yet another xlibgfl254.dll is not a valid...

andywo · Mar 4, 2007

I saw a few others with this same issue. I followed through with the "BEFORE you POST" thread and below are the logs from the Activescan and Hijackthis scan. This is post 1 of 6 of the logs. Thanks in advance for your help!

Activescan:

Incident Status Location

Virus:Trj/dmRandom.EB Disinfected Operating system
Adware:Adware/WinAntivirus2006 Not disinfected c:\windows\system32\psc_mon.exe
Adware:Adware/SystemDoctor Not disinfected c:\windows\system32\60114164.exe
Adware:adware/dailytoolbar Not disinfected c:\windows\system32\dailytoolbar.dll
Adware:adware/emediacodec Not disinfected c:\windows\system32\ld101.tmp
Adware:adware/securityerror Not disinfected c:\windows\system32\ot.ico
Adware:adware/thespyguard Not disinfected c:\windows\system32\shellgui32.dll
Virus:trj/abwiz.a Disinfected Operating system
Adware:adware/admess Not disinfected c:\windows\system32\tcpservice2.exe
Adware:adware/topspyware Not disinfected c:\windows\system32\txfdb32.dll
Dialer:dialer.avv Not disinfected c:\windows\downloaded program files\gdnUS2218.exe
Potentially unwanted tool:application/spywaresheriff Not disinfected C:\Documents and Settings\Andy\Start Menu\Programs\Startup\spysheriff.lnk
Adware:adware/btgrab Not disinfected c:\windows\BTGrab.dll
Adware:adware/transponder Not disinfected c:\windows\dlmax.dll
Spyware:spyware/betterinet Not disinfected c:\windows\susp.exe
Adware:adware/spymarshal Not disinfected c:\windows\xpupdate.exe
Adware:adware/whenusearch Not disinfected C:\Documents and Settings\Andy\Start Menu\Programs\WhenU
Adware:adware/securitytoolbar Not disinfected c:\program files\Security Toolbar
Adware:adware/megatds Not disinfected Windows Registry
Potentially unwanted tool:application/antispywaresoldier Not disinfected hkey_current_user\software\ADV
Adware:adware/alexa-toolbar Not disinfected Windows Registry
Potentially unwanted tool:application/winantivirus2006 Not disinfected hkey_classes_root\WAP6.PCheck
Adware:adware/intcodec Not disinfected Windows Registry
Potentially unwanted tool:Application/Winantivirus2006 Not disinfected C:\Documents and Settings\Amy\Application Data\winantiviruspro2006freeinstall[1].exe
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Amy\Cookies\amy@247realmedia[2].txt
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Amy\Cookies\amy@2o7[1].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Amy\Cookies\amy@ad.yieldmanager[1].txt
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Amy\Cookies\amy@advertising[2].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Amy\Cookies\amy@atdmt[2].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Amy\Cookies\amy@belnk[1].txt
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Amy\Cookies\amy@bluestreak[1].txt
Spyware:Cookie/360i Not disinfected C:\Documents and Settings\Amy\Cookies\amy@ct.360i[1].txt
Spyware:Cookie/Coremetrics Not disinfected C:\Documents and Settings\Amy\Cookies\amy@data.coremetrics[1].txt
Spyware:Cookie/did-it Not disinfected C:\Documents and Settings\Amy\Cookies\amy@did-it[1].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Amy\Cookies\amy@dist.belnk[2].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Amy\Cookies\amy@doubleclick[1].txt
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Amy\Cookies\amy@ehg-dig.hitbox[2].txt
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Amy\Cookies\amy@go[2].txt
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Amy\Cookies\amy@hitbox[2].txt
Spyware:Cookie/Malwarewipe Not disinfected C:\Documents and Settings\Amy\Cookies\amy@malwarewipe[1].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Amy\Cookies\amy@mediaplex[1].txt
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Amy\Cookies\amy@overture[1].txt
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Amy\Cookies\amy@perf.overture[1].txt
Spyware:Cookie/WUpd Not disinfected C:\Documents and Settings\Amy\Cookies\amy@revenue[1].txt
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Amy\Cookies\amy@searchportal.information[2].txt
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Amy\Cookies\amy@server.iad.liveperson[2].txt
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Amy\Cookies\amy@statse.webtrendslive[2].txt
Spyware:Cookie/Target Not disinfected C:\Documents and Settings\Amy\Cookies\amy@target[2].txt
Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Amy\Cookies\amy@winantivirus[2].txt
Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\Amy\Cookies\amy@www.burstbeacon[2].txt

