Zombie PC

Bear07 · Jun 4, 2007

I think there's malware on my pc that's sending out spam, because I keep getting "mail delivery failed" messages regarding emails that I'm not sending. I'm also getting other strange spam mail that appears to be coming from my own email accounts.

Here is the HiJackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 4:11:47 PM, on 6/4/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\WINDOWS\anvshell.exe
C:\Program Files\RAMpage\RAMpage.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\ClipMate7\clipmate.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Wacom\TabUserW.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Tablet.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\hijackthis\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [anvshell] anvshell.exe
O4 - HKLM\..\Run: [LiveNote] livenote.exe
O4 - HKLM\..\Run: [RAMpage] "C:\Program Files\RAMpage\RAMpage.exe" U=1 M=28 T=4 LW P="C:\Program Files\RAMpage\RAMpageConfig.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ClipMate7] C:\Program Files\ClipMate7\clipmate.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: TabUserW.lnk = C:\Program Files\Wacom\TabUserW.exe
O8 - Extra context menu item: Google AdSense Preview Tool - http://pagead2.googlesyndication.com/pagead/preview/en/preview.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3F0EECCE-E138-11D1-8712-0060083D83F5} (LPViewer Class) - http://www.iseemedia.com/activex/LPControl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1126413452031
O16 - DPF: {77DD44BF-551D-4E3C-82CD-D637D5018D3C} - http://www.surveys.com/promptcast/Installs/SURVEYS.COM PROMPTCAST SETUP.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://prweb.webex.com/client/v_mywebex-t20/event/ieatgpc.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O16 - DPF: {ED4E6F97-FA1A-4634-B550-AABFEB8DA009} (TulipPlayer Class) - http://www.exstream.to/tulip/cab/3,0,5,19/TulipPlayer2.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: ASUS Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

When I did the online scan Trend Micro found and deleted Java Byteverify and Alexa. eTrust Antivirus Web Scanner found nothing.

Thank you,

Bear

Mr_JAk3 · Jun 5, 2007

Hello and welcome to the Forums

Let's do some research...nothing bad in HijackThis log.

Please run a GMER Rootkit scan:

Download GMER's application from here:
http://www.gmer.net/gmer.zip

Unzip it and start the GMER.exe
Click the Rootkit tab and click the Scan button.

Once done, click the Copy button.
This will copy the results to your clipboard.
Paste the results in your next reply.

Warning ! Please, do not select the "Show all" checkbox during the scan.

Bear07 · Jun 5, 2007

Here are the results of the GMER Rootkit scan:

GMER 1.0.12.12244 - http://www.gmer.net
Rootkit scan 2007-06-05 16:04:34
Windows 5.1.2600 Service Pack 2

---- System - GMER 1.0.12 ----

SSDT \SystemRoot\System32\vsdatant.sys ZwConnectPort
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateFile
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateKey
SSDT \SystemRoot\System32\vsdatant.sys ZwCreatePort
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateProcess
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateProcessEx
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateSection
SSDT 860C6109 ZwCreateThread
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateWaitablePort
SSDT \SystemRoot\System32\vsdatant.sys ZwDeleteFile
SSDT \SystemRoot\System32\vsdatant.sys ZwDeleteKey
SSDT \SystemRoot\System32\vsdatant.sys ZwDeleteValueKey
SSDT \SystemRoot\System32\vsdatant.sys ZwDuplicateObject
SSDT \SystemRoot\System32\vsdatant.sys ZwLoadKey
SSDT \SystemRoot\System32\vsdatant.sys ZwOpenFile
SSDT \SystemRoot\System32\vsdatant.sys ZwOpenProcess
SSDT \SystemRoot\System32\vsdatant.sys ZwOpenThread
SSDT \SystemRoot\System32\vsdatant.sys ZwReplaceKey
SSDT \SystemRoot\System32\vsdatant.sys ZwRequestWaitReplyPort
SSDT \SystemRoot\System32\vsdatant.sys ZwRestoreKey
SSDT \SystemRoot\System32\vsdatant.sys ZwSecureConnectPort
SSDT \SystemRoot\System32\vsdatant.sys ZwSetInformationFile
SSDT \SystemRoot\System32\vsdatant.sys ZwSetValueKey
SSDT \SystemRoot\System32\vsdatant.sys ZwTerminateProcess

---- Kernel code sections - GMER 1.0.12 ----

.text ntoskrnl.exe!_abnormal_termination + 104 804E2760 12 Bytes [ F0, 61, 1E, F1, 80, C4, 1E, ... ]
? srescan.sys The system cannot find the file specified.
? C:\WINDOWS\System32\DRIVERS\update.sys
.text ntoskrnl.exe!_abnormal_termination + 104 804E2760 12 Bytes [ F0, 61, 1E, F1, 80, C4, 1E, ... ]

---- User code sections - GMER 1.0.12 ----

.text C:\WINDOWS\system32\services.exe[676] kernel32.dll!ReadFile 7C80180E 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[676] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[676] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[676] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[676] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[676] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[676] kernel32.dll!WriteFile 7C810D87 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[676] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[676] kernel32.dll!PeekNamedPipe 7C85F90F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[676] kernel32.dll!WinExec 7C86136D 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[676] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[676] WS2_32.dll!select 71AB2DC0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[676] WS2_32.dll!socket 71AB3B91 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[676] WS2_32.dll!bind 71AB3E00 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[676] WS2_32.dll!send 71AB428A 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[676] WS2_32.dll!recv 71AB615A 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[676] WININET.dll!InternetReadFile 42C2ABBC 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[676] WININET.dll!InternetOpenA 42C2C869 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[676] WININET.dll!InternetOpenUrlA 42C306DD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!ReadFile 7C80180E 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!WriteFile 7C810D87 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!PeekNamedPipe 7C85F90F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!WinExec 7C86136D 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[688] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[688] WS2_32.dll!select 71AB2DC0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[688] WS2_32.dll!socket 71AB3B91 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[688] WS2_32.dll!bind 71AB3E00 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[688] WS2_32.dll!send 71AB428A 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[688] WS2_32.dll!recv 71AB615A 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[688] WININET.dll!InternetReadFile 42C2ABBC 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[688] WININET.dll!InternetOpenA 42C2C869 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[688] WININET.dll!InternetOpenUrlA 42C306DD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[836] kernel32.dll!ReadFile 7C80180E 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[836] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[836] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[836] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[836] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[836] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[836] kernel32.dll!WriteFile 7C810D87 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[836] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[836] kernel32.dll!PeekNamedPipe 7C85F90F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[836] kernel32.dll!WinExec 7C86136D 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[836] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[836] WS2_32.dll!select 71AB2DC0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[836] WS2_32.dll!socket 71AB3B91 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[836] WS2_32.dll!bind 71AB3E00 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll

Bear07 · Jun 5, 2007

Continuing results from GMER Rootkit scan:

.text C:\WINDOWS\system32\svchost.exe[836] WS2_32.dll!send 71AB428A 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[836] WS2_32.dll!recv 71AB615A 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[836] WININET.dll!InternetReadFile 42C2ABBC 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[836] WININET.dll!InternetOpenA 42C2C869 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[836] WININET.dll!InternetOpenUrlA 42C306DD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[920] kernel32.dll!ReadFile 7C80180E 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[920] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[920] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[920] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[920] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[920] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[920] kernel32.dll!WriteFile 7C810D87 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[920] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[920] kernel32.dll!PeekNamedPipe 7C85F90F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[920] kernel32.dll!WinExec 7C86136D 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[920] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[920] WS2_32.dll!select 71AB2DC0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[920] WS2_32.dll!socket 71AB3B91 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[920] WS2_32.dll!bind 71AB3E00 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[920] WS2_32.dll!send 71AB428A 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[920] WS2_32.dll!recv 71AB615A 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[920] WININET.dll!InternetReadFile 42C2ABBC 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[920] WININET.dll!InternetOpenA 42C2C869 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[920] WININET.dll!InternetOpenUrlA 42C306DD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1056] kernel32.dll!ReadFile 7C80180E 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1056] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1056] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1056] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1056] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1056] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1056] kernel32.dll!WriteFile 7C810D87 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1056] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1056] kernel32.dll!PeekNamedPipe 7C85F90F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1056] kernel32.dll!WinExec 7C86136D 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1056] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1056] WS2_32.dll!select 71AB2DC0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1056] WS2_32.dll!socket 71AB3B91 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1056] WS2_32.dll!bind 71AB3E00 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1056] WS2_32.dll!send 71AB428A 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1056] WS2_32.dll!recv 71AB615A 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1056] WININET.dll!InternetReadFile 42C2ABBC 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1056] WININET.dll!InternetOpenA 42C2C869 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1056] WININET.dll!InternetOpenUrlA 42C306DD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1100] kernel32.dll!ReadFile 7C80180E 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1100] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1100] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1100] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1100] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1100] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1100] kernel32.dll!WriteFile 7C810D87 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1100] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1100] kernel32.dll!PeekNamedPipe 7C85F90F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1100] kernel32.dll!WinExec 7C86136D 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1100] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1100] WS2_32.dll!select 71AB2DC0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1100] WS2_32.dll!socket 71AB3B91 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1100] WS2_32.dll!bind 71AB3E00 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1100] WS2_32.dll!send 71AB428A 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1100] WS2_32.dll!recv 71AB615A 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1100] WININET.dll!InternetReadFile 42C2ABBC 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1100] WININET.dll!InternetOpenA 42C2C869 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1100] WININET.dll!InternetOpenUrlA 42C306DD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1124] kernel32.dll!ReadFile 7C80180E 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1124] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1124] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1124] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1124] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1124] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1124] kernel32.dll!WriteFile 7C810D87 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1124] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1124] kernel32.dll!PeekNamedPipe 7C85F90F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1124] kernel32.dll!WinExec 7C86136D 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1124] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1124] WS2_32.dll!select 71AB2DC0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1124] WS2_32.dll!socket 71AB3B91 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1124] WS2_32.dll!bind 71AB3E00 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1124] WS2_32.dll!send 71AB428A 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1124] WS2_32.dll!recv 71AB615A 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1124] WININET.dll!InternetReadFile 42C2ABBC 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1124] WININET.dll!InternetOpenA 42C2C869 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1124] WININET.dll!InternetOpenUrlA 42C306DD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!ReadFile 7C80180E 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!WriteFile 7C810D87 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!PeekNamedPipe 7C85F90F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!WinExec 7C86136D 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1224] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1224] WS2_32.dll!select 71AB2DC0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1224] WS2_32.dll!socket 71AB3B91 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1224] WS2_32.dll!bind 71AB3E00 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1224] WS2_32.dll!send 71AB428A 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1224] WS2_32.dll!recv 71AB615A 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1224] WININET.dll!InternetReadFile 42C2ABBC 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1224] WININET.dll!InternetOpenA 42C2C869 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1224] WININET.dll!InternetOpenUrlA 42C306DD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1420] kernel32.dll!ReadFile 7C80180E 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll

