\WG511v2.sys
2006-12-04 18:38 249,856 ----a-w C:\WINDOWS\INF\WG511v2\InsDrvlh.exe
2006-12-04 18:38 212,992 ----a-w C:\WINDOWS\INF\WG511v2\CopyWHQLDriver.exe
2006-12-04 18:38 21,376 ----a-w C:\WINDOWS\INF\WG511v2\wlndis51.sys
2006-11-12 05:17 774,144 ----a-w C:\Program Files\RngInterstitial.dll
2006-10-02 05:43 6,759 ----a-w C:\Documents and Settings\Rob Marreel\Application Data\unins000.dat
2005-09-10 02:55 7,155,864 ----a-w C:\Program Files\NGhost10.msi
2005-09-10 02:55 37,766,164 ----a-w C:\Program Files\Data1.cab
2005-09-10 02:55 35 ----a-w C:\Program Files\SCSSDist.ini
2005-07-22 03:17 30,816 ----a-w C:\Documents and Settings\Rob Marreel\g2mdlhlpx.exe
.

((((((((((((((((((((((((((((( snapshot@2007-10-08_22.21.07.81 )))))))))))))))))))))))))))))))))))))))))
.
----a-w 14,048 2005-10-12 23:12:25 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\spmsg.dll
----a-w 213,216 2005-10-12 23:12:26 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\spuninst.exe
----a-w 584,192 2007-07-09 13:09:42 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\SP2GDR\rpcrt4.dll
----a-w 115,712 2007-06-13 06:53:14 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\SP2GDR\xpsp3res.dll
----a-w 582,656 2007-07-09 13:16:16 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\SP2QFE\rpcrt4.dll
----a-w 350,720 2007-06-19 07:24:36 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\SP2QFE\xpsp3res.dll
----a-w 22,752 2005-10-12 23:12:25 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\update\spcustom.dll
----a-w 716,000 2005-10-12 23:12:28 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\update\update.exe
----a-w 371,424 2005-10-12 23:12:33 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\update\updspapi.dll
----a-w 14,048 2007-03-06 01:22:36 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\spmsg.dll
----a-w 213,216 2007-03-06 01:22:41 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\spuninst.exe
----a-w 683,520 2007-08-21 06:15:44 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\sp2gdr\inetcomm.dll
----a-w 683,520 2007-08-21 06:25:02 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\sp2qfe\inetcomm.dll
----a-w 22,752 2007-03-06 01:22:34 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\update\spcustom.dll
----a-w 716,000 2007-03-06 01:22:59 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\update\update.exe
----a-w 371,424 2007-03-06 01:23:51 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\update\updspapi.dll
----atw 16,384 2007-10-09 05:21:37 C:\WINDOWS\Temp\Perflib_Perfdata_84.dat
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B1C35173-632F-4DD7-815D-5B497866957B}]
C:\PROGRA~1\SOFTOM~1\TOOLBA~1\INSTAL~1\{47D21~1\0\toolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 12:42]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-19 08:59]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-19 08:59]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 15:48]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-05 23:05]
"HostManager"="C:\Program Files\Common Files\AOL\1135184755\ee\AOLSoftware.exe" [2006-05-09 17:24]
"type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 01:51]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-04-11 03:12]
"IPHSend"="C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe" [2006-02-17 09:59]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [2004-08-17 16:29]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\McAgent.exe" [2004-08-17 16:26]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-12-13 15:30]
"Norton Ghost 10.0"="C:\Program Files\Norton Ghost\Agent\GhostTray.exe" [2005-09-09 19:09]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 18:34]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 10:36]
"GoToMyPC"="C:\Program Files\Citrix\GoToMyPC\g2svc.exe" [2007-01-12 18:45]
"PrevxOne"="C:\Program Files\Prevx2\PXConsole.exe" [2007-09-27 19:19]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24]
"Aim6"="C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" [2006-05-09 17:24]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2006-01-24 11:37]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

C:\Documents and Settings\Rob Marreel\Start Menu\Programs\Startup\
OpenOffice.org 2.1.lnk - C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe [2006-11-27 17:45:48]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Cloudmark Desktop for Outlook Express.lnk - C:\WINDOWS\Installer\{44BD5DAF-71F0-4963-AFDC-3039B003CA84}\SC_1.ico [2006-11-08 23:55:42]
NETGEAR WG511v2 Smart Wizard.lnk - C:\Program Files\NETGEAR\WG511v2\wlancfg5.exe [2006-08-03 20:36:56]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToMyPC]
C:\Program Files\Citrix\GoToMyPC\G2WinLogon.dll 2007-01-12 18:45 10800 C:\Program Files\Citrix\GoToMyPC\G2WinLogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL

R1 V2IMount;V2IMount;C:\WINDOWS\system32\drivers\V2IMount.sys
R2 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
R3 NaiFiltr;NaiFiltr;C:\WINDOWS\system32\DRIVERS\NaiFiltr.sys
S3 MEMSWEEP2;MEMSWEEP2;\??\C:\WINDOWS\system32\86E.tmp
S3 Tomcat5;Apache Tomcat;"C:\Program Files\Apache Software Foundation\Tomcat 5.5\bin\tomcat5.exe" //RS//Tomcat5

.
Contents of the 'Scheduled Tasks' folder
"2007-10-04 20:25:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-10-09 20:55:00 C:\WINDOWS\Tasks\Cloudmark Desktop Config Guard.job"
- C:\Program Files\Cloudmark\SpamNet\OE\snoe.exe
"2007-10-09 07:27:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(1).job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-09 05:30:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(10).job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-09 05:30:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(11).job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-09 10:00:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(12).job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-09 10:00:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(13).job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-09 10:00:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(14).job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-09 07:27:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(2).job"
"2007-10-09 07:27:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(3).job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-09 07:27:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(4).job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-09 07:27:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(5).job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-09 07:27:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(6).job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-09 07:27:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(7).job"
"2007-10-09 07:27:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(8).job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-09 07:27:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC(9).job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-09 07:27:00 C:\WINDOWS\Tasks\GBMPro7 Task - Rob's PC.job"
- C:\Program Files\Genie-Soft\GBM7Home\GBM7.exe
"2007-10-06 01:30:00 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (1) (ROBDESKTOP-Rob Marreel).job"
- c:\program files\mcafee.com\vso\mcmnhdlr.exe
"2007-10-06 01:30:00 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (ROBDESKTOP-Rob Marreel).job"
"2007-10-09 20:53:00 C:\WINDOWS\Tasks\McAfee.com Update Check (DF98B871-Owner).job"
- c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
"2007-10-09 20:55:00 C:\WINDOWS\Tasks\McAfee.com Update Check (ROBDESKTOP-Rob Marreel).job"
- C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-09 13:53:56
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
Completion time: 2007-10-09 13:56:56
C:\ComboFix-quarantined-files.txt ... 2007-10-09 13:56
C:\ComboFix2.txt ... 2007-10-08 22:22
.
--- E O F ---

Shaba · Oct 10, 2007

Hi

Please do an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings
In the scan settings make sure that the following are selected:

o Scan using the following Anti-Virus database:

+ Extended (If available otherwise Standard)

o Scan Options:

+ Scan Archives
+ Scan Mail Bases
Click OK
Now under select a target to scan select My Computer
The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button
Save the file to your desktop.
Copy and paste that information in your next post.