andywo · Mar 4, 2007

Spyware:Cookie/SecurityError Not disinfected C:\Documents and Settings\Amy\Cookies\amy@www.syssecuritysite[2].txt
Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Amy\Cookies\amy@www.winantivirus[2].txt
Adware:Adware/SystemDoctor Not disinfected C:\Documents and Settings\Amy\Local Settings\Application Data\60114164.exe
Potentially unwanted tool:Application/Winantivirus2006 Not disinfected C:\Documents and Settings\Amy\Local Settings\Temporary Internet Files\Content.IE5\Y72LO9WZ\WinAntiVirusPro2006FreeInstall[1].exe
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Andy\Cookies\andy@2o7[2].txt
Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Andy\Cookies\andy@adultfriendfinder[2].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Andy\Cookies\andy@belnk[1].txt
Spyware:Cookie/Ccbill Not disinfected C:\Documents and Settings\Andy\Cookies\andy@ccbill[2].txt
Spyware:Cookie/Clickbank Not disinfected C:\Documents and Settings\Andy\Cookies\andy@clickbank[2].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Andy\Cookies\andy@com[1].txt
Spyware:Cookie/cs.sexcounter Not disinfected C:\Documents and Settings\Andy\Cookies\andy@cs.sexcounter[2].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Andy\Cookies\andy@dist.belnk[2].txt
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Andy\Cookies\andy@go[2].txt
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Andy\Cookies\andy@searchportal.information[1].txt
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Andy\Cookies\andy@server.iad.liveperson[1].txt
Spyware:Cookie/Target Not disinfected C:\Documents and Settings\Andy\Cookies\andy@target[2].txt
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Andy\Cookies\andy@toplist[1].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Andy\Cookies\andy@tribalfusion[1].txt
Spyware:Cookie/WebPower Not disinfected C:\Documents and Settings\Andy\Cookies\andy@webpower[1].txt
Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\Andy\Cookies\andy@www.burstbeacon[2].txt
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Andy\Cookies\andy@xiti[1].txt
Spyware:Cookie/XXXCounter Not disinfected C:\Documents and Settings\Andy\Cookies\andy@xxxcounter[1].txt
Adware:Adware/SystemDoctor Not disinfected C:\Documents and Settings\Andy\Local Settings\Application Data\60114164.exe
Adware:Adware/SpySheriff Not disinfected C:\Documents and Settings\Andy\Local Settings\Temp\ehorqmis.exe
Adware:Adware/SpySheriff Not disinfected C:\Documents and Settings\Andy\Local Settings\Temp\nqubmtox.exe
Adware:Adware/SpywareQuake Not disinfected C:\Documents and Settings\Andy\Local Settings\Temp\tmp19A.tmp
Adware:Adware/SpySheriff Not disinfected C:\Documents and Settings\Andy\Local Settings\Temp\ujgjjdfw.exe
Adware:Adware/SpySheriff Not disinfected C:\Documents and Settings\Andy\Local Settings\Temp\vdrnegjj.exe
Virus:VBS/Psyme.C Disinfected C:\Documents and Settings\Andy\Local Settings\Temporary Internet Files\Content.IE5\G5EZGHIJ\index[3].htm
Adware:Adware/SaveNow Not disinfected C:\Program Files\DAEMON Tools\SetupDTSB.exe
Virus:Trj/Ruins.CS Disinfected C:\WINDOWS\system32\cshgo.exe

andywo · Mar 4, 2007

Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmacb.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmaek.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmafp.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmakn.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmast.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmauq.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmauv.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmbfk.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmbfq.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmbgi.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmbgw.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmbvz.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmbzu.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmcbb.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmcch.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmcdn.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmciy.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmcju.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmckm.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmckz.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmdgu.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmdhz.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmdkj.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmdtj.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmdtn.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmduz.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmdze.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmeex.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmehx.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmejd.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmeky.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmeps.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmeqd.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmeqh.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmetc.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmeuj.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmfca.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmfiq.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmfnn.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmfzg.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmgah.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmgaz.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmggs.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmgro.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmguh.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmgvz.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmgwn.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmgza.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmhee.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmhfp.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmhge.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmhip.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmhqo.exe

andywo · Mar 4, 2007

Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmhqy.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmhwc.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmifi.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmikh.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmilw.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmiov.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmipg.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmiru.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmivn.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmixz.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmjdd.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmjhx.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmjva.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmjwi.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmkfs.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmkne.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmknm.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmkpy.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmkqe.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmkqs.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmksi.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmkwb.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmkzz.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmlig.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmllr.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmlpa.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmlqh.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmltz.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmlyx.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmlzs.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmmez.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmmlv.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmmmc.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmmqs.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmmrs.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmmss.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmnaw.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmnfd.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmnga.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmnsp.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmnxw.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmodd.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmodk.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmodn.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmoei.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmoes.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmofx.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmoiq.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmoko.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmomw.exe

andywo · Mar 4, 2007

Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmonb.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmooi.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmooo.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmote.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmpbr.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmpcg.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmpco.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmpko.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmpne.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmpnk.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmpur.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmpuy.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmqar.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmqdv.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmqqr.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmquj.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmqvq.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmqvw.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmrii.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmrke.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmrnc.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmsit.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmskj.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmsnh.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmsny.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmsrn.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmstw.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmsxs.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmszd.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmsze.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmthg.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmtjw.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmtpe.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmtxu.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmucw.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmudz.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmufy.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmukg.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmupg.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmuqf.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmvad.exe