Bear07 · Jun 5, 2007

Continuing results from GMER Rootkit scan:

.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1420] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1420] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1420] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1420] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1420] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1420] kernel32.dll!WriteFile 7C810D87 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1420] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1420] kernel32.dll!PeekNamedPipe 7C85F90F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1420] kernel32.dll!WinExec 7C86136D 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1420] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1420] WS2_32.dll!select 71AB2DC0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1420] WS2_32.dll!socket 71AB3B91 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1420] WS2_32.dll!bind 71AB3E00 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1420] WS2_32.dll!send 71AB428A 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1420] WS2_32.dll!recv 71AB615A 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1420] WININET.dll!InternetReadFile 42C2ABBC 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1420] WININET.dll!InternetOpenA 42C2C869 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1420] WININET.dll!InternetOpenUrlA 42C306DD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\explorer.exe[1848] kernel32.dll!ReadFile 7C80180E 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\explorer.exe[1848] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\explorer.exe[1848] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\explorer.exe[1848] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\explorer.exe[1848] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\explorer.exe[1848] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\explorer.exe[1848] kernel32.dll!WriteFile 7C810D87 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\explorer.exe[1848] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\explorer.exe[1848] kernel32.dll!PeekNamedPipe 7C85F90F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\explorer.exe[1848] kernel32.dll!WinExec 7C86136D 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\explorer.exe[1848] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\explorer.exe[1848] WININET.dll!InternetReadFile 42C2ABBC 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\explorer.exe[1848] WININET.dll!InternetOpenA 42C2C869 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\explorer.exe[1848] WININET.dll!InternetOpenUrlA 42C306DD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\explorer.exe[1848] WS2_32.dll!select 71AB2DC0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\explorer.exe[1848] WS2_32.dll!socket 71AB3B91 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\explorer.exe[1848] WS2_32.dll!bind 71AB3E00 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\explorer.exe[1848] WS2_32.dll!send 71AB428A 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\explorer.exe[1848] WS2_32.dll!recv 71AB615A 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2080] kernel32.dll!ReadFile 7C80180E 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2080] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2080] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2080] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2080] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2080] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2080] kernel32.dll!WriteFile 7C810D87 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2080] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2080] kernel32.dll!PeekNamedPipe 7C85F90F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2080] kernel32.dll!WinExec 7C86136D 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2080] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2080] WS2_32.dll!select 71AB2DC0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2080] WS2_32.dll!socket 71AB3B91 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2080] WS2_32.dll!bind 71AB3E00 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2080] WS2_32.dll!send 71AB428A 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2080] WS2_32.dll!recv 71AB615A 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2080] WININET.dll!InternetReadFile 42C2ABBC 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2080] WININET.dll!InternetOpenA 42C2C869 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2080] WININET.dll!InternetOpenUrlA 42C306DD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[2504] kernel32.dll!ReadFile 7C80180E 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[2504] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[2504] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[2504] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[2504] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[2504] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[2504] kernel32.dll!WriteFile 7C810D87 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[2504] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[2504] kernel32.dll!PeekNamedPipe 7C85F90F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[2504] kernel32.dll!WinExec 7C86136D 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[2504] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[2504] WS2_32.dll!select 71AB2DC0 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[2504] WS2_32.dll!socket 71AB3B91 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[2504] WS2_32.dll!bind 71AB3E00 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[2504] WS2_32.dll!send 71AB428A 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[2504] WS2_32.dll!recv 71AB615A 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[2504] WININET.dll!InternetReadFile 42C2ABBC 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[2504] WININET.dll!InternetOpenA 42C2C869 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[2504] WININET.dll!InternetOpenUrlA 42C306DD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll

---- Devices - GMER 1.0.12 ----

Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE [F11F78A0] vsdatant.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_CLOSE [F11F78A0] vsdatant.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CONTROL [F11F78A0] vsdatant.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL [F11F78A0] vsdatant.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_CLEANUP [F11F78A0] vsdatant.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE [F11F78A0] vsdatant.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSE [F11F78A0] vsdatant.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CONTROL [F11F78A0] vsdatant.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [F11F78A0] vsdatant.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CLEANUP [F11F78A0] vsdatant.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_CREATE [F11F78A0] vsdatant.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_CLOSE [F11F78A0] vsdatant.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CONTROL [F11F78A0] vsdatant.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL [F11F78A0] vsdatant.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_CLEANUP [F11F78A0] vsdatant.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE [F11F78A0] vsdatant.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CLOSE [F11F78A0] vsdatant.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CONTROL [F11F78A0] vsdatant.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL [F11F78A0] vsdatant.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CLEANUP [F11F78A0] vsdatant.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CREATE [F11F78A0] vsdatant.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CLOSE [F11F78A0] vsdatant.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_DEVICE_CONTROL [F11F78A0] vsdatant.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_INTERNAL_DEVICE_CONTROL [F11F78A0] vsdatant.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CLEANUP [F11F78A0] vsdatant.sys

---- Files - GMER 1.0.12 ----

File C:\EPIC\
File C:\epson\
File C:\epson10464\
File C:\FreeFromHoverAdGernerator\
File C:\GODADDY\
File C:\Hewlett-Packard\
File C:\HP\
File C:\Internet Marketing Center\
File C:\KEITH\
File C:\Pictures\

---- EOF - GMER 1.0.12 ----

Mr_JAk3 · Jun 6, 2007

Hmm ok...

those emails that you're receiving may just be spam.

Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
- Extended (if available otherwise Standard)
- Scan Options:
- Scan Archives
  Scan Mail Bases
Click OK
Now under select a target to scan:
- Select My Computer
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
- Now click on the Save as Text button:
Save the file to your desktop.
Copy and paste that information in your next post.

Bear07 · Jun 7, 2007

Here are the results from the Kaspersky scan:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Wednesday, June 06, 2007 7:36:24 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 6/06/2007
Kaspersky Anti-Virus database records: 341017
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\

Scan Statistics:
Total number of scanned objects: 128501
Number of viruses found: 10
Number of infected objects: 81 / 0
Number of suspicious objects: 0
Duration of the scan process: 03:11:13

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\00bfe20763eace130ac012a687d1ceeb_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\019d57a528e34e8eb77304a7e3295bfc_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\024ceed2268dbcd60d59560010950c45_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\026367cbc1c04f38a043b27908883edc_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\077b71d4033ceafc908a3e5f1b517cf5_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0795aa8e4b5a7a2676eb5a097a9c9a73_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0889754a8e5ec9298837dc2b744f2538_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\094c287d7dc5cab53a0caabb0d299a1d_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0ec5198c5788c9e2f0f5c66716ce271c_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\12a0369c00bf804c8034139eba1ca6f9_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\18f54700fc559aa8f41642eac1290f11_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\19aa6946a42a4f0a20c4aac7f2b881f5_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\19b52e4be6c0fd066de49d67aca3d223_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1ab46c95911a4f3bbc62c780a614a38b_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1abaaadf3732708d59534f098fb005a4_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1f8043a9fbcc1960b6250f37ed3d7a24_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\20225ebb86a88737def4c99819dc9a80_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2054eefc25b385a9bea92837e625da0a_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2056c85330b45c9f14a8f05b43b4798f_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\25b53345ae251bff2db8aacd85fa7f87_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\29093b5ea3ddc0b22c51eb6cd85c3a76_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\29a0c4045a590d609a72faf57d26d511_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2a3625aecfe9f1ae6cb811230b3243d6_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2e1ef5583d5ef81a1b6b23ac14f0562b_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2f8c6d433942be9531ded5cd037ae5c2_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\314fd92dcdc43ebed3d0f0a388b979a7_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3206a5c7255d27d9b076da6de414300e_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\343e2fa7e4d7da12e0d87a2e051bb432_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\35845ad3609f16d425f5ffaf44414207_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\37edebef58223de2d0c3a5d535505999_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\38743915c704c18b405bb61c12e07f00_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\38e05e31758b1910f97c9d87ef74fd2c_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\390df13bcd06d16433fcc20f0f877e84_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3bc789238f0f2c447138ab69d6a63840_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3d1dc15c6ea837ad16aa13804123eb29_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3fabfca06d7d4641a5bc12f0db5ab099_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4191ba7d28d451232afc0e08a638b649_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\42edaac0b23562baae4c209b6e6b4e5e_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\47146a064c1f5fa89eeb96b49c6c6e9e_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4750deb12dff978d2201b33cca9299f1_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\48abb6ea40ba7b72da2f4063f47d88be_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\49a61815ea0b5325e206b34293269ae9_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4a3669eb8a2faad58fc2b1d67bc0cd77_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4cf9519f39c885cce1830a3532725f07_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4d560896007048f3c6fd8b4095f4ebba_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4ece9238ab42fd141bbc93a8aa219eed_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\500d70b43916af3e60c86599fac69ce1_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\513943e3137635dc3fe19094efff6b14_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\530f6e59fee4d870846dbf9b1870df8a_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5356a02e262604ee3a30a366bd544cc9_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\55cbb4161a6eac34eca2b47ca3ac61d5_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5639b7bc5eba763b85cd0fd7de496a13_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\563b1d192446150791d8c965468a942c_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\57ba7073eb72cd9832b151098f70856b_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5a29f04eede5633d7635cbf1d762f078_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5b48ae590daebc432835cac9d49c89f7_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5c5809fb46d6115911f5dda30edbe177_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5cb699b1f5f84577109c2ef3d669b97d_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5cc93b79b56f8b37648cee2d3653aef6_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5d013971d4639ccd4b53dfe63de53c40_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5d1bb0a98e97682b63e2fd3126d48d97_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5d7aa7865950f3ae849e7d57749808b0_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\601c25188c79231b5de5521e5c1ea40c_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\60bca84f4db6f692ad95353a9d1e884f_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\61080f28d4b88c147a0832fd47bf0dce_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\628ab0a7dd4f510446d7cf4019017f9a_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\63cb52a3b1fe2380808872ddb49aaf09_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6587e29a0a418e98647e8f852e73d915_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6654836fb73dc437d153383f70877220_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\665ebacb8bfc90e1d7c7b289cdc44dca_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\686d36f72609537ad7c95f0bba408e46_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6a2184ca3da6345f2f6a5da99e884f20_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6b35f1bc9e704d06e6225d3d78841043_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6b84a4f64c0205acee620b79944c38e1_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6c4e79d1565acec3d8606180fec8e825_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6dfb8fc176d61567722369c9f7cd62f5_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6e87a9ddd193f33271277f1ff9cd1fe1_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6f77be84e32dddb4c50902df997e18a6_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\70379aea12474f013356b6cd9b0bef7c_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\73a597126501f566f62125d2f099d631_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\73c539cf92fa948fa7b22bf777de454d_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\73f96f552b2a87ab76470650e35953eb_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7a518c7433d3d8d2d329b61586e16958_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7b241770916e4cadc0a4a7fa6e011bf8_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7c43764e96552134e47cd95355d2e511_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7d2e6a2e86d0233cd00759c00fec2682_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7d31602dd5f8117dab83cb1f6c2e9f9c_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7de79f54a84a05fef13651f9e28b6d27_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7f1f6d0af764a413411abdb1588bc4e1_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7fc7a2cc3bed504593378d911929b20a_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\80c43cda4ec36411fc6091911fef27df_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\859aeece058261eba619c4c9d9f68edc_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\863e450e10b60a645bc5baa9b1854c58_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\87281d21d1c40686f49cfa54b5038f26_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\880e1f77f955b2270224c40b6a28e48c_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8821999353d1c68b0bb69e1810ba20d0_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8da6fcba46af2d5850137f1727e6ec3f_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8e72b4891d8dc0727bd31cd35d9b40a7_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8f9b9fcf79ec3b922b59961bec71b99a_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9259181cbb18b6a147fa9f337f8e7228_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped