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the license, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

Post:

- a fresh HijackThis log
- kaspersky report

Shaba · Oct 17, 2007

Due to the lack of feedback this Topic is closed.

If you need this topic reopened, please request this by sending the moderating team
a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.

Shaba · Oct 23, 2007

Re-opened upon request.

robmarreel · Oct 25, 2007

New Hijack and Kapersky

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Wednesday, October 24, 2007 8:02:51 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 24/10/2007
Kaspersky Anti-Virus database records: 443581
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 175156
Number of viruses found: 10
Number of infected objects: 147
Number of suspicious objects: 0
Duration of the scan process: 05:24:45

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PestTrap.zip/PestTrap.exe Infected: not-a-virus:FraudTool.Win32.SpySheriff.j skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PestTrap.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PestTrap3.zip/heur000.dll Infected: not-a-virus:FraudTool.Win32.BraveSentry.b skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PestTrap3.zip/heur002.dll Infected: not-a-virus:FraudTool.Win32.BraveSentry.b skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PestTrap3.zip/heur003.dll Infected: not-a-virus:FraudTool.Win32.BraveSentry.b skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PestTrap3.zip ZIP: infected - 3 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC.zip/winstall.exe Infected: Trojan-Downloader.Win32.Small.cpg skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temp\Perflib_Perfdata_d8.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Rob Marreel\Cookies\INDEX.DAT Object is locked skipped
C:\Documents and Settings\Rob Marreel\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Rob Marreel\Desktop\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Rob Marreel\Desktop\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Rob Marreel\Desktop\SmitfraudFix.exe RarSFX: infected - 2 skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\AOL\UserProfiles\All Users\cls\common.cls Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Cloudmark\SpamNet\oemsgsvid.dat Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\dbc2e.ht1 Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\dbdam Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\dbdao Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\dbeam Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\dbeao Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\dbm Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\dbu2d.ht1 Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\dbvm.cf1 Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\dbvmh.ht1 Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\fii.cf1 Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\fiih.ht1 Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\hp Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\hpt2i.ht1 Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\rpm.cf1 Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\rpm1m.cf1 Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\rpm1mh.ht1 Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\rpmh.ht1 Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Identities\{DFF16927-88E6-4EAA-A097-460B7E65289B}\Microsoft\Outlook Express\Folders.dbx Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Identities\{DFF16927-88E6-4EAA-A097-460B7E65289B}\Microsoft\Outlook Express\Inbox.dbx Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Identities\{DFF16927-88E6-4EAA-A097-460B7E65289B}\Microsoft\Outlook Express\Offline.dbx Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Identities\{DFF16927-88E6-4EAA-A097-460B7E65289B}\Microsoft\Outlook Express\Outbox.dbx Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Identities\{DFF16927-88E6-4EAA-A097-460B7E65289B}\Microsoft\Outlook Express\Pop3uidl.dbx Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\History\History.IE5\MSHist012007102320071024\index.dat Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Temp\Perflib_Perfdata_f6c.dat Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Temp\sqlite_szXw03fTygnmDYS Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Temp\~DF20A7.tmp Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Temp\~DFEAC8.tmp Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\Rob Marreel\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Rob Marreel\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Rob Marreel\us48info.exe Infected: Trojan-Downloader.Win32.Small.cpg skipped
C:\Downloads\kwilkinson/[From Doctor <phdm@girlsinc-md.org>][Date Tue, 13 Dec 2005 14:35:34 -0600]/UNNAMED/[From Happy Holidays from Salesforce.com][Date Thu, 15 Dec 2005 17:00:00 -0800]/html/[From bcc_tiffanypuckett@yahoo.com][Date Fri, 16 Dec 2005 19:28:48 -0500]/UNNAMED/UNNAMED/document.txt .exe Infected: Email-Worm.Win32.NetSky.q skipped