andywo · Mar 4, 2007

Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmvim.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmvlt.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmvng.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmvnv.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmvou.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmvoz.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmvsj.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmvsv.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmvyv.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmwcr.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmwdp.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmwfn.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmwhw.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmwnt.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmwqt.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmwqy.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmwtn.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmwup.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmwyl.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmxeo.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmxjf.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmxpj.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmxrg.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmydv.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmyfj.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmyjw.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmyki.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmyww.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmyzk.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmzbj.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmzfp.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmzmw.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmzna.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmzor.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmzvm.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmzww.exe
Virus:Trj/Gagar.CE Disinfected C:\WINDOWS\system32\fjpgqlds.exe
Virus:Trj/Gagar.P Disinfected C:\WINDOWS\system32\iedfxgtd.exe
Virus:Trj/Firebypass.AR Disinfected C:\WINDOWS\system32\ntoskrnl.dll
Adware:Adware/SpyMarshal Not disinfected C:\WINDOWS\system32\spmrgaat.exe
Potentially unwanted tool:Application/Restart Not disinfected C:\WINDOWS\system32\Tools\Restart.exe
Virus:Trj/Alanchum.BQ Disinfected C:\WINDOWS\system32\uqeclzsl.exe

andywo · Mar 4, 2007

Hijackthis scan:

Logfile of HijackThis v1.99.1
Scan saved at 4:38:08 PM, on 3/4/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ntsystem.exe
C:\WINDOWS\system32\psc_mon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1da7dbe8-c51b-4ae4-bc6e-21863349b0b4} - C:\Program Files\Media-Codec\isaddon.dll (file missing)
O2 - BHO: (no name) - {25B8CA4C-CF54-61C1-EF06-0281E92C4E4E} - C:\WINDOWS\system32\buxxrqn.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {75416740-A8F0-3EA3-DCC7-044323343C7D} - C:\WINDOWS\system32\yhrbrqi.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)
O2 - BHO: office_pnl.office_panel - {B53455DB-5527-4041-AC41-F86E6947AA47} - C:\WINDOWS\system32\office_pnl.dll (file missing)
O2 - BHO: (no name) - {f7d40011-29bb-43eb-9c97-875ce89e9e36} - C:\WINDOWS\system32\hp100.tmp (file missing)
O3 - Toolbar: (no name) - {a2595f37-48d0-46a1-9b51-478591a97764} - (no file)
O4 - HKLM\..\Run: [USIUDF_Eject_Monitor] C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Ulead Quick-Drop] "C:\Program Files\Ulead Systems\Ulead DVD MovieFactory 4.0 Suite\Ulead Quick-Drop 1.0\Quick-Drop.exe" WINDOWCALL
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup
O4 - HKLM\..\Run: [gwiz] C:\WINDOWS\system32\ntsystem.exe
O4 - HKLM\..\Run: [Personal Security Center Monitor] C:\WINDOWS\system32\psc_mon.exe
O4 - HKLM\..\Run: [dmzvm.exe] C:\WINDOWS\system32\dmzvm.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - Startup: spysheriff.lnk = C:\Program Files\SpywareSheriff\spysheriff.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1152762830625
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1152762826359
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\MDT5\AcDcToday.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred Control) - file://C:\Program Files\MDT5\InstFred.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\MDT5\AcPreview.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{0D534C20-F794-44BB-9D42-999FAE087487}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CCS\Services\Tcpip\..\{17E18E55-35FB-4E53-B60E-DA46E96A9C28}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CCS\Services\Tcpip\..\{9E57EBF6-E4BD-4977-B8E4-E58DF995D3FB}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CCS\Services\Tcpip\..\{A3C16CCE-36BA-4A8B-B81D-528A0F428C51}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.133 85.255.112.195
O17 - HKLM\System\CS1\Services\Tcpip\..\{0D534C20-F794-44BB-9D42-999FAE087487}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.133 85.255.112.195
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: coursings - {f8d02387-789a-4c0f-a1d8-8a93f33ee4df} - C:\WINDOWS\system32\yephk.dll (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

andywo · Mar 4, 2007

Okay, I was off by one post, but it's all here. Thanks again and I'm looking forward to your response!

tashi · Mar 10, 2007

Hello and sorry for the wait.

If you have not resolved the problem, we have this sticky topic:

If you have waited four days for advice post here.

Mr_JAk3 · Mar 16, 2007

HI andywo and welcome to the Forums

Sorry for the long wait.

You're infected....

You may want to print out these instructions for reference, since you will have to restart your computer during the fix.

Please download FixWareout from one of these sites:
http://downloads.subratam.org/Fixwareout.exe
http://www.bleepingcomputer.com/files/lonny/Fixwareout.exe

Save it to your desktop and run it. Click Next, then Install, then make sure "Run fixit" is checked and click Finish. The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal.

At the end of the fix, you may need to restart your computer again.

===========

Please download VundoFix.exe to your desktop.

Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.

==========

Please download SmitfraudFix (by S!Ri)

Double-click SmitfraudFix.exe
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply along with a fresh HijackThis log.

**If the tool fails to launch from the Desktop, please move SmitfraudFix.exe directly to the root of the system drive (usually C:), and launch from there.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm

NOTE: Do not run any other options from SmitfraudFix until I tell you to do so!