Bear07 · Jun 7, 2007

Continuing Kaspersky results:

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\941ef9ec8d1ce3bf8c7c019973acc7cf_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\94ae041365cfdf9f2dbbd98f53f1e250_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9617f8c41223cd3db1768136b383a732_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\96ab6ae8f8314efd84534a1f5c22b113_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9aaad20fe9fca07a2e0ca99d7f8dd4b7_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9ce735565bf78a62e7622d3ff74379fa_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9e64a91b5e06915bda262e17a3377093_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9e7fb38af69bcbb362720947f6ee7de9_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a115bb55f9f3a44df546767b073a1877_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a11cef9b12271e3e1efbc518e770e2f7_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a15f041291df948af25f8dc27322be70_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a220d8e08b43c1be790ff146b25ed774_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a245c235bae1159028afc99cb9ca354d_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a3ae8d0a06a1b3f8525eb7d8d263e12d_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a3ffe166e93fa6140b0b595da5ce254d_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a4d581731dd71e842c8ebfa8ba7125c5_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a6a0f0db3198681a0eae70d1b73b0ffd_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a6b7cd0ff54db905290a066d9b61a118_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a6d4c71f2597913662b27452ac0b66d5_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a754aae5db6039075ac0ef11b49ba106_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a8ccb06c5d803ce0de76789eae761cf7_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a91e8c537c146cdfd6a8af03b1551b07_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a959caaf32ea9f3c3de714d23426ccb2_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\aab0cde99fe47faa0b545aded951f915_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\aaff3bda7bb3ea203aacf4ebfb365193_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ab2735a92577e2fbb6dec4dd996d910a_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ad664eac6338e5a7b66335a26cdcb8d7_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b31311d7e3b89d2901598ddfd2bcb746_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b4af671c495469c8e16b93adbb2c7a28_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b56f12225301f1db1cf1bb28abf65442_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b598dbc3dc350ffc91f49b34a4615665_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b903435bb189118728666499d4f0e20f_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b9a9008209dc37c65092359787e8aded_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bbf518dd825b095057b8cff4aa21bbef_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c2e6782d95832a749ed8fd18f8456cfe_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c324db7d77f9efb5cd22d4f849036b22_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c3f4b604c0f6e91bce2b96f0d1c38742_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c4bdc087f9e125ded2665347fe4ba5d5_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c4f0d789989a45c425ab39fb3c8a569b_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c6e985ef57522deb46df9ff0428eefb6_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c702b4a01ef4d7bfeb5175d8295faf71_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c71195ca44d3d3d2a23a678c76d3adaa_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c7461992e132196383180f8da6902a42_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c81a4871a7da4434825354009aea78fa_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c85a45606076e1085ecccb2549fcf005_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c8f2871648a1b7bc2646481b628f718c_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cbc7794a5ed173d7854905e35e24e1fb_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cc532f28e875e66f211ec116bb5e0212_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ccfdf97686fcb4aab956e46dfa5a51d6_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cf12dfec9d728c86269aa22388e8a23b_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d0bdd874c86879e1364e6d57a1d4a462_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d3c74c51664d65b9b4ee76bed4febaed_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d3d1fbd79c38c8db47fec4f0c1d0a5fa_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d994b852d03d1e9acbbe16a17eb45f68_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\daa1d4e2a4e7bab936785c14449b4f5f_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\dad29635b4dd796a6478881a9db049e4_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\dae515cf34aef357c5e0030787330b87_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\db5daa364054c0fd6d739a3667be9e0c_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\dc70940ed5a0a9382bb1cf3e5e4531ac_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e1ed72663fffa22a24667e2b638c7735_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e1f806e9d0b8a4dea29158c88126ecfc_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e72adb61e306e75716bedb873c7ae1c0_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e7c9c45803c39db3f7d52a20650a80d1_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e95752c9ec4ca303ed777165b098b945_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ec1020649880d9e18550550b5af1d929_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ec2f68cab5bc2d9fb4737c5a1494b082_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ee3b23cb11a67d6c979c3ebb7c43b9d2_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\eef1b6aeb2f141f223413d81ea989125_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f1a5f50ec4c284599ba7c9f115d5ee88_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f287e7e4e471e6b86cf11100a81fb7d5_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f4a0f79993c5aa736f195858aef3ff2b_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f52139807405a22a95b1380c4d555264_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f6de43da9655f890fc38fa3fc9923be8_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f81fafcc3e869a634de44e82d293847d_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\fa3903947f9d1098c0e2879dae165d19_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\fa9df10af101926575d61caa70b4c040_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\fd11eab7b604ae2aa33ba9adca4abd07_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\fd664cba0a65019740f6dc156d5e89cd_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ff3ac642cd86f903f9bdfcbd88926a62_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\fff90c2285427d685176350b09750f66_c3bd601f-f4a7-4eff-9579-d459301f721c Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-12082006-095706.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\BOPDATA\_Date-20070606_Time-160829093_EnterceptExceptions.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\BOPDATA\_Date-20070606_Time-160829093_EnterceptRules.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Db\Agent_MOE1.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Db\PrdMgr_MOE1.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\AccessProtectionLog.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\BufferOverflowProtectionLog.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\OnAccessScanLog.txt Object is locked skipped
C:\Documents and Settings\HTH\.housecall6.6\Quarantine\498c7bba-7ac4e5b0.bac_a01640/GetAccess.class Infected: Trojan.Java.ClassLoader.c skipped
C:\Documents and Settings\HTH\.housecall6.6\Quarantine\498c7bba-7ac4e5b0.bac_a01640/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify skipped
C:\Documents and Settings\HTH\.housecall6.6\Quarantine\498c7bba-7ac4e5b0.bac_a01640/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped
C:\Documents and Settings\HTH\.housecall6.6\Quarantine\498c7bba-7ac4e5b0.bac_a01640/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v skipped
C:\Documents and Settings\HTH\.housecall6.6\Quarantine\498c7bba-7ac4e5b0.bac_a01640 ZIP: infected - 4 skipped
C:\Documents and Settings\HTH\.housecall6.6\Quarantine\498c7bba-7ac4e5b0.bac_a01640 CryptFF.b: infected - 4 skipped
C:\Documents and Settings\HTH\.housecall6.6\Quarantine\classload.jar-1910af14-4e288d7e.zip.bac_a01640/GetAccess.class Infected: Trojan.Java.ClassLoader.c skipped
C:\Documents and Settings\HTH\.housecall6.6\Quarantine\classload.jar-1910af14-4e288d7e.zip.bac_a01640/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify skipped
C:\Documents and Settings\HTH\.housecall6.6\Quarantine\classload.jar-1910af14-4e288d7e.zip.bac_a01640/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped
C:\Documents and Settings\HTH\.housecall6.6\Quarantine\classload.jar-1910af14-4e288d7e.zip.bac_a01640/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v skipped
C:\Documents and Settings\HTH\.housecall6.6\Quarantine\classload.jar-1910af14-4e288d7e.zip.bac_a01640 ZIP: infected - 4 skipped
C:\Documents and Settings\HTH\.housecall6.6\Quarantine\classload.jar-1910af14-4e288d7e.zip.bac_a01640 CryptFF.b: infected - 4 skipped
C:\Documents and Settings\HTH\Application Data\Thornsoft Development\ClipMate7\BlobBlob.blb Object is locked skipped
C:\Documents and Settings\HTH\Application Data\Thornsoft Development\ClipMate7\BlobBlob.dat Object is locked skipped
C:\Documents and Settings\HTH\Application Data\Thornsoft Development\ClipMate7\BlobBlob.idx Object is locked skipped
C:\Documents and Settings\HTH\Application Data\Thornsoft Development\ClipMate7\BlobJPG.blb Object is locked skipped
C:\Documents and Settings\HTH\Application Data\Thornsoft Development\ClipMate7\BlobJPG.dat Object is locked skipped
C:\Documents and Settings\HTH\Application Data\Thornsoft Development\ClipMate7\BlobJPG.idx Object is locked skipped
C:\Documents and Settings\HTH\Application Data\Thornsoft Development\ClipMate7\blobpng.blb Object is locked skipped
C:\Documents and Settings\HTH\Application Data\Thornsoft Development\ClipMate7\blobpng.dat Object is locked skipped
C:\Documents and Settings\HTH\Application Data\Thornsoft Development\ClipMate7\blobpng.idx Object is locked skipped