robmarreel · Oct 25, 2007

Continuation of log

C:\Downloads\kwilkinson/[From Doctor <phdm@girlsinc-md.org>][Date Tue, 13 Dec 2005 14:35:34 -0600]/UNNAMED/[From Happy Holidays from Salesforce.com][Date Thu, 15 Dec 2005 17:00:00 -0800]/html/[From bcc_tiffanypuckett@yahoo.com][Date Fri, 16 Dec 2005 19:28:48 -0500]/UNNAMED/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped
C:\Downloads\kwilkinson/[From Doctor <phdm@girlsinc-md.org>][Date Tue, 13 Dec 2005 14:35:34 -0600]/UNNAMED/[From Happy Holidays from Salesforce.com][Date Thu, 15 Dec 2005 17:00:00 -0800]/html/[From bcc_tiffanypuckett@yahoo.com][Date Fri, 16 Dec 2005 19:28:48 -0500]/UNNAMED/[From "Nora Kaufman" <tarasov_sabina@mail.ru>][Date Fri, 16 Dec 2005 23:37:56 -0800]/text/[From 3x1bb024591@timeshare1.inetu.net][Date Sat, 17 Dec 2005 04:08:13 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped
C:\Downloads\kwilkinson/[From Doctor <phdm@girlsinc-md.org>][Date Tue, 13 Dec 2005 14:35:34 -0600]/UNNAMED/[From Happy Holidays from Salesforce.com][Date Thu, 15 Dec 2005 17:00:00 -0800]/html/[From bcc_tiffanypuckett@yahoo.com][Date Fri, 16 Dec 2005 19:28:48 -0500]/UNNAMED/[From "Nora Kaufman" <tarasov_sabina@mail.ru>][Date Fri, 16 Dec 2005 23:37:56 -0800]/text Infected: Email-Worm.Win32.NetSky.q skipped
C:\Downloads\kwilkinson/[From Doctor <phdm@girlsinc-md.org>][Date Tue, 13 Dec 2005 14:35:34 -0600]/UNNAMED/[From Happy Holidays from Salesforce.com][Date Thu, 15 Dec 2005 17:00:00 -0800]/html/[From bcc_tiffanypuckett@yahoo.com][Date Fri, 16 Dec 2005 19:28:48 -0500]/UNNAMED/[From "Nora Kaufman" <tarasov_sabina@mail.ru>][Date Fri, 16 Dec 2005 23:37:56 -0800]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped
C:\Downloads\kwilkinson/[From Doctor <phdm@girlsinc-md.org>][Date Tue, 13 Dec 2005 14:35:34 -0600]/UNNAMED/[From Happy Holidays from Salesforce.com][Date Thu, 15 Dec 2005 17:00:00 -0800]/html/[From bcc_tiffanypuckett@yahoo.com][Date Fri, 16 Dec 2005 19:28:48 -0500]/UNNAMED/[From jlgbwzumcrqfyq@yahoo.com][Date Mon, 19 Dec 2005 02:37:17 -0500]/UNNAMED/document.txt .exe Infected: Email-Worm.Win32.NetSky.q skipped
C:\Downloads\kwilkinson/[From Doctor <phdm@girlsinc-md.org>][Date Tue, 13 Dec 2005 14:35:34 -0600]/UNNAMED/[From Happy Holidays from Salesforce.com][Date Thu, 15 Dec 2005 17:00:00 -0800]/html/[From bcc_tiffanypuckett@yahoo.com][Date Fri, 16 Dec 2005 19:28:48 -0500]/UNNAMED/[From jlgbwzumcrqfyq@yahoo.com][Date Mon, 19 Dec 2005 02:37:17 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped
C:\Downloads\kwilkinson/[From Doctor <phdm@girlsinc-md.org>][Date Tue, 13 Dec 2005 14:35:34 -0600]/UNNAMED/[From Happy Holidays from Salesforce.com][Date Thu, 15 Dec 2005 17:00:00 -0800]/html/[From bcc_tiffanypuckett@yahoo.com][Date Fri, 16 Dec 2005 19:28:48 -0500]/UNNAMED/[From borgco@aol.com][Date Mon, 19 Dec 2005 02:40:13 -0500]/UNNAMED/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped
C:\Downloads\kwilkinson/[From Doctor <phdm@girlsinc-md.org>][Date Tue, 13 Dec 2005 14:35:34 -0600]/UNNAMED/[From Happy Holidays from Salesforce.com][Date Thu, 15 Dec 2005 17:00:00 -0800]/html/[From bcc_tiffanypuckett@yahoo.com][Date Fri, 16 Dec 2005 19:28:48 -0500]/UNNAMED/[From borgco@aol.com][Date Mon, 19 Dec 2005 02:40:13 -0500]/UNNAMED/[From jose@drums.org][Date Mon, 19 Dec 2005 02:41:30 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped
C:\Downloads\kwilkinson/[From Doctor <phdm@girlsinc-md.org>][Date Tue, 13 Dec 2005 14:35:34 -0600]/UNNAMED/[From Happy Holidays from Salesforce.com][Date Thu, 15 Dec 2005 17:00:00 -0800]/html/[From bcc_tiffanypuckett@yahoo.com][Date Fri, 16 Dec 2005 19:28:48 -0500]/UNNAMED/[From borgco@aol.com][Date Mon, 19 Dec 2005 02:40:13 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped
C:\Downloads\kwilkinson/[From Doctor <phdm@girlsinc-md.org>][Date Tue, 13 Dec 2005 14:35:34 -0600]/UNNAMED/[From Happy Holidays from Salesforce.com][Date Thu, 15 Dec 2005 17:00:00 -0800]/html/[From bcc_tiffanypuckett@yahoo.com][Date Fri, 16 Dec 2005 19:28:48 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped
C:\Downloads\kwilkinson/[From Doctor <phdm@girlsinc-md.org>][Date Tue, 13 Dec 2005 14:35:34 -0600]/UNNAMED/[From Happy Holidays from Salesforce.com][Date Thu, 15 Dec 2005 17:00:00 -0800]/html/[From Doctor <helgaas@glastroesch.com>][Date Tue, 20 Dec 2005 11:22:27 -0800]/UNNAMED/[From n7113bmw4518bmw4518hailan410@korea.com][Date Wed, 21 Dec 2005 14:58:18 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped
C:\Downloads\kwilkinson/[From Doctor <phdm@girlsinc-md.org>][Date Tue, 13 Dec 2005 14:35:34 -0600]/UNNAMED/[From Happy Holidays from Salesforce.com][Date Thu, 15 Dec 2005 17:00:00 -0800]/html/[From Doctor <helgaas@glastroesch.com>][Date Tue, 20 Dec 2005 11:22:27 -0800]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped
C:\Downloads\kwilkinson/[From Doctor <phdm@girlsinc-md.org>][Date Tue, 13 Dec 2005 14:35:34 -0600]/UNNAMED/[From Happy Holidays from Salesforce.com][Date Thu, 15 Dec 2005 17:00:00 -0800]/html Infected: Email-Worm.Win32.NetSky.q skipped
C:\Downloads\kwilkinson/[From Doctor <phdm@girlsinc-md.org>][Date Tue, 13 Dec 2005 14:35:34 -0600]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped
C:\Downloads\kwilkinson Mail Berkeley mbox: infected - 15 skipped
C:\Downloads\var\www\marreel.com\htdocs\tmp\AdminCodeSnapShot_040507.zip/webmail/temporary_files/heidil_thecharitygroup.com/inbox/3244d1fc710cd529c1925abe7510cd8e.eml/[From "eBay Member: sabomania" <member@ebay.com>][Date Tue, 17 May 2005 13:31:39 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\var\www\marreel.com\htdocs\tmp\AdminCodeSnapShot_040507.zip/webmail/temporary_files/heidil_thecharitygroup.com/inbox/3244d1fc710cd529c1925abe7510cd8e.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\var\www\marreel.com\htdocs\tmp\AdminCodeSnapShot_040507.zip/webmail/temporary_files/heidil_thecharitygroup.com/inbox/53912b7ec31292a45d52516f669e8f6f.eml/[From "eBay Member: earls71" <member@ebay.com>][Date Tue, 17 May 2005 21:02:23 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\var\www\marreel.com\htdocs\tmp\AdminCodeSnapShot_040507.zip/webmail/temporary_files/heidil_thecharitygroup.com/inbox/53912b7ec31292a45d52516f669e8f6f.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\var\www\marreel.com\htdocs\tmp\AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/53912b7ec31292a45d52516f669e8f6f.eml/[From "eBay Member: earls71" <member@ebay.com>][Date Tue, 17 May 2005 21:02:23 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\var\www\marreel.com\htdocs\tmp\AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/53912b7ec31292a45d52516f669e8f6f.