==========

Finally, please post a fresh HijackThis log, along with the contents of the logfile C:\fixwareout\report.txt and the contents of C:\vundofix.txt and the contents of C:\Rapport.txt

:bigthumb:

andywo · Mar 20, 2007

Logfile of HijackThis v1.99.1
Scan saved at 7:46:20 PM, on 3/20/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\psc_mon.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\PIXELA\ImageMixer for HDD Camcorder\IMx3Launcher.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1da7dbe8-c51b-4ae4-bc6e-21863349b0b4} - C:\Program Files\Media-Codec\isaddon.dll (file missing)
O2 - BHO: (no name) - {25B8CA4C-CF54-61C1-EF06-0281E92C4E4E} - C:\WINDOWS\system32\buxxrqn.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {75416740-A8F0-3EA3-DCC7-044323343C7D} - C:\WINDOWS\system32\yhrbrqi.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)
O2 - BHO: office_pnl.office_panel - {B53455DB-5527-4041-AC41-F86E6947AA47} - C:\WINDOWS\system32\office_pnl.dll (file missing)
O2 - BHO: (no name) - {f7d40011-29bb-43eb-9c97-875ce89e9e36} - C:\WINDOWS\system32\hp100.tmp (file missing)
O3 - Toolbar: (no name) - {a2595f37-48d0-46a1-9b51-478591a97764} - (no file)
O4 - HKLM\..\Run: [USIUDF_Eject_Monitor] C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Ulead Quick-Drop] "C:\Program Files\Ulead Systems\Ulead DVD MovieFactory 4.0 Suite\Ulead Quick-Drop 1.0\Quick-Drop.exe" WINDOWCALL
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup
O4 - HKLM\..\Run: [Personal Security Center Monitor] C:\WINDOWS\system32\psc_mon.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Startup: spysheriff.lnk = C:\Program Files\SpywareSheriff\spysheriff.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: ImageMixer for HDD Camcorder.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1152762830625
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1152762826359
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\MDT5\AcDcToday.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred Control) - file://C:\Program Files\MDT5\InstFred.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\MDT5\AcPreview.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{0D534C20-F794-44BB-9D42-999FAE087487}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CCS\Services\Tcpip\..\{17E18E55-35FB-4E53-B60E-DA46E96A9C28}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CCS\Services\Tcpip\..\{9E57EBF6-E4BD-4977-B8E4-E58DF995D3FB}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CCS\Services\Tcpip\..\{A3C16CCE-36BA-4A8B-B81D-528A0F428C51}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.133 85.255.112.195
O17 - HKLM\System\CS1\Services\Tcpip\..\{0D534C20-F794-44BB-9D42-999FAE087487}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.133 85.255.112.195
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: coursings - {f8d02387-789a-4c0f-a1d8-8a93f33ee4df} - C:\WINDOWS\system32\yephk.dll (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

report.txt:
»»»»» System restarted

»»»»» Postrun check
HKLM\SOFTWARE\~\version\Run\ "dmzvm"
HKLM\SOFTWARE\~\Winlogon\ "system"=""
....
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls "1trap" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls "2trap" Deleted
HKLM\~\currentversion\run "dmzvm.exe" Deleted
....
»»»»» Misc files.
C:\Documents and Settings\Andy\Application Data\Install.dat Deleted
....
»»»»» Checking for older varients.
....

Search five digit cs, dm, kd, jb, other, files.
The following files NEED TO BE SUBMITTED to one of the following URL'S for further inspection.

Click browse, find the file then click submit.
http://www.virustotal.com/flash/index_en.html
Or http://virusscan.jotti.org/

»»»»» Other

»»»»» Current runs
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"USIUDF_Eject_Monitor"="C:\\Program Files\\Common Files\\Ulead Systems\\DVD\\USISrv.exe"
"UpdReg"="C:\\WINDOWS\\UpdReg.EXE"
"Ulead Quick-Drop"="\"C:\\Program Files\\Ulead Systems\\Ulead DVD MovieFactory 4.0 Suite\\Ulead Quick-Drop 1.0\\Quick-Drop.exe\" WINDOWCALL"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\""
"SBDrvDet"="C:\\Program Files\\Creative\\SB Drive Det\\SBDrvDet.exe /r"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nTrayFw"="C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\bin\\nTrayFw.exe"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
"CTSysVol"="C:\\Program Files\\Creative\\SBAudigy2ZS\\Surround Mixer\\CTSysVol.exe /r"
"CTHelper"="CTHELPER.EXE"
"CTDVDDET"="C:\\Program Files\\Creative\\SBAudigy2ZS\\DVDAudio\\CTDVDDet.EXE"
"AGRSMMSG"="AGRSMMSG.exe"
"NWEReboot"=""
"DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"SNM"="C:\\Program Files\\SpyNoMore\\SNM.exe /startup"
"Personal Security Center Monitor"="C:\\WINDOWS\\system32\\psc_mon.exe"
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"RemoteCenter"="C:\\Program Files\\Creative\\MediaSource\\RemoteControl\\RCMan.EXE"
"updateMgr"="C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe AcRdB7_0_9"
....
Hosts file was reset, If you use a custom hosts file please replace it
»»»»» End report »»»»»

andywo · Mar 20, 2007

rapport.txt:
SmitFraudFix v2.151

Scan done at 19:42:19.76, Tue 03/20/2007
Run from C:\Documents and Settings\Andy\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