Bear07 · Jun 7, 2007

Continuing Kaspersky results:

C:\Documents and Settings\HTH\Application Data\Thornsoft Development\ClipMate7\BlobTXT.blb Object is locked skipped
C:\Documents and Settings\HTH\Application Data\Thornsoft Development\ClipMate7\BlobTXT.dat Object is locked skipped
C:\Documents and Settings\HTH\Application Data\Thornsoft Development\ClipMate7\BlobTXT.idx Object is locked skipped
C:\Documents and Settings\HTH\Application Data\Thornsoft Development\ClipMate7\clip.dat Object is locked skipped
C:\Documents and Settings\HTH\Application Data\Thornsoft Development\ClipMate7\clip.idx Object is locked skipped
C:\Documents and Settings\HTH\Application Data\Thornsoft Development\ClipMate7\ClipData.dat Object is locked skipped
C:\Documents and Settings\HTH\Application Data\Thornsoft Development\ClipMate7\ClipData.idx Object is locked skipped
C:\Documents and Settings\HTH\Application Data\Thornsoft Development\ClipMate7\coll.dat Object is locked skipped
C:\Documents and Settings\HTH\Application Data\Thornsoft Development\ClipMate7\coll.idx Object is locked skipped
C:\Documents and Settings\HTH\Application Data\Thornsoft Development\ClipMate7\dbisam.lck Object is locked skipped
C:\Documents and Settings\HTH\Application Data\Thornsoft Development\ClipMate7\LOG\LOG_2007-06-06.TXT Object is locked skipped
C:\Documents and Settings\HTH\Application Data\Thornsoft Development\ClipMate7\TEMP\5000.cm_dat Object is locked skipped
C:\Documents and Settings\HTH\Application Data\Thornsoft Development\ClipMate7\TEMP\5000.cm_idx Object is locked skipped
C:\Documents and Settings\HTH\Application Data\Thornsoft Development\ClipMate7\TEMP\dbisam.lck Object is locked skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/love_me_now.exe Infected: Email-Worm.Win32.Bagle.ae skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNNAMED/Message.scr Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNNAMED/[From "N/A" <jcvojfnl@rdsnet.ro>][D ... /[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 21:46:45 +0800]/Common.exe Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNNAMED/[From "N/A" <jcvojfnl@rdsnet.ro>][Date ... /[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 21:46:45 ... /mplay.exe Infected: Email-Worm.Win32.Bagle.ae skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNNAMED/[From "N/A" <jcvojfnl@rdsn ... /[F ... /[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 15:01:32 +0800]/love_me.exe Infected: Email-Worm.Win32.Bagle.ae skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNNAMED/[From "N/A" <jcvojfnl@rdsn ... /[From ... /[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 15:01: ... /Details.exe Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "Goldie Egan" <Earnest ... ... /[From "Addr" <addr6@xinul.com>][Date Wed, 07 Mar 2007 23:15:19 +0800]/xxxporno.exe Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "Goldie Egan" <Earnest ... /[Fr ... /[From "Addr" <addr6@xinul.com>][Date Wed, 07 Mar 2007 23:15:19 ... /mplay.exe Infected: Email-Worm.Win32.Bagle.ae skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "Goldie ... /[From "Angelique ... /[From "Addr" <addr6@xinul.com>][Date Thu, 08 Mar 2007 00:44:47 +0800]/mplay.exe Infected: Email-Worm.Win32.Bagle.ae skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "Goldie ... /[From "Angelique K ... /[From "Addr" <addr6@xinul.com>][Date Thu, 08 Mar 2007 00:44 ... /MoreInfo.exe Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "Goldie ... /[From "Angelique K ... /[From "Addr" <addr6@xinul.com>][Date Thu, 08 Mar 2007 00 ... /love_me_now.exe Infected: Email-Worm.Win32.Bagle.ae skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "Goldie ... /[From "Angelique K ... /[From "Addr" <addr6@xinul.com>][Date Thu, 08 Mar 2007 ... /XXX_livebabes.scr Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "Goldie . ... /[From "BB&T" <customerservice-id9777255186162ib@bbt.com>][Date Thu, 8 Mar 2007 10:07:38 -0500]/html Infected: Trojan-Spy.HTML.Bankfraud.ra skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[F ... /[From "BB&T" <customerservice-id9777255186162ib@bbt.com>][Date Thu, 8 Mar 2007 10:07:38 -0500]/cytochemistry.gif Infected: Trojan-Spy.HTML.Bankfraud.ri skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "G ... /[From Google Alerts <googlealerts-noreply@google.com>][Date Sat, 10 Mar 2007 00:36:12 -0800 ( ... /UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "G ... /[From Google Alerts <googlealerts-noreply@google.com>][Date Sat, 10 Mar 2007 00:36:12 -0800 (PST ... /html Infected: Trojan-Spy.HTML.Bankfraud.ri skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "G ... /[From Google Alerts <googlealerts-noreply@google.com>][Date Sat, 10 Mar 2007 00:36:12 -0800 (PST)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "G ... /[From "PMattie ... /[From "Basil U. Goff" <clxbml@mwob.org>][Date Mon, 12 Mar 2007 17:00:07 +0300]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "G ... /[Fro ... /[From "BB&T" <service-num3486624311010ib@bbt.com>][Date Mon, 12 Mar 2007 12:56:05 - ... /UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "G ... /[Fro ... /[From "BB&T" <service-num3486624311010ib@bbt.com>][Date Mon, 12 Mar 2007 12:56:05 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From " ... /[From "GameStop Weekend Specials" <gsnews@email.ebgames.com>][Date Fri, 23 Mar 2007 01:00:00 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

Bear07 · Jun 7, 2007

Continuing Kaspersky results:

C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... ... /[From "Mason Adkins" <puttranspo ... /[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 04:23:34 +0800]/UNNAMED Infected: Email-Worm.Win32.Bagle.ae skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... ... /[From "Mason Adkins" <puttranspo ... /[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 04:23:55 + ... /UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... ... /[From "Mason Adkins" <puttranspo ... /[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 04:23:55 +0800]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... ... /[From "Mason Adkins" <puttransportesmoltedodew@transportesmoltedo.cl>][Date Mon, 5 Mar 2007 19:45:05 +0000]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "G .. ... /[From ... ... /[From Bvlgari Watches <dfranco@post.com>][Date Mon, 05 Mar 2007 20:59:57 +0300]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "G .. ... /[From ... /[From "kkk MacDermid" <MacDermid@agrimesh.com>][Date Mon, 5 Mar 2007 19:03:32 +0100]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "G .. ... /[From Google Al ... /[From "Maryland" <wkdigxer@tpnet.pl>][Date Mon, 5 Mar 2007 17:55:25 -0100]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "G .. ... /[From Google Alerts <googlealerts-noreply@google.com>][Date Sat, 24 Mar 2007 07:43:10 -0700 (PDT)]/html Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "G ... /[From "PMattie YRichmond" <uyxpbsbxo@glenwoodequipment.com>][Date Thu, 08 Mar 2007 21:44:32 + .. ... /html Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "G ... /[From "PMattie YRichmond" <uyxpbsbxo@glenwoodequipment.com>][Date Thu, 08 Mar 2007 21:44:32 + ... /UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "G ... /[From "PMattie YRichmond" <uyxpbsbxo@glenwoodequipment.com>][Date Thu, 08 Mar 2007 21:44:32 +0600]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "Goldie ... ... ... / ... /[From SitePro News <spn-h2@sitepronews.com>][Date Thu, 08 Mar 2007 04:30:00 -0500]/html Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "Goldie ... ... ... /[From "Brittni Danika" <myked58bnp@gloryroad.net>][Date Thu, 08 Mar 2007 10:57:02 +0100]/html Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "Goldie ... ... /[From Gwendoline Sullivan <rdphp@newmancapital.com>][Date Thu, 8 Mar 2007 14:36:06 +0530]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "Goldie ... /[From "A ... ... /[From "Area Basic" <tiqznjuwl@net.tr>][Date Thu, 8 Mar 2007 09:35:13 -0200]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "Goldie ... /[From "A ... /[From "Apps" <qifococfha@bostonpilot.com>][Date Thu, 8 Mar 2007 08:20:05 +0800]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "Goldie ... /[From "Angeli ... /[From "Center" <kobuttu@brimson.net>][Date Wed, 7 Mar 2007 15:33:30 +0500]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "Goldie ... /[From "Angelique K ... /[From "Addr" <addr6@xinul.com>][Date Thu, 08 Mar 2007 00:59:44 +0800]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "Goldie ... /[From "Angelique K ... /[From "Addr" <addr6@xinul.com>][Date Thu, 08 Mar 2007 00:44:47 +0800]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "Goldie ... /[From "Angelique Koch" <dixtuchimportbos@tuchimport.de>][Date Wed, 7 Mar 2007 14:12:39 -0060]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "Goldie Egan" <Earnest ... /[Fr ... /[From "Addr" <addr6@xinul.com>][Date Wed, 07 Mar 2007 23:15:19 +0800]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "Goldie Egan" <Earnest ... /[From "madethe" <qigzxvvlnlw@cimco.net>][Date Wed, 7 Mar 2007 10:46:17 -05-30]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNN ... /[From "Goldie Egan" <EarnestineKearney@soyouvebeendumped.every1.net>][Date Tue, 6 Mar 2007 23:39:59 -0500 (EST)]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped