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\var\www\marreel.com\htdocs\tmp\AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/8acc3db1d7097ac80d88bad101056197.eml/[From "eBay Member: evm1024" <member@ebay.com>][Date Wed, 18 May 2005 09:06:42 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\var\www\marreel.com\htdocs\tmp\AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/8acc3db1d7097ac80d88bad101056197.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\var\www\marreel.com\htdocs\tmp\AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/c32ce5e49248429aab46767d5a3e633e.eml/[From "eBay Member: adlpc" <member@ebay.com>][Date Wed, 18 May 2005 09:32:07 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\var\www\marreel.com\htdocs\tmp\AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/c32ce5e49248429aab46767d5a3e633e.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\var\www\marreel.com\htdocs\tmp\AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/27eb56e72b95e96641b0b555e8fd4c6b.eml/[From "eBay Member: dlonno" <member@ebay.com>][Date Fri, 10 Jun 2005 18:43:37 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\var\www\marreel.com\htdocs\tmp\AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/27eb56e72b95e96641b0b555e8fd4c6b.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\var\www\marreel.com\htdocs\tmp\AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/3caddd3d4ac39e126dc82198cc8ae48f.eml/[From "eBay Member: rvickers48" <member@ebay.com>][Date Sun, 12 Jun 2005 19:30:52 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\var\www\marreel.com\htdocs\tmp\AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/3caddd3d4ac39e126dc82198cc8ae48f.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\var\www\marreel.com\htdocs\tmp\AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/trash/82a3731ead9a615e762f47d376a60638.eml/[From "eBay Member: mannyvel" <member@ebay.com>][Date Mon, 16 May 2005 18:31:19 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\var\www\marreel.com\htdocs\tmp\AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/trash/82a3731ead9a615e762f47d376a60638.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\var\www\marreel.com\htdocs\tmp\AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/trash/3244d1fc710cd529c1925abe7510cd8e.eml/[From "eBay Member: sabomania" <member@ebay.com>][Date Tue, 17 May 2005 13:31:39 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\var\www\marreel.com\htdocs\tmp\AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/trash/3244d1fc710cd529c1925abe7510cd8e.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\var\www\marreel.com\htdocs\tmp\AdminCodeSnapShot_040507.zip ZIP: infected - 18 skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/heidil_thecharitygroup.com/inbox/3244d1fc710cd529c1925abe7510cd8e.eml/[From "eBay Member: sabomania" <member@ebay.com>][Date Tue, 17 May 2005 13:31:39 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/heidil_thecharitygroup.com/inbox/3244d1fc710cd529c1925abe7510cd8e.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/heidil_thecharitygroup.com/inbox/53912b7ec31292a45d52516f669e8f6f.eml/[From "eBay Member: earls71" <member@ebay.com>][Date Tue, 17 May 2005 21:02:23 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/heidil_thecharitygroup.com/inbox/53912b7ec31292a45d52516f669e8f6f.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/53912b7ec31292a45d52516f669e8f6f.eml/[From "eBay Member: earls71" <member@ebay.com>][Date Tue, 17 May 2005 21:02:23 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/53912b7ec31292a45d52516f669e8f6f.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/8acc3db1d7097ac80d88bad101056197.eml/[From "eBay Member: evm1024" <member@ebay.com>][Date Wed, 18 May 2005 09:06:42 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/8acc3db1d7097ac80d88bad101056197.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/c32ce5e49248429aab46767d5a3e633e.eml/[From "eBay Member: adlpc" <member@ebay.com>][Date Wed, 18 May 2005 09:32:07 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/c32ce5e49248429aab46767d5a3e633e.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/27eb56e72b95e96641b0b555e8fd4c6b.eml/[From "eBay Member: dlonno" <member@ebay.com>][Date Fri, 10 Jun 2005 18:43:37 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/27eb56e72b95e96641b0b555e8fd4c6b.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/3caddd3d4ac39e126dc82198cc8ae48f.eml/[From "eBay Member: rvickers48" <member@ebay.com>][Date Sun, 12 Jun 2005 19:30:52 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/3caddd3d4ac39e126dc82198cc8ae48f.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/trash/82a3731ead9a615e762f47d376a60638.eml/[From "eBay Member: mannyvel" <member@ebay.com>][Date Mon, 16 May 2005 18:31:19 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/trash/82a3731ead9a615e762f47d376a60638.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/trash/3244d1fc710cd529c1925abe7510cd8e.eml/[From "eBay Member: sabomania" <member@ebay.com>][Date Tue, 17 May 2005 13:31:39 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/trash/3244d1fc710cd529c1925abe7510cd8e.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/ocap.tv/htdocs/pp/paypal/error.php Infected: Trojan-Spy.HTML.Fraud.h skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/ocap.tv/htdocs/pp/paypal/final.php Infected: Trojan-Spy.HTML.Fraud.h skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/ocap.tv/htdocs/pp/paypal/index.php Infected: Trojan-Spy.HTML.Fraud.h skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/ocap.tv/htdocs/pp/paypal/login.html Infected: Trojan-Spy.HTML.Fraud.h skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/ocap.tv/htdocs/pp/paypal/login.php Infected: Trojan-Spy.HTML.Fraud.h skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/ocap.tv/htdocs/pp/paypal/next.php Infected: Trojan-Spy.HTML.Fraud.h skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/ocap.tv/htdocs/pp/paypal/processing.htm Infected: Trojan-Spy.HTML.Fraud.h skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/ocap.tv/htdocs/pp/paypal/protect.htm Infected: Trojan-Spy.HTML.Fraud.h skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/ocap.tv/htdocs/pp/paypal/protect.php Infected: Trojan-Spy.HTML.Fraud.h skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/ocap.tv/htdocs/pp/paypal/update.php Infected: Trojan-Spy.HTML.Fraud.h skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/ocap.tv/htdocs/pp/paypal/_login-submit.htm Infected: Trojan-Spy.HTML.Fraud.h skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/heidil_thecharitygroup.com/inbox/3244d1fc710cd529c1925ab/[From "eBay Member: sabomania" <member@ebay.com