C:\WINDOWS\adware-sheriff-box.gif FOUND !
C:\WINDOWS\adware-sheriff-header.gif FOUND !
C:\WINDOWS\alexaie.dll FOUND !
C:\WINDOWS\alxie328.dll FOUND !
C:\WINDOWS\alxtb1.dll FOUND !
C:\WINDOWS\antispylab-logo.gif FOUND !
C:\WINDOWS\about_spyware_bg.gif FOUND !
C:\WINDOWS\blue-bg.gif FOUND !
C:\WINDOWS\BTGrab.dll FOUND !
C:\WINDOWS\button_freescan.gif FOUND !
C:\WINDOWS\buy-now-btn.gif FOUND !
C:\WINDOWS\corner-left.gif FOUND !
C:\WINDOWS\corner-right.gif FOUND !
C:\WINDOWS\dlmax.dll FOUND !
C:\WINDOWS\facts.gif FOUND !
C:\WINDOWS\footer.giff FOUND !
C:\WINDOWS\free-scan-btn.gif FOUND !
C:\WINDOWS\h-line-gradient.gif FOUND !
C:\WINDOWS\header_1.gif FOUND !
C:\WINDOWS\header-bg.gif FOUND !
C:\WINDOWS\info.gif FOUND !
C:\WINDOWS\no-icon.gif FOUND !
C:\WINDOWS\Pynix.dll FOUND !
C:\WINDOWS\reg-freeze-box.gif FOUND !
C:\WINDOWS\reg-freeze-header.gif FOUND !
C:\WINDOWS\remove-spyware-btn.gif FOUND !
C:\WINDOWS\spyware-sheriff-header.gif FOUND !
C:\WINDOWS\spyware-sheriff-box.gif FOUND !
C:\WINDOWS\star-grey.gif FOUND !
C:\WINDOWS\susp.exe FOUND !
C:\WINDOWS\true-stories.gif FOUND !
C:\WINDOWS\ts_header.gif FOUND !
C:\WINDOWS\win-sec-center-logo.gif FOUND !
C:\WINDOWS\windows-compatible.gif FOUND !
C:\WINDOWS\yes-icon.gif FOUND !
C:\WINDOWS\ZServ.dll FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\dailytoolbar.dll FOUND !
C:\WINDOWS\system32\ot.ico FOUND !
C:\WINDOWS\system32\questmod.dll FOUND !
C:\WINDOWS\system32\runsrv32.dll FOUND !
C:\WINDOWS\system32\shellgui32.dll FOUND !
C:\WINDOWS\system32\smaexp32.dll FOUND !
C:\WINDOWS\system32\tcpservice2.exe FOUND !
C:\WINDOWS\system32\thlwin32.dll FOUND !
C:\WINDOWS\system32\txfdb32.dll FOUND !
C:\WINDOWS\system32\udpmod.dll FOUND !
C:\WINDOWS\system32\wstart.dll FOUND !
C:\WINDOWS\system32\1024\ FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Andy

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Andy\Application Data

C:\Documents and Settings\Andy\Local Settings\Application Data\SpywareSheriff FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

C:\DOCUME~1\Andy\STARTM~1\Programs\Startup\spysheriff.lnk FOUND !
C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url FOUND !
C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Andy\FAVORI~1

C:\DOCUME~1\Andy\FAVORI~1\Online Security Test.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

C:\Program Files\EliteCodec\ FOUND !
C:\Program Files\HQVideoCodec\ FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"coursings"="{f8d02387-789a-4c0f-a1d8-8a93f33ee4df}"

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"system"=""

»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32-huy32

»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

Mr_JAk3 · Mar 21, 2007

Hello

Ok, please post the contents of C:\vundofix.txt too then we'll kill the remainings
:bigthumb:

andywo · Mar 22, 2007

VundoFix V6.3.17

Checking Java version...

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Scan started at 7:37:43 PM 3/20/2007

Listing files found while scanning....

No infected files were found.

Beginning removal...

Mr_JAk3 · Mar 23, 2007

Hi again, we'll continue

You seem to have this SpyNoMore software installed.It has a suspicious reputation and Irecommend that you remove it via Control Panel, Add/Remove programs.
More info here

This is the line to fix with HijackThis, O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup

This is the folder to delete, C:\Program Files\SpyNoMore

You should print these instructions or save these to a text file. Follow these instructions carefully.

Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/

Install AVG Anti-Spyware by double clicking the installer.
Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
On the main screen under Your Computer's security.
- Click on Change state next to Resident shield. It should now change to inactive.
- Click on Change state next to Automatic updates. It should now change to inactive.
- Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
- Wait until you see the Update succesfull message.
Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.

Download ATF Cleaner by Atribune to your desktop.
Do NOT run yet.