Bear07 · Jun 7, 2007

Continuing Kaspersky results:

C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNNAMED/[From " ... /[From "pancho guenever ... /[From Sex can <bfranks@witty.com>][Date Wed, 07 Mar 2007 05:53:07 +0300]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNNAMED/[From " ... /[From "pancho guenevere" <barbab ... /[From Hockey" <fix@orpea.net>][Date 7 Mar 2007 02:16:47 +0100]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNNAMED/[From " ... /[From "pancho guenevere" <barbabassancho@physiqueproducts.com>][Date Wed, 7 Mar 2007 02:19:49 +0900]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNNAMED/[From "N/A" ... /[From "Vowels G. Squirrelling" <iceman@glass-island.com>][Date Tue, 06 Mar 2007 16:20:01 +0000]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNNAMED/[From "N/A" ... /[From Google Alerts <googlealerts-noreply@google.com>][Date Mon, 05 Mar 2007 23:13:29 -0800 (PST)]/html Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNNAMED/[From "N/A" <jcvojfnl@rdsn ... /[From ... /[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 15:01:32 +0800]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNNAMED/[From "N/A" <jcvojfnl@rdsn ... /[From --Mark--Hendricks-- <mph@hunteridge.com>][Date Tue, 6 Mar 2007 08:51:05 -0500]/text Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNNAMED/[From "N/A" <jcvojfnl@rdsnet.ro>][Date ... /[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 21:46:45 +0800]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNNAMED/[From "N/A" <jcvojfnl@rdsnet.ro>][Date Tue, 6 Mar 2007 13:56:06 -0200]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED/[From "Addr" <addr6@xinul.com>][Date Tue, 06 Mar 2007 23:13:57 +0800]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED/[From "Sexy by" <frrnbyimaa@t-dialin.net>][Date Tue, 6 Mar 2007 16:14:00 -0100]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED/[From "Edgar Mccullough" <wodistillery@freedombound.com>][Date Tue, 6 Mar 2007 05:40:08 +0200]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items/[From "Hope Connell" <ChandraDick@cekakhanafi.com>][Date Mon, 5 Mar 2007 21:47:58 -0500 (EST)]/UNNAMED Infected: Email-Worm.Win32.Bagle.fl skipped
C:\Documents and Settings\HTH\Application Data\Thunderbird\Profiles\qzv4a2ng.default\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items Mail Berkeley mbox: infected - 57 skipped
C:\Documents and Settings\HTH\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\HTH\Local Settings\Application Data\Identities\{07EA8992-70AD-46A3-A05B-4070923F039A}\Microsoft\Outlook Express\Deleted Items.dbx/[From "Branch Banking and Trust" <services-0355050852541ib@bbt.com>][Date Fri, 23 Mar 2007 02:16:28 -0400 (EDT)]/UNNAMED/html Infected: Trojan-Spy.HTML.Bankfraud.ra skipped
C:\Documents and Settings\HTH\Local Settings\Application Data\Identities\{07EA8992-70AD-46A3-A05B-4070923F039A}\Microsoft\Outlook Express\Deleted Items.dbx/[From "Branch Banking and Trust" <services-0355050852541ib@bbt.com>][Date Fri, 23 Mar 2007 02:16:28 -0400 (EDT)]/UNNAMED/colon.gif Infected: Trojan-Spy.HTML.Bankfraud.ri skipped
C:\Documents and Settings\HTH\Local Settings\Application Data\Identities\{07EA8992-70AD-46A3-A05B-4070923F039A}\Microsoft\Outlook Express\Deleted Items.dbx/[From "Branch Banking and Trust" <services-0355050852541ib@bbt.com>][Date Fri, 23 Mar 2007 02:16:28 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped
C:\Documents and Settings\HTH\Local Settings\Application Data\Identities\{07EA8992-70AD-46A3-A05B-4070923F039A}\Microsoft\Outlook Express\Deleted Items.dbx Mail MS Outlook 5: infected - 3 skipped
C:\Documents and Settings\HTH\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\HTH\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\HTH\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\HTH\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{9B70E510-29A2-44BB-A7B4-4A62E63B2EED} Object is locked skipped
C:\Documents and Settings\HTH\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\HTH\Local Settings\History\History.IE5\MSHist012007060620070607\index.dat Object is locked skipped
C:\Documents and Settings\HTH\Local Settings\Temp\~DF3D9.tmp Object is locked skipped
C:\Documents and Settings\HTH\Local Settings\Temp\~DF7D9E.tmp Object is locked skipped
C:\Documents and Settings\HTH\Local Settings\Temp\~DF84ED.tmp Object is locked skipped
C:\Documents and Settings\HTH\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\HTH\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\HTH\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\HTH\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\HTH\UserData\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\ESftp\esftpv42.exe/data0019/NHInstall.exe Infected: not-a-virus:AdWare.Win32.NavExcel.d skipped
C:\ESftp\esftpv42.exe/data0019/v2.0.2.cab/NHUninstaller.exe Infected: not-a-virus:AdWare.Win32.NavExcel.d skipped
C:\ESftp\esftpv42.exe/data0019/v2.0.2.cab/NHelper.dll Infected: not-a-virus:AdWare.Win32.NavExcel.d skipped
C:\ESftp\esftpv42.exe/data0019/v2.0.2.cab/NHUpdater.exe Infected: not-a-virus:AdWare.Win32.NavExcel.b skipped
C:\ESftp\esftpv42.exe/data0019/v2.0.2.cab Infected: not-a-virus:AdWare.Win32.NavExcel.b skipped
C:\ESftp\esftpv42.exe/data0019 Infected: not-a-virus:AdWare.Win32.NavExcel.b skipped
C:\ESftp\esftpv42.exe Inno: infected - 6 skipped
C:\Program Files\ASUS\Probe\Record\200766 Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{FFA5CE3D-2147-46EA-9F22-0D54AD76096F}\RP1632\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
C:\WINDOWS\Internet Logs\MOE1.ldb Object is locked skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{2CF12902-96F7-4B35-9295-D6634A76DC56}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\spool\PRINTERS\FP00000.SHD Object is locked skipped
C:\WINDOWS\system32\spool\PRINTERS\FP00000.SPL Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\ZLT076d0.TMP Object is locked skipped
C:\WINDOWS\Temp\ZLT076d3.TMP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

Mr_JAk3 · Jun 7, 2007

OK most of the infections were in Thunderbirds messages. YOu might want to do some cleaning there...

Generate a HijackThis Startup list:
Open HijackThis:

Click on "Open the Misc Tools Section"
Check the following boxes to the right of "Generate StartupList Log":
- List also minor sections (Full)
- List empty sections (Complete)
Click "Generate StartupListLog"
Click "Yes" at the prompt.
A Notepad window will open with the contents of the HijackThis Startup list displayed
Copy & Paste that log to here

Bear07 · Jun 7, 2007

Here's the HijackThis Startup list:

StartupList report, 6/7/2007, 2:18:52 PM
StartupList version: 1.52.2
Started from : C:\Program Files\hijackthis\hijackthis\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v7.00 (7.00.6000.16441)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\anvshell.exe
C:\Program Files\RAMpage\RAMpage.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\ClipMate7\clipmate.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Tablet.exe
C:\Program Files\Wacom\TabUserW.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBNA.EXE
C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S30RP1.EXE
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program Files\hijackthis\hijackthis\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\HTH\Start Menu\Programs\Startup]
SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe

Shell folders AltStartup:
*Folder not found*

User shell folders Startup:
*Folder not found*

User shell folders AltStartup:
*Folder not found*

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
TabUserW.lnk = C:\Program Files\Wacom\TabUserW.exe

Shell folders Common AltStartup:
*Folder not found*

User shell folders Common Startup:
*Folder not found*

User shell folders Alternate Common Startup:
*Folder not found*

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
*Registry value not found*

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

CamMonitor = C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
Share-to-Web Namespace Daemon = C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
ASUS Probe = C:\Program Files\ASUS\Probe\AsusProb.exe
NvCplDaemon = RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
nwiz = nwiz.exe /install
anvshell = anvshell.exe
LiveNote = livenote.exe
RAMpage = "C:\Program Files\RAMpage\RAMpage.exe" U=1 M=28 T=4 LW P="C:\Program Files\RAMpage\RAMpageConfig.exe"
ShStatEXE = "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
McAfeeUpdaterUI = "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
SunJavaUpdateSched = "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
Network Associates Error Reporting Service = "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
TkBellExe = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
Windows Defender = "C:\Program Files\Windows Defender\MSASCui.exe" -hide
ZoneAlarm Client = "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

ClipMate7 = C:\Program Files\ClipMate7\clipmate.exe
ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
WMPNSCFG = C:\Program Files\Windows Media Player\WMPNSCFG.exe
SpybotSD TeaTimer = C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
EPSON Stylus Photo R260 Series = C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBNA.EXE /FU "C:\WINDOWS\TEMP\E_SA7.tmp" /EF "HKCU"

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

[OptionalComponents]
*No values found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .COM:
HKEY_CLASSES_ROOT\comfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .SCR:
HKEY_CLASSES_ROOT\AutoCADLTScript\shell\open\command

(Default) = C:\WINDOWS\NOTEPAD.EXE "%1"

--------------------------------------------------

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = C:\WINDOWS\system32\mshta.exe "%1" %*

--------------------------------------------------

File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] *
StubPath = C:\WINDOWS\system32\ieudinit.exe