robmarreel · Oct 25, 2007

Continuation

>][Date Tue, 17 May 2005 13:31:39 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/heidil_thecharitygroup.com/inbox/3244d1fc710cd529c1925ab Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/heidil_thecharitygroup.com/inbox/53912b7ec31292a45d52516/[From "eBay Member: earls71" <member@ebay.com>][Date Tue, 17 May 2005 21:02:23 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/heidil_thecharitygroup.com/inbox/53912b7ec31292a45d52516 Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/53912b7ec31292a45d52516f/[From "eBay Member: earls71" <member@ebay.com>][Date Tue, 17 May 2005 21:02:23 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/53912b7ec31292a45d52516f Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/8acc3db1d7097ac80d88bad1/[From "eBay Member: evm1024" <member@ebay.com>][Date Wed, 18 May 2005 09:06:42 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/8acc3db1d7097ac80d88bad1 Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/c32ce5e49248429aab46767d/[From "eBay Member: adlpc" <member@ebay.com>][Date Wed, 18 May 2005 09:32:07 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/c32ce5e49248429aab46767d Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/27eb56e72b95e96641b0b555/[From "eBay Member: dlonno" <member@ebay.com>][Date Fri, 10 Jun 2005 18:43:37 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/27eb56e72b95e96641b0b555 Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/3caddd3d4ac39e126dc82198/[From "eBay Member: rvickers48" <member@ebay.com>][Date Sun, 12 Jun 2005 19:30:52 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/3caddd3d4ac39e126dc82198 Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/trash/82a3731ead9a615e762f47d3/[From "eBay Member: mannyvel" <member@ebay.com>][Date Mon, 16 May 2005 18:31:19 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/trash/82a3731ead9a615e762f47d3 Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/trash/3244d1fc710cd529c1925abe/[From "eBay Member: sabomania" <member@ebay.com>][Date Tue, 17 May 2005 13:31:39 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/trash/3244d1fc710cd529c1925abe Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz GZIP: infected - 49 skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/heidil_thecharitygroup.com/inbox/3244d1fc710cd529c1925abe7510cd8e.eml/[From "eBay Member: sabomania" <member@ebay.com>][Date Tue, 17 May 2005 13:31:39 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/heidil_thecharitygroup.com/inbox/3244d1fc710cd529c1925abe7510cd8e.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/heidil_thecharitygroup.com/inbox/53912b7ec31292a45d52516f669e8f6f.eml/[From "eBay Member: earls71" <member@ebay.com>][Date Tue, 17 May 2005 21:02:23 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/heidil_thecharitygroup.com/inbox/53912b7ec31292a45d52516f669e8f6f.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/53912b7ec31292a45d52516f669e8f6f.eml/[From "eBay Member: earls71" <member@ebay.com>][Date Tue, 17 May 2005 21:02:23 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/53912b7ec31292a45d52516f669e8f6f.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/8acc3db1d7097ac80d88bad101056197.eml/[From "eBay Member: evm1024" <member@ebay.com>][Date Wed, 18 May 2005 09:06:42 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/8acc3db1d7097ac80d88bad101056197.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/c32ce5e49248429aab46767d5a3e633e.eml/[From "eBay Member: adlpc" <member@ebay.com>][Date Wed, 18 May 2005 09:32:07 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/c32ce5e49248429aab46767d5a3e633e.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/27eb56e72b95e96641b0b555e8fd4c6b.eml/[From "eBay Member: dlonno" <member@ebay.com>][Date Fri, 10 Jun 2005 18:43:37 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/27eb56e72b95e96641b0b555e8fd4c6b.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/3caddd3d4ac39e126dc82198cc8ae48f.eml/[From "eBay Member: rvickers48" <member@ebay.com>][Date Sun, 12 Jun 2005 19:30:52 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/3caddd3d4ac39e126dc82198cc8ae48f.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/trash/82a3731ead9a615e762f47d376a60638.eml/[From "eBay Member: mannyvel" <member@ebay.com>][Date Mon, 16 May 2005 18:31:19 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/trash/82a3731ead9a615e762f47d376a60638.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/trash/3244d1fc710cd529c1925abe7510cd8e.eml/[From "eBay Member: sabomania" <member@ebay.com>][Date Tue, 17 May 2005 13:31:39 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/trash/3244d1fc710cd529c1925abe7510cd8e.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/heidil_thecharitygroup.com/inbox/3244d1fc710cd529c1925ab/[From "eBay Member: sabomania" <member@ebay.com>][Date Tue, 17 May 2005 13:31:39 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/heidil_thecharitygroup.com/inbox/3244d1fc710cd529c1925ab Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/heidil_thecharitygroup.com/inbox/53912b7ec31292a45d52516/[From "eBay Member: earls71" <member@ebay.com>][Date Tue, 17 May 2005 21:02:23 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/heidil_thecharitygroup.com/inbox/53912b7ec31292a45d52516 Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/53912b7ec31292a45d52516f/[From "eBay Member: earls71" <member@ebay.com>][Date Tue, 17 May 2005 21:02:23 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/53912b7ec31292a45d52516f Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/8acc3db1d7097ac80d88bad1/[From "eBay Member: evm1024" <member@ebay.com>][Date Wed, 18 May 2005 09:06:42 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/8acc3db1d7097ac80d88bad1 Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/c32ce5e49248429aab46767d/[From "eBay Member: adlpc" <member@ebay.com>][Date Wed, 18 May 2005 09:32:07 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/c32ce5e49248429aab46767d Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/27eb56e72b95e96641b0b555/[From "eBay Member: dlonno" <member@ebay.com>][Date Fri, 10 Jun 2005 18:43:37 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/27eb56e72b95e96641b0b555 Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/3caddd3d4ac39e126dc82198/[From "eBay Member: rvickers48" <member@ebay.com>][Date Sun, 12 Jun 2005 19:30:52 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/3caddd3d4ac39e126dc82198 Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/trash/82a3731ead9a615e762f47d3/[From "eBay Member: mannyvel" <member@ebay.com>][Date Mon, 16 May 2005 18:31:19 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/trash/82a3731ead9a615e762f47d3 Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/trash/3244d1fc710cd529c1925abe/[From "eBay Member: sabomania" <member@ebay.com>][Date Tue, 17 May 2005 13:31:39 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/trash/3244d1fc710cd529c1925abe Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz GZIP: infected - 38 skipped
C:\Program Files\Citrix\GoToMyPC\g2host.log Object is locked skipped
C:\Program Files\Citrix\GoToMyPC\g2svc.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\mastlog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\model.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\modellog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\msdbdata.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\msdblog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\tempdb.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\templog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\LOG\ERRORLOG Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\LOG\log_16.trc Object is locked skipped
C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll Infected: not-a-virus:AdWare.Win32.MyWay.v skipped
C:\Program Files\Softomate\ToolbarStudio\installed\{47D2116B-201B-4031-8317-5EA027FBC188}\1\tbhelper.dll Infected: not-a-virus:AdWare.Win32.Mostofate.v skipped
C:\Program Files\Softomate\ToolbarStudio\installed\{47D2116B-201B-4031-8317-5EA027FBC188}\1\toolbar.dll Infected: not-a-virus:AdWare.Win32.Mostofate.v skipped
C:\Program Files\Softomate\ToolbarStudio\projects\EmailScan.cab/EmailScan.dll Infected: not-a-virus:AdWare.Win32.Mostofate.v skipped
C:\Program Files\Softomate\ToolbarStudio\projects\EmailScan.cab/tbhelper.dll Infected: not-a-virus:AdWare.Win32.Mostofate.v skipped
C:\Program Files\Softomate\ToolbarStudio\projects\EmailScan.cab CAB: infected - 2 skipped
C:\Program Files\Softomate\ToolbarStudio\projects\toolbar.cab/tbhelper.dll Infected: not-a-virus:AdWare.Win32.Mostofate.v skipped
C:\Program Files\Softomate\ToolbarStudio\projects\toolbar.cab/toolbar.dll Infected: not-a-virus:AdWare.Win32.Mostofate.v skipped
C:\Program Files\Softomate\ToolbarStudio\projects\toolbar.cab CAB: infected - 2 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP806\A0025083.dll Infected: Trojan-Downloader.Win32.Agent.bfj skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP833\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{F89E32EE-533F-4529-966F-FFAF2232EC9F}.crmlog Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{3A3AD287-E852-43A0-97F3-DBA71817DF1A}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\gotomon.log Object is locked skipped
C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped
C:\WINDOWS\SYSTEM32\MsDtc\MSDTC.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\MsDtc\Trace\DTCTRACE.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_140.dat Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_c0.dat Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