Make your hidden files visible:

Go to My Computer
Select the Tools menu and click Folder Options
Click the View tab.
Checkmark the "Display the contents of system folders"
Under the Hidden files and folders select "Show hidden files and folders"
Uncheck "Hide protected operating system files"
Click Apply and then the OK and close My Computer.

==================

Next, please reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.

Once in Safe Mode, double-click on SmitfraudFix.exe
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Warning : running option #2 on a non infected computer will remove your Desktop background.

Stop the following processes using Task Manager (press ctrl+alt+del, select the Processes tab, highlight the first process in the list and click End Process). Continue through the list (one at a time) until all processes have been ended. If something isn't found, please continue with the next process in the list.

psc_mon.exe

Run HijackThis, click Do a system scan only, and check the box next to each of these entries if still present. Close all other windows and press Fix checked. If something isn't there, please continue with the next entry in the list.

O2 - BHO: (no name) - {1da7dbe8-c51b-4ae4-bc6e-21863349b0b4} - C:\Program Files\Media-Codec\isaddon.dll (file missing)
O2 - BHO: (no name) - {25B8CA4C-CF54-61C1-EF06-0281E92C4E4E} - C:\WINDOWS\system32\buxxrqn.dll
O2 - BHO: (no name) - {75416740-A8F0-3EA3-DCC7-044323343C7D} - C:\WINDOWS\system32\yhrbrqi.dll
O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)
O2 - BHO: office_pnl.office_panel - {B53455DB-5527-4041-AC41-F86E6947AA47} - C:\WINDOWS\system32\office_pnl.dll (file missing)
O2 - BHO: (no name) - {f7d40011-29bb-43eb-9c97-875ce89e9e36} - C:\WINDOWS\system32\hp100.tmp (file missing)
O3 - Toolbar: (no name) - {a2595f37-48d0-46a1-9b51-478591a97764} - (no file)
O4 - HKLM\..\Run: [Personal Security Center Monitor] C:\WINDOWS\system32\psc_mon.exe
O4 - Startup: spysheriff.lnk = C:\Program Files\SpywareSheriff\spysheriff.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{0D534C20-F794-44BB-9D42-999FAE087487}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CCS\Services\Tcpip\..\{17E18E55-35FB-4E53-B60E-DA46E96A9C28}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CCS\Services\Tcpip\..\{9E57EBF6-E4BD-4977-B8E4-E58DF995D3FB}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CCS\Services\Tcpip\..\{A3C16CCE-36BA-4A8B-B81D-528A0F428C51}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.133 85.255.112.195
O17 - HKLM\System\CS1\Services\Tcpip\..\{0D534C20-F794-44BB-9D42-999FAE087487}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.133 85.255.112.195
O21 - SSODL: coursings - {f8d02387-789a-4c0f-a1d8-8a93f33ee4df} - C:\WINDOWS\system32\yephk.dll (file missing)

Now lets check some settings on your system.
(2000/XP) Only
In the windows control panel. If you are using Windows XP's Category View, select the Network and Internet Connections category otherwise double click on Network Connections. Then right click on your default connection, usually local area connection for cable and dsl, and left click on properties. Click the Networking tab. Double-click on the Internet Protocol (TCP/IP) item and select the radio dial that says Obtain DNS servers automatically
Press OK twice to get out of the properties screen and reboot if it asks.
That option might not be avaiable on some systems
Next Go start run type cmd and hit OK
type
ipconfig /flushdns
then hit enter, type exit hit enter
(that space between g and / is needed)

Restart your computer to the safe mode:

Restart your computer
Start tapping the F8 key when the computer restarts.
When the start menu opens, choose Safe mode
Press Enter. The computer then begins to start in Safe mode.

Go to the My Computer and delete the following files (if present):
C:\WINDOWS\system32\buxxrqn.dll
C:\WINDOWS\system32\yhrbrqi.dll
C:\WINDOWS\system32\psc_mon.exe

Run ATF Cleaner

Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.

Click on Scanner on the toolbar.
Click on the Settings tab.
- Under How to act?
  - Click on Recommended Action and choose Quarantine from the popup menu.
- Under How to scan?
  - All checkboxes should be ticked.
- Under Possibly unwanted software:
  - All checkboxes should be ticked.
- Under Reports:
  - Select Automatically generate report after every scan and uncheck Only if threats were found.
- Under What to scan?
  - Select Scan every file.
Click on the Scan tab.
Click on Complete System Scan to start the scan process.
Let the program scan the machine.
When the scan has finished, follow the instructions below.
IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
- Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
- At the bottom of the window click on the Apply all Actions button. (3)
When done, click the Save Scan Report button. (4)
- Click the Save Report as button.
- Save the report to your Desktop.
Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

Reboot in Normal Mode.