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

[{44BBA851-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection %SystemRoot%\INF\wpie4x86.inf,PerUserStub

[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = C:\WINDOWS\system32\ie4uinit.exe -BaseSettings

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
StubPath = C:\WINDOWS\System32\Rundll32.exe C:\WINDOWS\System32\mscories.dll,Install

--------------------------------------------------

Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=*INI section not found*
run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

Bear07 · Jun 7, 2007

Continuing HijackThis Startup list:

--------------------------------------------------

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in C:\WINDOWS
- .reg open command is normal (regedit.exe %1)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registry Editor'

Registry check passed

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
SpywareGuard Download Protection - C:\Program Files\SpywareGuard\dlprotect.dll - {4A368E80-174F-4872-96B5-0B27DDD11DB2}
(no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
(no name) - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
(no name) - c:\program files\google\googletoolbar3.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7}
(no name) - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll - {AE7CD045-E861-484f-8273-0445EE161910}

--------------------------------------------------

Enumerating Task Scheduler jobs:

AppleSoftwareUpdate.job
MP Scheduled Scan.job

--------------------------------------------------

Enumerating Download Program Files:

[{00000075-9980-0010-8000-00AA00389B71}]
CODEBASE = http://codecs.microsoft.com/codecs/i386/voxacm.CAB

[QuickTime Object]
InProcServer32 = C:\Program Files\QuickTime\QTPlugin.ocx
CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab

[CKAVWebScan Object]
InProcServer32 = C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
CODEBASE = http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab

[Windows Genuine Advantage Validation Tool]
InProcServer32 = C:\WINDOWS\system32\legitcheckcontrol.dll
CODEBASE = http://go.microsoft.com/fwlink/?linkid=39204

[LPViewer Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\LPControl.dll
CODEBASE = http://www.iseemedia.com/activex/LPControl.cab

[MUWebControl Class]
InProcServer32 = C:\WINDOWS\system32\muweb.dll
CODEBASE = http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1126413452031

[{77DD44BF-551D-4E3C-82CD-D637D5018D3C}]
CODEBASE = http://www.surveys.com/promptcast/Installs/SURVEYS.COM PROMPTCAST SETUP.cab

[WScanCtl Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\webscan.dll
CODEBASE = http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab

[Java Plug-in 1.6.0_01]
InProcServer32 = C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
CODEBASE = http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab

[{9F1C11AA-197B-4942-BA54-47A8489BB47F}]
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37851.8805092593

[Java Plug-in 1.5.0_02]
InProcServer32 = C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
CODEBASE = http://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab

[Java Plug-in 1.5.0_04]
InProcServer32 = C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
CODEBASE = http://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab

[Java Plug-in 1.5.0_06]
InProcServer32 = C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
CODEBASE = http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

[Java Plug-in 1.5.0_09]
InProcServer32 = C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
CODEBASE = http://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab

[Java Plug-in 1.5.0_10]
InProcServer32 = C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
CODEBASE = http://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab

[Java Plug-in 1.5.0_11]
InProcServer32 = C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
CODEBASE = http://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab

[Java Plug-in 1.6.0_01]
InProcServer32 = C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
CODEBASE = http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab

[Java Plug-in 1.6.0_01]
InProcServer32 = C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
CODEBASE = http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[GpcContainer Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\ieatgpc.dll
CODEBASE = https://prweb.webex.com/client/v_mywebex-t20/event/ieatgpc.cab

[Yahoo! Webcam Viewer Wrapper]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\yvwrctl.dll
CODEBASE = http://chat.yahoo.com/cab/yvwrctl.cab

[TulipPlayer Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\TulipPlayer2.dll
CODEBASE = http://www.exstream.to/tulip/cab/3,0,5,19/TulipPlayer2.cab

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #1: C:\WINDOWS\System32\mswsock.dll
NameSpace #2: C:\WINDOWS\System32\winrnr.dll
NameSpace #3: C:\WINDOWS\System32\mswsock.dll
NameSpace #4: C:\Program Files\Bonjour\mdnsNSP.dll
Protocol #1: C:\WINDOWS\system32\mswsock.dll
Protocol #2: C:\WINDOWS\system32\mswsock.dll
Protocol #3: C:\WINDOWS\system32\mswsock.dll
Protocol #4: C:\WINDOWS\system32\rsvpsp.dll
Protocol #5: C:\WINDOWS\system32\rsvpsp.dll
Protocol #6: C:\WINDOWS\system32\mswsock.dll
Protocol #7: C:\WINDOWS\system32\mswsock.dll
Protocol #8: C:\WINDOWS\system32\mswsock.dll
Protocol #9: C:\WINDOWS\system32\mswsock.dll
Protocol #10: C:\WINDOWS\system32\mswsock.dll
Protocol #11: C:\WINDOWS\system32\mswsock.dll
Protocol #12: C:\WINDOWS\system32\mswsock.dll
Protocol #13: C:\WINDOWS\system32\mswsock.dll

--------------------------------------------------

Enumerating Windows NT/2000/XP services

Microsoft ACPI Driver: System32\DRIVERS\ACPI.sys (system)
Microsoft Kernel Acoustic Echo Canceller: system32\drivers\aec.sys (manual start)
PPdus ASPI Shell: system32\drivers\Afc.sys (manual start)
AFD Networking Support Environment: \SystemRoot\System32\drivers\afd.sys (system)
Alerter: %SystemRoot%\System32\svchost.exe -k LocalService (disabled)
Application Layer Gateway Service: %SystemRoot%\System32\alg.exe (manual start)
AMD K7 Processor Driver: System32\DRIVERS\amdk7.sys (system)
ANVIOCTL: System32\DRIVERS\anvioctl.sys (system)
ASUS Keyboard Filter Driver: System32\DRIVERS\anvosdnt.sys (system)
Application Management: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
aslm75: \??\C:\WINDOWS\system32\drivers\aslm75.sys (autostart)
Aspi32: System32\drivers\aspi32.sys (autostart)
ASP.NET State Service: %SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (manual start)
RAS Asynchronous Media Driver: System32\DRIVERS\asyncmac.sys (manual start)
Standard IDE/ESDI Hard Disk Controller: System32\DRIVERS\atapi.sys (system)
ATM ARP Client Protocol: System32\DRIVERS\atmarpc.sys (manual start)
Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Audio Stub Driver: System32\DRIVERS\audstub.sys (manual start)
Background Intelligent Transfer Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Bonjour Service: "C:\Program Files\Bonjour\mDNSResponder.exe" (autostart)
Computer Browser: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
CD-ROM Driver: System32\DRIVERS\cdrom.sys (system)
Indexing Service: %SystemRoot%\system32\cisvc.exe (manual start)
ClipBook: %SystemRoot%\system32\clipsrv.exe (disabled)
COM+ System Application: C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)
Cryptographic Services: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
DCOM Server Process Launcher: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)
DHCP Client: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Disk Driver: System32\DRIVERS\disk.sys (system)
Logical Disk Manager Administrative Service: %SystemRoot%\System32\dmadmin.exe /com (manual start)
dmboot: System32\drivers\dmboot.sys (disabled)
dmio: System32\drivers\dmio.sys (disabled)
dmload: System32\drivers\dmload.sys (disabled)
Logical Disk Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Dmstf30pep: C:\WINDOWS\system32\drivers\acpiec.sys (disabled)
Microsoft Kernel DLS Syntheiszer: system32\drivers\DMusic.sys (manual start)
DNS Client: %SystemRoot%\System32\svchost.exe -k NetworkService (autostart)
Microsoft Kernel DRM Audio Descrambler: system32\drivers\drmkaud.sys (manual start)
EIO: \??\C:\WINDOWS\system32\drivers\EIO.sys (manual start)
EntDrv51: \??\C:\WINDOWS\system32\drivers\EntDrv51.sys (manual start)
Eplpdx02: \??\C:\WINDOWS\System32\Drivers\EPLPDX02.SYS (manual start)
EpsonBidirectionalService: C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe (autostart)
EPSON V3 Service4(01): C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S30RP1.EXE (autostart)
Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Event Log: %SystemRoot%\system32\services.exe (autostart)
COM+ Event System: C:\WINDOWS\System32\svchost.exe -k netsvcs (manual start)
Fast User Switching Compatibility: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Floppy Disk Controller Driver: System32\DRIVERS\fdc.sys (manual start)
Floppy Disk Driver: System32\DRIVERS\flpydisk.sys (manual start)
FltMgr: system32\drivers\fltmgr.sys (system)
Volume Manager Driver: System32\DRIVERS\ftdisk.sys (system)
Game Port Enumerator: System32\DRIVERS\gameenum.sys (manual start)
GEARAspiWDM: System32\Drivers\GEARAspiWDM.sys (manual start)
gmer: System32\DRIVERS\gmer.sys (manual start)
Generic Packet Classifier: System32\DRIVERS\msgpc.sys (manual start)
Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Human Interface Device Access: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
Microsoft HID Class Driver: System32\DRIVERS\hidusb.sys (manual start)
HTTP: System32\Drivers\HTTP.sys (manual start)
HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)
i8042 Keyboard and PS/2 Mouse Port Driver: System32\DRIVERS\i8042prt.sys (system)
InstallDriver Table Manager: "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe" (manual start)
CD-Burning Filter Driver: System32\DRIVERS\imapi.sys (system)
IMAPI CD-Burning COM Service: C:\WINDOWS\System32\imapi.exe (manual start)
IPv6 Windows Firewall Driver: system32\drivers\ip6fw.sys (manual start)
IP Traffic Filter Driver: System32\DRIVERS\ipfltdrv.sys (manual start)
IP in IP Tunnel Driver: System32\DRIVERS\ipinip.sys (manual start)
IP Network Address Translator: System32\DRIVERS\ipnat.sys (manual start)
iPod Service: "C:\Program Files\iPod\bin\iPodService.exe" (manual start)
IPSEC driver: System32\DRIVERS\ipsec.sys (system)
IR Enumerator Service: System32\DRIVERS\irenum.sys (manual start)
PnP ISA/EISA Bus Driver: System32\DRIVERS\isapnp.sys (system)
Keyboard Class Driver: System32\DRIVERS\kbdclass.sys (system)
Microsoft Kernel Wave Audio Mixer: system32\drivers\kmixer.sys (manual start)
Server: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Workstation: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
TCP/IP NetBIOS Helper: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
Macromedia Licensing Service: "C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe" (manual start)
McAfee Framework Service: C:\Program Files\Network Associates\Common Framework\FrameworkService.exe /ServiceStart (autostart)