robmarreel · Oct 25, 2007

New Hijack Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:20:47 PM, on 10/24/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5700.0006)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Citrix\GoToMyPC\g2svc.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\Program Files\Citrix\GoToMyPC\g2comm.exe
C:\Program Files\Norton Ghost\Agent\VProSvc.exe
C:\Program Files\Citrix\GoToMyPC\g2pre.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Citrix\GoToMyPC\g2tray.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\Explorer.EXE
c:\program files\mcafee.com\agent\mcagent.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\AOL\1135184755\ee\AOLSoftware.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jucheck.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton Ghost\Agent\GhostTray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Cloudmark\SpamNet\OE\snoe.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\NETGEAR\WG511v2\wlancfg5.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.BIN
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Outlook Express\msimn.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\WISPTIS.EXE
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\PHP DESIGNER 2006\phpDesignerPrg2006.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: XBTP03102 - {B1C35173-632F-4DD7-815D-5B497866957B} - C:\PROGRA~1\SOFTOM~1\TOOLBA~1\INSTAL~1\{47D21~1\0\toolbar.dll (file missing)
O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\PROGRA~1\SOFTOM~1\TOOLBA~1\bin\tbcore3U.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1135184755\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton Ghost\Agent\GhostTray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [GoToMyPC] C:\Program Files\Citrix\GoToMyPC\g2svc.exe -logon
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx2\PXConsole.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Cloudmark Desktop for Outlook Express.lnk = ?
O4 - Global Startup: NETGEAR WG511v2 Smart Wizard.lnk = C:\Program Files\NETGEAR\WG511v2\wlancfg5.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {2D72C39D-53F6-4AEA-A9DB-1298429DA974} (3DVista Viewer Control) - http://www.3dvista.com/downloads/viewer3dv.cab
O16 - DPF: {2DEF4530-8CE6-41C9-84B6-A54536C90213} (Crystal Report Viewer Control 9) - https://www.libertytax.net/crystalreportviewers/activeXViewer/activexviewer.cab
O16 - DPF: {40F8967E-34A6-474A-837A-CEC1E7DAC54C} - https://accounting.quickbooks.com/c1/v16.548/qboax9.cab
O16 - DPF: {41289E02-198A-4034-8CF9-5A8739A80D0D} (ReportPromptInfoDlg Class) - https://www.libertytax.net/crystalreportviewers/activeXViewer/reportparameterdialog.cab
O16 - DPF: {4B5C9C28-3806-47B5-89A9-93063323160F} (ReportExport Class) - https://www.libertytax.net/crystalreportviewers/activeXViewer/activexviewer.cab
O16 - DPF: {843EE768-3A97-455C-9076-741BA3AD7B62} (QuickBooks Online Edition Utilities Class v10) - https://accounting.quickbooks.com/c6/v16.607/qboax10.cab
O16 - DPF: {8CE3BAE6-AB66-40B6-9019-41E5282FF1E2} - https://accounting.quickbooks.com/c8/v14.174/qboax8.cab
O16 - DPF: {934CC260-C5AA-43C4-A657-7B70C5B3DAE1} (Crystal Report Web Report Source Control 9) - https://www.libertytax.net/crystalreportviewers/activeXViewer/activexviewer.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://aolsvc.aol.com/onlinegames/pandacraze/gpcontrol.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: GoToMyPC - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToMyPC\g2svc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: PREVXAgent - Prevx - C:\Program Files\Prevx2\PXAgent.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Apache Tomcat (Tomcat5) - Apache Software Foundation - C:\Program Files\Apache Software Foundation\Tomcat 5.5\bin\tomcat5.exe

--
End of file - 12075 bytes

Shaba · Oct 25, 2007

Hi

I recommend to uninstall MyWay Search assistant via add/remove programs.

Empty this folder:

C:\Downloads\kwilkinson

Delete these:

C:\Program Files\MyWaySA\ <--- optional
C:\Program Files\Softomate
C:\Documents and Settings\Rob Marreel\us48info.exe

Empty Recycle Bin

Open HijackThis, click do a system scan only and checkmark these:

R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll <-- optional
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll <-- optional
O2 - BHO: XBTP03102 - {B1C35173-632F-4DD7-815D-5B497866957B} - C:\PROGRA~1\SOFTOM~1\TOOLBA~1\INSTAL~1\{47D21~1\0\toolbar.dll (file missing)
O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\PROGRA~1\SOFTOM~1\TOOLBA~1\bin\tbcore3U.dll

Close all windows including browser and press fix checked.

Reboot.

Re-scan with kaspersky.

Post:

- a fresh hijackthis log
- kaspersky report

robmarreel · Oct 31, 2007

HJ Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:02:13 PM, on 10/30/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5700.0006)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Citrix\GoToMyPC\g2svc.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\Program Files\Citrix\GoToMyPC\g2comm.exe
C:\Program Files\Norton Ghost\Agent\VProSvc.exe
C:\Program Files\Citrix\GoToMyPC\g2pre.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Citrix\GoToMyPC\g2tray.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\AOL\1135184755\ee\AOLSoftware.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jucheck.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton Ghost\Agent\GhostTray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Cloudmark\SpamNet\OE\snoe.exe
C:\Program Files\NETGEAR\WG511v2\wlancfg5.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.BIN
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\WINDOWS\System32\vssvc.exe
C:\Program Files\FileZilla\FileZilla.exe
C:\Program Files\PHP DESIGNER 2006\phpDesignerPrg2006.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1135184755\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton Ghost\Agent\GhostTray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [GoToMyPC] C:\Program Files\Citrix\GoToMyPC\g2svc.exe -logon
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx2\PXConsole.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Cloudmark Desktop for Outlook Express.lnk = ?
O4 - Global Startup: NETGEAR WG511v2 Smart Wizard.lnk = C:\Program Files\NETGEAR\WG511v2\wlancfg5.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {2D72C39D-53F6-4AEA-A9DB-1298429DA974} (3DVista Viewer Control) - http://www.3dvista.com/downloads/viewer3dv.cab
O16 - DPF: {2DEF4530-8CE6-41C9-84B6-A54536C90213} (Crystal Report Viewer Control 9) - https://www.libertytax.net/crystalreportviewers/activeXViewer/activexviewer.cab
O16 - DPF: {40F8967E-34A6-474A-837A-CEC1E7DAC54C} - https://accounting.quickbooks.com/c1/v16.548/qboax9.cab
O16 - DPF: {41289E02-198A-4034-8CF9-5A8739A80D0D} (ReportPromptInfoDlg Class) - https://www.libertytax.net/crystalreportviewers/activeXViewer/reportparameterdialog.cab
O16 - DPF: {4B5C9C28-3806-47B5-89A9-93063323160F} (ReportExport Class) - https://www.libertytax.net/crystalreportviewers/activeXViewer/activexviewer.cab
O16 - DPF: {843EE768-3A97-455C-9076-741BA3AD7B62} (QuickBooks Online Edition Utilities Class v10) - https://accounting.quickbooks.com/c6/v16.607/qboax10.cab
O16 - DPF: {8CE3BAE6-AB66-40B6-9019-41E5282FF1E2} - https://accounting.quickbooks.com/c8/v14.174/qboax8.cab
O16 - DPF: {934CC260-C5AA-43C4-A657-7B70C5B3DAE1} (Crystal Report Web Report Source Control 9) - https://www.libertytax.net/crystalreportviewers/activeXViewer/activexviewer.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://aolsvc.aol.com/onlinegames/pandacraze/gpcontrol.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: GoToMyPC - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToMyPC\g2svc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: PREVXAgent - Prevx - C:\Program Files\Prevx2\PXAgent.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Apache Tomcat (Tomcat5) - Apache Software Foundation - C:\Program Files\Apache Software Foundation\Tomcat 5.5\bin\tomcat5.exe

Shaba · Oct 31, 2007

Hi

How about a fresh kaspersky report?

robmarreel · Nov 1, 2007

Kasperksy

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Thursday, November 01, 2007 7:43:14 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 31/10/2007
Kaspersky Anti-Virus database records: 449137
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 172161
Number of viruses found: 9
Number of infected objects: 107
Number of suspicious objects: 0
Duration of the scan process: 05:28:54