================

When you're ready, please post the following logs to here:
- AVG's report
- a fresh HijackThis log
- contents of C:\Rapport.txt

andywo · Mar 25, 2007

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 11:31:00 PM 3/24/2007

+ Scan result:

HKLM\SOFTWARE\Classes\DailyToolbar.IEBand -> Adware.DailyToolbar : Error during cleaning.
HKLM\SOFTWARE\Classes\DailyToolbar.SysMgr -> Adware.DailyToolbar : Error during cleaning.
HKLM\SOFTWARE\Classes\IEToolbar.AffiliateCtl -> Adware.DailyToolbar : Error during cleaning.
HKU\S-1-5-21-527237240-1715567821-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1DA7DBE8-C51B-4AE4-BC6E-21863349B0B4} -> Adware.Generic : Cleaned with backup (quarantined).
HKU\S-1-5-21-527237240-1715567821-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B53455DB-5527-4041-AC41-F86E6947AA47} -> Adware.Generic : Cleaned with backup (quarantined).
HKU\S-1-5-21-527237240-1715567821-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F7D40011-29BB-43EB-9C97-875CE89E9E36} -> Adware.Generic : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027758.dll -> Adware.Pesttrap : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027762.exe -> Adware.Pesttrap : Cleaned with backup (quarantined).
C:\Documents and Settings\Andy\Start Menu\Programs\WhenU -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Documents and Settings\Andy\Start Menu\Programs\WhenU\Uninstall.lnk -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Documents and Settings\Andy\Start Menu\Programs\WhenU\WhenU Help Desk.lnk -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Program Files\DAEMON Tools\SetupDTSB.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027759.dll -> Adware.SearchAssistant : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027760.dll -> Adware.SearchAssistant : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027761.dll -> Adware.SearchAssistant : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP105\A0037145.cpl -> Adware.SecurityCenter : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP106\A0037209.cpl -> Adware.SecurityCenter : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP107\A0038416.cpl -> Adware.SecurityCenter : Cleaned with backup (quarantined).
C:\WINDOWS\system32\isc_cpl.cpl -> Adware.SecurityCenter : Cleaned with backup (quarantined).
C:\Documents and Settings\Andy\Desktop\SmitfraudFix\SmiUpdate.exe -> Adware.SmiUpdate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP87\A0031411.exe -> Adware.SpyMarshal : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP87\A0031412.exe -> Adware.SpyMarshal : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP87\A0031413.dll -> Adware.SpyMarshal : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP87\A0031414.dll -> Adware.SpyMarshal : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP87\A0031415.dll -> Adware.SpyMarshal : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP87\A0031416.dll -> Adware.SpyMarshal : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP104\A0037086.exe -> Adware.SpySheriff : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP104\A0037088.exe -> Adware.SpySheriff : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027763.exe -> Adware.Spysheriff : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP114\A0038945.exe -> Adware.UltimateDefender : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032705.dll -> Downloader.Agent.bfj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\snapshot\MFEX-1.DAT -> Downloader.Agent.bfj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\snapshot\MFEX-2.DAT -> Downloader.Agent.bfj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP79\A0027599.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027615.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027633.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027648.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027666.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027682.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027715.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP81\A0027733.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027769.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027787.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027827.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027850.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027886.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027908.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027922.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP83\A0027938.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP83\A0027967.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP83\A0027998.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP83\A0028031.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP83\A0028049.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP84\A0028107.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP85\A0028156.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP85\A0028175.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0028200.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0028229.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0028238.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0029238.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0029268.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0029309.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0029341.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0029375.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0030375.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0031375.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0031387.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP87\A0031420.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP87\A0032421.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP87\A0032457.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP88\A0032516.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP88\A0032557.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP88\A0032587.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032637.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032652.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032677.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032691.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032735.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032766.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032784.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032814.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032831.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032884.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0032997.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0033028.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0033043.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0033063.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0033089.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0033120.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034120.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034139.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034183.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034244.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034259.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034277.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034292.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034339.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034409.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034426.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034442.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034532.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0035532.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP91\A0035566.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP91\A0035590.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP91\A0035620.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP91\A0035637.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP91\A0035789.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035821.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035838.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035845.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035861.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035879.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP93\A0036545.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032635.exe -> Downloader.AIO : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0029321.exe -> Downloader.Busky : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0033132.exe -> Downloader.Busky : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP105\A0037144.exe -> Downloader.Busky.aw : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027612.exe -> Downloader.Obfuscated.bc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027627.exe -> Downloader.Obfuscated.bc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027645.exe -> Downloader.Obfuscated.bc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027660.exe -> Downloader.Obfuscated.bc : Cleaned with backup (quarantined).