Bear07 · Jun 7, 2007

Continuing HijackThis Startup list:

Network Associates McShield: "C:\Program Files\Network Associates\VirusScan\Mcshield.exe" (autostart)
Network Associates Task Manager: "C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe" (autostart)
Messenger: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
NetMeeting Remote Desktop Sharing: C:\WINDOWS\System32\mnmsrvc.exe (manual start)
Mouse Class Driver: System32\DRIVERS\mouclass.sys (system)
Mouse HID Driver: System32\DRIVERS\mouhid.sys (manual start)
WebDav Client Redirector: System32\DRIVERS\mrxdav.sys (manual start)
MRXSMB: System32\DRIVERS\mrxsmb.sys (system)
Distributed Transaction Coordinator: C:\WINDOWS\System32\msdtc.exe (manual start)
Windows Installer: C:\WINDOWS\system32\msiexec.exe /V (manual start)
Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)
Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start)
Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start)
Microsoft System Management BIOS Driver: System32\DRIVERS\mssmbios.sys (manual start)
Microsoft MPU-401 MIDI UART Driver: system32\drivers\msmpu401.sys (manual start)
NaiAvFilter1: system32\drivers\naiavf5x.sys (manual start)
NaiAvTdi1: system32\drivers\mvstdi5x.sys (system)
Remote Access NDIS TAPI Driver: System32\DRIVERS\ndistapi.sys (manual start)
NDIS Usermode I/O Protocol: System32\DRIVERS\ndisuio.sys (manual start)
Remote Access NDIS WAN Driver: System32\DRIVERS\ndiswan.sys (manual start)
NetBIOS Interface: System32\DRIVERS\netbios.sys (system)
NetBios over Tcpip: System32\DRIVERS\netbt.sys (system)
Network DDE: %SystemRoot%\system32\netdde.exe (disabled)
Network DDE DSDM: %SystemRoot%\system32\netdde.exe (disabled)
Net Logon: %SystemRoot%\System32\lsass.exe (manual start)
Network Connections: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Network Location Awareness (NLA): %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
NT LM Security Support Provider: %SystemRoot%\System32\lsass.exe (manual start)
Removable Storage: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
nv: System32\DRIVERS\nv4_mini.sys (manual start)
Service for NVIDIA(R) nForce(TM) Audio Enumerator: system32\drivers\nvax.sys (manual start)
NVIDIA nForce MCP Networking Adapter Driver: System32\DRIVERS\NVENET.sys (manual start)
Service for NVIDIA(R) nForce(TM) Audio: system32\drivers\nvapu.sys (manual start)
ASUS Driver Helper Service: %SystemRoot%\System32\nvsvc32.exe (autostart)
NVIDIA nForce AGP Bus Filter: System32\DRIVERS\nv_agp.sys (system)
IPX Traffic Filter Driver: System32\DRIVERS\nwlnkflt.sys (manual start)
IPX Traffic Forwarder Driver: System32\DRIVERS\nwlnkfwd.sys (manual start)
Parallel port driver: System32\DRIVERS\parport.sys (manual start)
PCI Bus Driver: System32\DRIVERS\pci.sys (system)
PCIIde: System32\DRIVERS\pciide.sys (system)
Pen Class: System32\Drivers\PenClass.sys (system)
Plug and Play: %SystemRoot%\system32\services.exe (autostart)
IPSEC Services: %SystemRoot%\System32\lsass.exe (autostart)
WAN Miniport (PPTP): System32\DRIVERS\raspptp.sys (manual start)
Processor Driver: System32\DRIVERS\processr.sys (system)
Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)
QoS Packet Scheduler: System32\DRIVERS\psched.sys (manual start)
Direct Parallel Link Driver: System32\DRIVERS\ptilink.sys (manual start)
Remote Access Auto Connection Driver: System32\DRIVERS\rasacd.sys (system)
Remote Access Auto Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
WAN Miniport (L2TP): System32\DRIVERS\rasl2tp.sys (manual start)
Remote Access Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Remote Access PPPOE Driver: System32\DRIVERS\raspppoe.sys (manual start)
Direct Parallel: System32\DRIVERS\raspti.sys (manual start)
Rdbss: System32\DRIVERS\rdbss.sys (system)
RDPCDD: System32\DRIVERS\RDPCDD.sys (system)
Remote Desktop Help Session Manager: C:\WINDOWS\system32\sessmgr.exe (manual start)
Digital CD Audio Playback Filter Driver: System32\DRIVERS\redbook.sys (system)
Routing and Remote Access: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
Microsoft Legacy Modem Driver: System32\Drivers\RootMdm.sys (manual start)
Remote Procedure Call (RPC) Locator: %SystemRoot%\System32\locator.exe (manual start)
Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)
QoS RSVP: %SystemRoot%\System32\rsvp.exe (manual start)
Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
Smart Card: %SystemRoot%\System32\SCardSvr.exe (manual start)
Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Secdrv: System32\DRIVERS\secdrv.sys (manual start)
Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Serenum Filter Driver: System32\DRIVERS\serenum.sys (manual start)
Serial port driver: System32\DRIVERS\serial.sys (system)
Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Microsoft Kernel Audio Splitter: system32\drivers\splitter.sys (manual start)
Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
System Restore Filter Driver: System32\DRIVERS\sr.sys (system)
srescan: system32\ZoneLabs\srescan.sys (system)
System Restore Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Srv: System32\DRIVERS\srv.sys (manual start)
SSDP Discovery Service: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)
Windows Image Acquisition (WIA): %SystemRoot%\System32\svchost.exe -k imgsvc (autostart)
Intel Play QX3 Microscope: system32\drivers\STVqx3.sys (manual start)
Software Bus Driver: System32\DRIVERS\swenum.sys (manual start)
Microsoft Kernel GS Wavetable Synthesizer: system32\drivers\swmidi.sys (manual start)
MS Software Shadow Copy Provider: C:\WINDOWS\System32\dllhost.exe /Processid:{A57A6EA3-0AE4-4961-A2F9-4C7549DE1740} (manual start)
Microsoft Kernel System Audio Device: system32\drivers\sysaudio.sys (manual start)
Performance Logs and Alerts: %SystemRoot%\system32\smlogsvc.exe (manual start)
TabletService: C:\WINDOWS\System32\Tablet.exe (autostart)
Telephony: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
TCP/IP Protocol Driver: System32\DRIVERS\tcpip.sys (system)
Terminal Device Driver: System32\DRIVERS\termdd.sys (system)
Terminal Services: %SystemRoot%\System32\svchost -k DComLaunch (manual start)
Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Microcode Update Driver: System32\DRIVERS\update.sys (manual start)
Universal Plug and Play Device Host: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)
Uninterruptible Power Supply: %SystemRoot%\System32\ups.exe (manual start)
Microsoft USB 2.0 Enhanced Host Controller Miniport Driver: System32\DRIVERS\usbehci.sys (manual start)
USB2 Enabled Hub: System32\DRIVERS\usbhub.sys (manual start)
Microsoft USB Open Host Controller Miniport Driver: System32\DRIVERS\usbohci.sys (manual start)
Microsoft USB PRINTER Class: System32\DRIVERS\usbprint.sys (manual start)
Usbscan: System32\DRIVERS\usbscan.sys (manual start)
USB Mass Storage Driver: system32\DRIVERS\USBSTOR.SYS (manual start)
VGA Display Controller.: \SystemRoot\System32\drivers\vga.sys (system)
vsdatant: System32\vsdatant.sys (system)
TrueVector Internet Monitor: C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service (autostart)
Volume Shadow Copy: %SystemRoot%\System32\vssvc.exe (manual start)
Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Remote Access IP ARP Driver: System32\DRIVERS\wanarp.sys (manual start)
Microsoft WINMM WDM Audio Compatibility Driver: system32\drivers\wdmaud.sys (manual start)
WebClient: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
Windows Defender: "C:\Program Files\Windows Defender\MsMpEng.exe" (autostart)
Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Portable Media Serial Number Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
WMI Performance Adapter: C:\WINDOWS\System32\wbem\wmiapsrv.exe (manual start)
Windows Media Player Network Sharing Service: "C:\Program Files\Windows Media Player\WMPNetwk.exe" (autostart)
Security Center: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Windows Driver Foundation - User-mode Driver Framework Platform Driver: system32\DRIVERS\WudfPf.sys (manual start)
Windows Driver Foundation - User-mode Driver Framework Reflector: system32\DRIVERS\wudfrd.sys (manual start)
Windows Driver Foundation - User-mode Driver Framework: %SystemRoot%\system32\svchost.exe -k WudfServiceGroup (manual start)
Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Network Provisioning Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\New\EPSET32.DLL|C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPSET32.DLL|C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\New\EBAPI4.DLL|C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EBAPI4.DLL|C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\New\EPUPDATE.EXE|C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE|||

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll
WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll

--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

--------------------------------------------------

End of report, 39,262 bytes
Report generated in 0.219 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

Mr_JAk3 · Jun 8, 2007

Ok nothing bad there but just to be sure...

You should print these instructions or save these to a text file. Follow these instructions carefully.

Download Dr.Web CureIt to the desktop -> ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

Restart your computer to the safe mode:

Restart your computer
Start tapping the F8 key when the computer restarts.
When the start menu opens, choose Safe mode
Press Enter. The computer then begins to start in Safe mode.