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PestTrap.zip/PestTrap.exe Infected: not-a-virus:FraudTool.Win32.SpySheriff.j skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PestTrap.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PestTrap3.zip/heur000.dll Infected: not-a-virus:FraudTool.Win32.BraveSentry.b skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PestTrap3.zip/heur002.dll Infected: not-a-virus:FraudTool.Win32.BraveSentry.b skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PestTrap3.zip/heur003.dll Infected: not-a-virus:FraudTool.Win32.BraveSentry.b skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PestTrap3.zip ZIP: infected - 3 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC.zip/winstall.exe Infected: Trojan-Downloader.Win32.Small.cpg skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temp\Perflib_Perfdata_e4.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Rob Marreel\Cookies\INDEX.DAT Object is locked skipped
C:\Documents and Settings\Rob Marreel\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Rob Marreel\Desktop\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Rob Marreel\Desktop\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Rob Marreel\Desktop\SmitfraudFix.exe RarSFX: infected - 2 skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\AOL\UserProfiles\All Users\cls\common.cls Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Cloudmark\SpamNet\oemsgsvid.dat Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\dbc2e.ht1 Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\dbdam Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\dbdao Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\dbeam Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\dbeao Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\dbm Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\dbu2d.ht1 Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\dbvm.cf1 Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\dbvmh.ht1 Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\fii.cf1 Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\fiih.ht1 Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\hp Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\hpt2i.ht1 Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\rpm.cf1 Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\rpm1m.cf1 Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\rpm1mh.ht1 Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Google\Google Desktop\164e583521d9\rpmh.ht1 Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Identities\{DFF16927-88E6-4EAA-A097-460B7E65289B}\Microsoft\Outlook Express\Folders.dbx Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Identities\{DFF16927-88E6-4EAA-A097-460B7E65289B}\Microsoft\Outlook Express\Inbox.dbx Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Identities\{DFF16927-88E6-4EAA-A097-460B7E65289B}\Microsoft\Outlook Express\Offline.dbx Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Identities\{DFF16927-88E6-4EAA-A097-460B7E65289B}\Microsoft\Outlook Express\Pop3uidl.dbx Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Temp\Perflib_Perfdata_f1c.dat Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Temp\sqlite_Kafap1dmBoBBQ8c Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Temp\~DF3D4E.tmp Object is locked skipped
C:\Documents and Settings\Rob Marreel\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\Rob Marreel\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Rob Marreel\ntuser.dat.LOG Object is locked skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/heidil_thecharitygroup.com/inbox/3244d1fc710cd529c1925abe7510cd8e.eml/[From "eBay Member: sabomania" <member@ebay.com>][Date Tue, 17 May 2005 13:31:39 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/heidil_thecharitygroup.com/inbox/3244d1fc710cd529c1925abe7510cd8e.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/heidil_thecharitygroup.com/inbox/53912b7ec31292a45d52516f669e8f6f.eml/[From "eBay Member: earls71" <member@ebay.com>][Date Tue, 17 May 2005 21:02:23 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/heidil_thecharitygroup.com/inbox/53912b7ec31292a45d52516f669e8f6f.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/53912b7ec31292a45d52516f669e8f6f.eml/[From "eBay Member: earls71" <member@ebay.com>][Date Tue, 17 May 2005 21:02:23 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/53912b7ec31292a45d52516f669e8f6f.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/8acc3db1d7097ac80d88bad101056197.eml/[From "eBay Member: evm1024" <member@ebay.com>][Date Wed, 18 May 2005 09:06:42 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/8acc3db1d7097ac80d88bad101056197.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/c32ce5e49248429aab46767d5a3e633e.eml/[From "eBay Member: adlpc" <member@ebay.com>][Date Wed, 18 May 2005 09:32:07 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/c32ce5e49248429aab46767d5a3e633e.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/27eb56e72b95e96641b0b555e8fd4c6b.eml/[From "eBay Member: dlonno" <member@ebay.com>][Date Fri, 10 Jun 2005 18:43:37 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/27eb56e72b95e96641b0b555e8fd4c6b.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/3caddd3d4ac39e126dc82198cc8ae48f.eml/[From "eBay Member: rvickers48" <member@ebay.com>][Date Sun, 12 Jun 2005 19:30:52 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/3caddd3d4ac39e126dc82198cc8ae48f.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/trash/82a3731ead9a615e762f47d376a60638.eml/[From "eBay Member: mannyvel" <member@ebay.com>][Date Mon, 16 May 2005 18:31:19 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/trash/82a3731ead9a615e762f47d376a60638.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/trash/3244d1fc710cd529c1925abe7510cd8e.eml/[From "eBay Member: sabomania" <member@ebay.com>][Date Tue, 17 May 2005 13:31:39 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/trash/3244d1fc710cd529c1925abe7510cd8e.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/ocap.tv/htdocs/pp/paypal/error.php Infected: Trojan-Spy.HTML.Fraud.h skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/ocap.tv/htdocs/pp/paypal/final.php Infected: Trojan-Spy.HTML.Fraud.h skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/ocap.tv/htdocs/pp/paypal/index.php Infected: Trojan-Spy.HTML.Fraud.h skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/ocap.tv/htdocs/pp/paypal/login.html Infected: Trojan-Spy.HTML.Fraud.h skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/ocap.tv/htdocs/pp/paypal/login.php Infected: Trojan-Spy.HTML.Fraud.h skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/ocap.tv/htdocs/pp/paypal/next.php Infected: Trojan-Spy.HTML.Fraud.h skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/ocap.tv/htdocs/pp/paypal/processing.htm Infected: Trojan-Spy.HTML.Fraud.h skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/ocap.tv/htdocs/pp/paypal/protect.htm Infected: Trojan-Spy.HTML.Fraud.h skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/ocap.tv/htdocs/pp/paypal/protect.php Infected: Trojan-Spy.HTML.Fraud.h skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/ocap.tv/htdocs/pp/paypal/update.php Infected: Trojan-Spy.HTML.Fraud.h skipped