andywo · Mar 25, 2007

C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027919.exe -> Downloader.Obfuscated.bc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027679.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027694.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027727.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP81\A0027745.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027781.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027799.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027839.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027862.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027898.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027934.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP83\A0027950.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP83\A0027979.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP83\A0028010.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP83\A0028044.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP83\A0028061.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP84\A0028125.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP85\A0028169.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP85\A0028187.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0028212.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0028252.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032649.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP79\A0027600.exe -> Downloader.Oleloa : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027616.exe -> Downloader.Oleloa : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027634.exe -> Downloader.Oleloa : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027649.exe -> Downloader.Oleloa : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027667.exe -> Downloader.Oleloa : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027683.exe -> Downloader.Oleloa : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027716.exe -> Downloader.Oleloa : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP81\A0027734.exe -> Downloader.Oleloa : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027770.exe -> Downloader.Oleloa : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036076.exe -> Downloader.Small.cpt : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036077.exe -> Downloader.Small.dkt : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036079.exe -> Downloader.Small.dkt : Cleaned with backup (quarantined).
C:\Documents and Settings\Amy\Application Data\winantiviruspro2006freeinstall[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP81\A0027750.exe -> Not-A-Virus.Hoax.Win32.Renos.eo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027764.exe -> Not-A-Virus.Hoax.Win32.Renos.eo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032632.exe -> Not-A-Virus.Hoax.Win32.Renos.eo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032636.exe -> Not-A-Virus.Hoax.Win32.Renos.eo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032765.exe -> Not-A-Virus.Hoax.Win32.Renos.eo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035843.exe -> Not-A-Virus.Hoax.Win32.Renos.eo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP81\A0027751.dll -> Trojan.Agent.rx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036078.dll -> Trojan.Agent.rx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034545.exe -> Trojan.Obfuscated.ev : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP91\A0035651.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP91\A0035795.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035828.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035852.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035872.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035886.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035896.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035897.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035898.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035899.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035900.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035901.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035902.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035903.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035904.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035905.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035906.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035907.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035908.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035909.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035910.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035911.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035912.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035913.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035914.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035915.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035916.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035917.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035918.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035919.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035920.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035921.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035922.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035923.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035924.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035925.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035926.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035927.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035928.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035929.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035930.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035931.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035932.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035933.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035934.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035935.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035936.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035937.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035938.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035939.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035940.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035941.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035942.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035943.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035944.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035945.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035946.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035947.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035948.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035949.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035950.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035951.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035952.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035953.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035954.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035955.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035956.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035957.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035958.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035959.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035960.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035961.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035962.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035963.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035964.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035965.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035966.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035967.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035968.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035969.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035970.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035971.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035972.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035973.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).

andywo · Mar 25, 2007

C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035974.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035975.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035976.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035977.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035978.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035979.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035980.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035981.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035982.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035983.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035984.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035985.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035986.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035987.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035988.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035989.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035990.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035991.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035992.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035993.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035994.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035995.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035996.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035997.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035998.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035999.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036000.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036001.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036002.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036003.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036004.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036005.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036006.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036007.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036008.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036009.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036010.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036011.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036012.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036013.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036014.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036015.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036016.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036017.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036018.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036019.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036020.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036021.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036022.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036023.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036024.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036025.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036026.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036027.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036028.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036029.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036030.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036031.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036032.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036033.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036034.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036035.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036036.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036037.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036038.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036039.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036040.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036041.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036042.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036043.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036044.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036045.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036046.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036047.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036048.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036049.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036050.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036051.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036052.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036053.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036054.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036055.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036056.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036057.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036058.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036059.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036060.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036061.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036062.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036063.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036064.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036065.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036066.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036067.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036068.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036069.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036070.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036071.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036072.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036073.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036074.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036075.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP93\A0036546.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).

::Report end

andywo · Mar 25, 2007

Logfile of HijackThis v1.99.1
Scan saved at 11:34:43 PM, on 3/24/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\PIXELA\ImageMixer for HDD Camcorder\IMx3Launcher.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HijackThis\HijackThis.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O4 - HKLM\..\Run: [USIUDF_Eject_Monitor] C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Ulead Quick-Drop] "C:\Program Files\Ulead Systems\Ulead DVD MovieFactory 4.0 Suite\Ulead Quick-Drop 1.0\Quick-Drop.exe" WINDOWCALL
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: ImageMixer for HDD Camcorder.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1152762830625
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1152762826359
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\MDT5\AcDcToday.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred Control) - file://C:\Program Files\MDT5\InstFred.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\MDT5\AcPreview.ocx
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

SmitFraudFix v2.151

Scan done at 22:50:28.79, Sat 03/24/2007
Run from C:\Documents and Settings\Andy\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"system"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

Mr_JAk3 · Mar 25, 2007

Hello, good work

:

Looks much better now.

You have some Symantec/Norton leftovers there. You have uninstalled it, right? In that case, Please run this removal tool -> Link

Restart the computer.

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

==========

Download F-Secure Blacklight and save it to your desktop.

Doubleclick blbeta.exe, accept the agreement, click Scan, then click Next

You'll see a list what have been found. A log will appear to your desktop, it is named fsbl.xxxxxxx.log (xxxxxxx will be random numbers).

DON'T choose Rename if something was found!

Post the contents of fsbl.xxxx.log to here (blacklight log from your desktop) along with a fresh HijackThis log and ComboFix log.

Let me also know that how is the computer running :bigthumb:

yet another xlibgfl254.dll is not a valid...

New member

New member

New member

New member

New member

New member

New member

New member

Member of Team Spybot

Security Expert-Emeritus

New member

New member

Security Expert-Emeritus

New member

Security Expert-Emeritus

New member

New member

New member

New member

Security Expert-Emeritus