Run a scan with Dr.Web CureIt

Doubleclick the drweb-cureit.exe file and Allow to run the express scan
This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
Once the short scan has finished, you should now mark the drives that you want to scan.
Select all drives. A red dot shows which drives have been chosen.
Click the green arrow at the right, and the scan will start.
Click 'Yes to all' if it asks if you want to cure/move the file.
When the scan has finished, look if you can click next icon next to the files found
If so, click it and then click the next icon right below and select Move incurable
After the scan, in the menu, click file and choose save report list
Save the report to your desktop. The report will be called DrWeb.csv
Close Dr.Web Cureit.
Reboot the computer in Normal Mode,
Post the Cure-it report and a fresh HijackThis log

Bear07 · Jun 9, 2007

Results from the Cure-it report:

GoogleMon.exe;C:\KEITH\Gorilla Website Marketing\google monitor;Probably DLOADER.Trojan;Incurable.Moved.;

Fresh HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 8:12:28 PM, on 6/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\WINDOWS\anvshell.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\RAMpage\RAMpage.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S30RP1.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\ClipMate7\clipmate.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBNA.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\WINDOWS\System32\Tablet.exe
C:\Program Files\Wacom\TabUserW.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Microsoft Office\Office\EXCEL.EXE
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program Files\hijackthis\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [anvshell] anvshell.exe
O4 - HKLM\..\Run: [LiveNote] livenote.exe
O4 - HKLM\..\Run: [RAMpage] "C:\Program Files\RAMpage\RAMpage.exe" U=1 M=28 T=4 LW P="C:\Program Files\RAMpage\RAMpageConfig.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ClipMate7] C:\Program Files\ClipMate7\clipmate.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [EPSON Stylus Photo R260 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBNA.EXE /FU "C:\WINDOWS\TEMP\E_SA7.tmp" /EF "HKCU"
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: TabUserW.lnk = C:\Program Files\Wacom\TabUserW.exe
O8 - Extra context menu item: Google AdSense Preview Tool - http://pagead2.googlesyndication.com/pagead/preview/en/preview.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3F0EECCE-E138-11D1-8712-0060083D83F5} (LPViewer Class) - http://www.iseemedia.com/activex/LPControl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1126413452031
O16 - DPF: {77DD44BF-551D-4E3C-82CD-D637D5018D3C} - http://www.surveys.com/promptcast/Installs/SURVEYS.COM PROMPTCAST SETUP.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://prweb.webex.com/client/v_mywebex-t20/event/ieatgpc.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O16 - DPF: {ED4E6F97-FA1A-4634-B550-AABFEB8DA009} (TulipPlayer Class) - http://www.exstream.to/tulip/cab/3,0,5,19/TulipPlayer2.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S30RP1.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: ASUS Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Mr_JAk3 · Jun 9, 2007

Ok good

How is the computer running?

Bear07 · Jun 10, 2007

The problem persists. I’m still getting suspicious bounce backs and spam mail that appears to be from my own email accounts. In fact, I just got a bounce back while typing this. I’m also getting spam that appears to be from accounts on my own websites, but they’re accounts that don’t exist. For example, some emails say something like this:

From: Kerry <xw @ mywebsite.com>
To: Madeleine <myname @ mywebsite.com>

But the “From” address does not exist because I never created it and while the “To” email address is correct the name “Madeleine” is not. I’ve already had my host check the server for problems and they say everything looks normal, which is why I thought maybe it was malware on my pc that was causing the problem. Maybe it’s really just spam faked to look like it’s coming from my email accounts and websites. Do you know if there’s any way to tell exactly where an email is coming from?

I want to give you some more information that I’m hoping might help us figure out for sure whether or not I have malware. Please bare with me… this might be a little confusing.

I have 10 email accounts that I check regularly using Thunderbird. Nine of these accounts are on 3 domains that are owned by me and one that’s on earthlink.net. Four of these email accounts (all on my domains) have only been made available to very trusted parties. Those 4 accounts do not receive any spam and they have never received any suspicious emails or bounce backs. My 6 other email accounts, one of which is the earthlink.net email account, have at one time or another been available to spammers or vulnerable to email harvesters. These 6 email accounts are the ones getting the suspicious bounce backs and spam. But the eathlink.net email only receives bounce backs. It doesn’t have the other problem I described above. The other problematic accounts have both types of problems.

Now in my opinion, since only my vulnerable accounts are having problems that makes it seem like maybe it’s just spam that’s been faked to look like it’s coming from me and not malware that’s sending spam through my computer. If it were malware wouldn’t it send spam through all my accounts?

But I have an eleventh email account (different domain from the others but same server) that I rarely check and only check through the site’s webmail program - not through Thunderbird. This email is publicly available and although it receives a lot of spam, it does not receive bounce backs or suspicious emails. If the bounce backs etc. were just spam then wouldn’t this eleventh account receive similar spam?

I’m also still concerned about some of the infected files discovered by Kaspersky. I know most of the infections were in Thunderbird messages, but what about these:

C:\ESftp\esftpv42.exe/data0019/NHInstall.exe Infected: not-a-virus:AdWare.Win32.NavExcel.d skipped
C:\ESftp\esftpv42.exe/data0019/v2.0.2.cab/NHUninstaller.exe Infected: not-a-virus:AdWare.Win32.NavExcel.d skipped
C:\ESftp\esftpv42.exe/data0019/v2.0.2.cab/NHelper.dll Infected: not-a-virus:AdWare.Win32.NavExcel.d skipped
C:\ESftp\esftpv42.exe/data0019/v2.0.2.cab/NHUpdater.exe Infected: not-a-virus:AdWare.Win32.NavExcel.b skipped
C:\ESftp\esftpv42.exe/data0019/v2.0.2.cab Infected: not-a-virus:AdWare.Win32.NavExcel.b skipped
C:\ESftp\esftpv42.exe/data0019 Infected: not-a-virus:AdWare.Win32.NavExcel.b skipped
C:\ESftp\esftpv42.exe Inno: infected - 6 skipped

C:\Documents and Settings\HTH\.housecall6.6\Quarantine\498c7bba-7ac4e5b0.bac_a01640/GetAccess.class Infected: Trojan.Java.ClassLoader.c skipped
C:\Documents and Settings\HTH\.housecall6.6\Quarantine\498c7bba-7ac4e5b0.bac_a01640/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify skipped
C:\Documents and Settings\HTH\.housecall6.6\Quarantine\498c7bba-7ac4e5b0.bac_a01640/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped
C:\Documents and Settings\HTH\.housecall6.6\Quarantine\498c7bba-7ac4e5b0.bac_a01640/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v skipped
C:\Documents and Settings\HTH\.housecall6.6\Quarantine\498c7bba-7ac4e5b0.bac_a01640 ZIP: infected - 4 skipped
C:\Documents and Settings\HTH\.housecall6.6\Quarantine\498c7bba-7ac4e5b0.bac_a01640 CryptFF.b: infected - 4 skipped
C:\Documents and Settings\HTH\.housecall6.6\Quarantine\classload.jar-1910af14-4e288d7e.zip.bac_a01640/GetAccess.class Infected: Trojan.Java.ClassLoader.c skipped
C:\Documents and Settings\HTH\.housecall6.6\Quarantine\classload.jar-1910af14-4e288d7e.zip.bac_a01640/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify skipped
C:\Documents and Settings\HTH\.housecall6.6\Quarantine\classload.jar-1910af14-4e288d7e.zip.bac_a01640/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped
C:\Documents and Settings\HTH\.housecall6.6\Quarantine\classload.jar-1910af14-4e288d7e.zip.bac_a01640/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v skipped
C:\Documents and Settings\HTH\.housecall6.6\Quarantine\classload.jar-1910af14-4e288d7e.zip.bac_a01640 ZIP: infected - 4 skipped
C:\Documents and Settings\HTH\.housecall6.6\Quarantine\classload.jar-1910af14-4e288d7e.zip.bac_a01640 CryptFF.b: infected - 4 skipped

I also did a scan with ZoneAlarm’s System Checkup and that program claims to have detected 3 spyware infections on my computer. Unfortunately it won’t show me where the infections are. It may just be a marketing gimmick to get me to buy their software, but it still makes me nervous.

Here is one last piece of info – I have no idea if it’s related but I should probably tell you about it just in case. Three or four days ago I had a problem with web pages not completely loading. When I looked at the HTML source code I could see that the web pages would literally just stop downloading. At the same time I was also having trouble receiving my email – it was very slow. This happened off and on for 2 days. During that time I also got a strange Windows error that said, “Generic Host Process for Win32 Services has encountered a problem and needs to close. We are sorry for the inconvenience.” But for the past couple of days everything has downloaded normally so maybe it was just a temporary glitch in my computer.

I hope I didn’t write too much. I just really really want to figure out what’s going on with my computer.

Thanks!

Bear

Mr_JAk3 · Jun 10, 2007

Hello

I believe that the messages are just spam. However there are a few more scans that we could do.

Make a new folder in the C:\drive called silentrunners
Download 'silent runners" from here: (direct download)
http://www.silentrunners.org/Silent Runners.vbs
Save it to your silentrunners folder.

Click start> run> type cmd and hit enter
Type the following exactly and hit enter after each line.
cd c:\silentrunners and hit enter
"silent runners.vbs" -all and hit enter

Wait until it pops up saying its completed, then post the resulting logfile here
It will be very large. You may need several posts to include everything

Download F-Secure Blacklight and save it to your desktop.

Doubleclick fsbl.exe, accept the agreement, click Scan, then click Next

You'll see a list what have been found. A log will appear to your desktop, it is named fsbl.xxxxxxx.log (xxxxxxx will be random numbers).

DON'T choose Rename if something was found!

Post the contents of fsbl.xxxx.log to here (blacklight log from your desktop)

Zombie PC

New member

Security Expert-Emeritus

New member

New member

New member

Security Expert-Emeritus

New member

New member

New member

New member

New member

Security Expert-Emeritus

New member

New member

New member

Security Expert-Emeritus

New member

Security Expert-Emeritus

New member

Security Expert-Emeritus