robmarreel · Nov 1, 2007

WIsh there wasn't a limit on the posts

C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/ocap.tv/htdocs/pp/paypal/_login-submit.htm Infected: Trojan-Spy.HTML.Fraud.h skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/heidil_thecharitygroup.com/inbox/3244d1fc710cd529c1925ab/[From "eBay Member: sabomania" <member@ebay.com>][Date Tue, 17 May 2005 13:31:39 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/heidil_thecharitygroup.com/inbox/3244d1fc710cd529c1925ab Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/heidil_thecharitygroup.com/inbox/53912b7ec31292a45d52516/[From "eBay Member: earls71" <member@ebay.com>][Date Tue, 17 May 2005 21:02:23 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/heidil_thecharitygroup.com/inbox/53912b7ec31292a45d52516 Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/53912b7ec31292a45d52516f/[From "eBay Member: earls71" <member@ebay.com>][Date Tue, 17 May 2005 21:02:23 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/53912b7ec31292a45d52516f Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/8acc3db1d7097ac80d88bad1/[From "eBay Member: evm1024" <member@ebay.com>][Date Wed, 18 May 2005 09:06:42 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/8acc3db1d7097ac80d88bad1 Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/c32ce5e49248429aab46767d/[From "eBay Member: adlpc" <member@ebay.com>][Date Wed, 18 May 2005 09:32:07 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/c32ce5e49248429aab46767d Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/27eb56e72b95e96641b0b555/[From "eBay Member: dlonno" <member@ebay.com>][Date Fri, 10 Jun 2005 18:43:37 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/27eb56e72b95e96641b0b555 Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/3caddd3d4ac39e126dc82198/[From "eBay Member: rvickers48" <member@ebay.com>][Date Sun, 12 Jun 2005 19:30:52 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/3caddd3d4ac39e126dc82198 Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/trash/82a3731ead9a615e762f47d3/[From "eBay Member: mannyvel" <member@ebay.com>][Date Mon, 16 May 2005 18:31:19 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/trash/82a3731ead9a615e762f47d3 Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/trash/3244d1fc710cd529c1925abe/[From "eBay Member: sabomania" <member@ebay.com>][Date Tue, 17 May 2005 13:31:39 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/trash/3244d1fc710cd529c1925abe Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz/www_07-29-07.tar Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_07-29-07.tar.gz GZIP: infected - 49 skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/heidil_thecharitygroup.com/inbox/3244d1fc710cd529c1925abe7510cd8e.eml/[From "eBay Member: sabomania" <member@ebay.com>][Date Tue, 17 May 2005 13:31:39 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/heidil_thecharitygroup.com/inbox/3244d1fc710cd529c1925abe7510cd8e.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/heidil_thecharitygroup.com/inbox/53912b7ec31292a45d52516f669e8f6f.eml/[From "eBay Member: earls71" <member@ebay.com>][Date Tue, 17 May 2005 21:02:23 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/heidil_thecharitygroup.com/inbox/53912b7ec31292a45d52516f669e8f6f.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/53912b7ec31292a45d52516f669e8f6f.eml/[From "eBay Member: earls71" <member@ebay.com>][Date Tue, 17 May 2005 21:02:23 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/53912b7ec31292a45d52516f669e8f6f.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/8acc3db1d7097ac80d88bad101056197.eml/[From "eBay Member: evm1024" <member@ebay.com>][Date Wed, 18 May 2005 09:06:42 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/8acc3db1d7097ac80d88bad101056197.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/c32ce5e49248429aab46767d5a3e633e.eml/[From "eBay Member: adlpc" <member@ebay.com>][Date Wed, 18 May 2005 09:32:07 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/c32ce5e49248429aab46767d5a3e633e.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/27eb56e72b95e96641b0b555e8fd4c6b.eml/[From "eBay Member: dlonno" <member@ebay.com>][Date Fri, 10 Jun 2005 18:43:37 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/27eb56e72b95e96641b0b555e8fd4c6b.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/3caddd3d4ac39e126dc82198cc8ae48f.eml/[From "eBay Member: rvickers48" <member@ebay.com>][Date Sun, 12 Jun 2005 19:30:52 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/inbox/3caddd3d4ac39e126dc82198cc8ae48f.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/trash/82a3731ead9a615e762f47d376a60638.eml/[From "eBay Member: mannyvel" <member@ebay.com>][Date Mon, 16 May 2005 18:31:19 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/trash/82a3731ead9a615e762f47d376a60638.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/trash/3244d1fc710cd529c1925abe7510cd8e.eml/[From "eBay Member: sabomania" <member@ebay.com>][Date Tue, 17 May 2005 13:31:39 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip/webmail/temporary_files/mattl_thecharitygroup.com/trash/3244d1fc710cd529c1925abe7510cd8e.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/marreel.com/htdocs/tmp/AdminCodeSnapShot_040507.zip Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/heidil_thecharitygroup.com/inbox/3244d1fc710cd529c1925ab/[From "eBay Member: sabomania" <member@ebay.com>][Date Tue, 17 May 2005 13:31:39 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/heidil_thecharitygroup.com/inbox/3244d1fc710cd529c1925ab Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/heidil_thecharitygroup.com/inbox/53912b7ec31292a45d52516/[From "eBay Member: earls71" <member@ebay.com>][Date Tue, 17 May 2005 21:02:23 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/heidil_thecharitygroup.com/inbox/53912b7ec31292a45d52516 Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/53912b7ec31292a45d52516f/[From "eBay Member: earls71" <member@ebay.com>][Date Tue, 17 May 2005 21:02:23 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/53912b7ec31292a45d52516f Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/8acc3db1d7097ac80d88bad1/[From "eBay Member: evm1024" <member@ebay.com>][Date Wed, 18 May 2005 09:06:42 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/8acc3db1d7097ac80d88bad1 Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/c32ce5e49248429aab46767d/[From "eBay Member: adlpc" <member@ebay.com>][Date Wed, 18 May 2005 09:32:07 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/c32ce5e49248429aab46767d Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/27eb56e72b95e96641b0b555/[From "eBay Member: dlonno" <member@ebay.com>][Date Fri, 10 Jun 2005 18:43:37 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/27eb56e72b95e96641b0b555 Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/3caddd3d4ac39e126dc82198/[From "eBay Member: rvickers48" <member@ebay.com>][Date Sun, 12 Jun 2005 19:30:52 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/inbox/3caddd3d4ac39e126dc82198 Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/trash/82a3731ead9a615e762f47d3/[From "eBay Member: mannyvel" <member@ebay.com>][Date Mon, 16 May 2005 18:31:19 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/trash/82a3731ead9a615e762f47d3 Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/trash/3244d1fc710cd529c1925abe/[From "eBay Member: sabomania" <member@ebay.com>][Date Tue, 17 May 2005 13:31:39 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar/var/www/tcg/htdocs/webmail/temporary_files/mattl_thecharitygroup.com/trash/3244d1fc710cd529c1925abe Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz/www_08-06-07.tar Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Downloads\www_08-06-07.tar.gz GZIP: infected - 38 skipped
C:\Program Files\Citrix\GoToMyPC\g2host.log Object is locked skipped
C:\Program Files\Citrix\GoToMyPC\g2svc.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\mastlog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\model.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\modellog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\msdbdata.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\msdblog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\tempdb.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\templog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\LOG\ERRORLOG Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\LOG\log_17.trc Object is locked skipped
C:\Program Files\Trend Micro\HijackThis\backups\backup-20071030-230147-952.dll Infected: not-a-virus:AdWare.Win32.MyWay.v skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP806\A0025083.dll Infected: Trojan-Downloader.Win32.Agent.bfj skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP839\A0026632.dll Infected: not-a-virus:AdWare.Win32.MyWay.v skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP840\A0026637.exe Infected: Trojan-Downloader.Win32.Small.cpg skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP840\A0026639.dll Infected: not-a-virus:AdWare.Win32.Mostofate.v skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP840\A0026640.dll Infected: not-a-virus:AdWare.Win32.Mostofate.v skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP840\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{C0292EF0-2A65-43EF-A1E5-736E4FF5F6A8}.crmlog Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{3A3AD287-E852-43A0-97F3-DBA71817DF1A}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\gotomon.log Object is locked skipped
C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped
C:\WINDOWS\SYSTEM32\MsDtc\MSDTC.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\MsDtc\Trace\DTCTRACE.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_14c.dat Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_b8.dat Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

Shaba · Nov 1, 2007

Hi

Empty these folders:

C:\Downloads
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\

Empty Recycle Bin

Still problems?

xlibgfl254.dll

New member

Security Expert: Emeritus

New member

New member

Security Expert: Emeritus

New member

New member

Security Expert: Emeritus

Security Expert: Emeritus

Security Expert: Emeritus

New member

New member

New member

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

New member

Security Expert: Emeritus