Tech Support Forum - View Single Post - Re: Posted Logs-need Spyware Removal Help

adasha · 01-19-2008, 10:15 AM

Combofix Log:

ComboFix 08-01-09.2 - Adasha Knight 2008-01-19 8:34:30.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.752 [GMT -6:00]
Running from: C:\Documents and Settings\Adasha Knight\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Adasha Knight\Desktop\CFscript.txt
* Created a new restore point

FILE
C:\WINDOWS\mrofinu72.exe.tmp
C:\WINDOWS\system32\cdsjfwqt.ini
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\VundoFix Backups
C:\VundoFix Backups\addmorefiles.txt
C:\VundoFix Backups\hggefec.dll.bad
C:\VundoFix Backups\iifeecd.dll.bad
C:\VundoFix Backups\rtutv.ini.bad
C:\VundoFix Backups\rtutv.ini2.bad
C:\VundoFix Backups\vtutr.dll.bad
C:\VundoFix Backups\vtutr.exe.bad
C:\WINDOWS\mrofinu72.exe.tmp
C:\WINDOWS\system32\cdsjfwqt.ini

.
((((((((((((((((((((((((( Files Created from 2007-12-19 to 2008-01-19 )))))))))))))))))))))))))))))))
.

2008-01-17 19:01 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-15 21:10 . 2008-01-15 21:10 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-09 14:31 . 2008-01-09 14:31 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-09 14:30 . 2008-01-09 14:30 <DIR> d-------- C:\ie-spyad_zo
2008-01-09 11:50 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS
2008-01-09 11:29 . 2008-01-09 13:47 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-01-09 11:29 . 2008-01-09 11:29 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-01-09 11:29 . 2008-01-09 11:29 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-01-09 11:29 . 2008-01-09 11:29 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-01-08 21:01 . 2008-01-08 21:01 <DIR> d-------- C:\Deckard
2007-12-23 12:40 . 2008-01-05 14:23 <DIR> d-------- C:\Program Files\AIMTunes
2007-12-23 12:27 . 2007-12-23 12:27 4,286 --a------ C:\WINDOWS\system32\MobileSidewalk.ico

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-18 01:22 --------- d-----w C:\Program Files\QuickTime
2008-01-16 13:49 --------- d-----w C:\Program Files\Java
2008-01-09 19:15 --------- d-----w C:\Program Files\Lexmark 1200 Series
2008-01-09 19:09 --------- d-----w C:\Program Files\DIGStream
2007-12-23 18:42 --------- d-----w C:\Program Files\AIM6
2007-12-23 18:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads
2007-12-06 23:43 --------- d-----w C:\Program Files\LimeWire
2007-09-23 16:03 25,336 ----a-w C:\Documents and Settings\Adasha Knight\Application Data\GDIPFONTCACHEV1.DAT
2007-09-09 16:35 14,738 ----a-w C:\Program Files\videodownloader-1.1.1-fx.xpi
2007-01-19 04:36 722,176 ----a-w C:\Documents and Settings\Adasha Knight\gotomypc_428.exe
2006-06-25 02:14 5,244 ----a-w C:\Program Files\me 06 (84 x 114).jpg
.

((((((((((((((((((((((((((((( snapshot@2008-01-17_19.27.42.48 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-18 01:02:56 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-19 14:33:58 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-18 01:02:56 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-19 14:33:58 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-18 01:02:58 4,329,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\ntuser.dat
+ 2008-01-19 14:34:00 4,329,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\ntuser.dat
- 2008-01-18 01:02:58 348,160 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-19 14:34:01 348,160 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-18 01:02:59 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\NTUSER.DAT
+ 2008-01-19 14:34:01 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\NTUSER.DAT
- 2008-01-18 01:02:59 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-19 14:34:02 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2008-01-17 18:40 385024]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2008-01-17 18:40 83608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-01-08 18:04 4898816]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-27 19:17 443968]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 18:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

S3 akshasp;Aladdin HASP Key;C:\WINDOWS\system32\DRIVERS\akshasp.sys [2005-07-20 20:08]

.
Contents of the 'Scheduled Tasks' folder
"2008-01-19 00:29:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-19 08:43:05
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-19 8:47:12 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-19 14:47:08
ComboFix2.txt 2008-01-18 01:28:19
.
2007-07-12 03:53:47 --- E O F ---

Kaspersky Log:
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Saturday, January 19, 2008 11:12:43 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 19/01/2008
Kaspersky Anti-Virus database records: 523769
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 71496
Number of viruses found: 19
Number of infected objects: 189
Number of suspicious objects: 0
Duration of the scan process: 01:59:02

Infected Object Name / Virus Name / Last Action
C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP1.tmp Infected: Trojan-Downloader.Win32.PurityScan.fe skipped
C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP1221.tmp Infected: Trojan-Downloader.Win32.PurityScan.fe skipped
C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP1238.tmp Infected: Trojan-Downloader.Win32.Agent.gwh skipped
C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP2.tmp Infected: Trojan-Downloader.Win32.PurityScan.fe skipped
C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP5C.tmp Infected: Trojan-Downloader.Win32.PurityScan.fe skipped
C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP67.tmp Infected: Trojan-Downloader.Win32.Adload.ni skipped
C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP75.tmp Infected: Trojan-Downloader.Win32.Agent.gwh skipped
C:\Documents and Settings\Adasha Knight\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071206-221922-851.dll Infected: Trojan.Win32.BHO.abo skipped
C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071206-222313-289.dll Infected: Trojan.Win32.BHO.abo skipped
C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071212-231333-851.dll Infected: Trojan.Win32.BHO.abo skipped
C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071215-131912-475.dll Infected: Trojan.Win32.BHO.abo skipped
C:\Documents and Settings\Adasha Knight\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Adasha Knight\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Adasha Knight\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Adasha Knight\Local Settings\History\History.IE5\MSHist012008011920080120\index.dat Object is locked skipped
C:\Documents and Settings\Adasha Knight\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Adasha Knight\ntuser.dat Object is locked skipped
C:\Documents and Settings\Adasha Knight\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Common Files\Real\Update_OB\realsched.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Intel\Wireless\Bin\ifrmewrk.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Java\jre1.6.0_01\bin\jusched.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\VundoFix Backups\hggefec.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.clz skipped
C:\QooBox\Quarantine\C\VundoFix Backups\iifeecd.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.clz skipped
C:\QooBox\Quarantine\C\VundoFix Backups\vtutr.exe.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\WINDOWS\mrofinu72.exe.tmp.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\WINDOWS\mrofinu72.exe.vir Infected: Trojan-Downloader.Win32.Agent.gwh skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\qlgojmza.dat.vir Object is locked skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\hggefec.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.clz skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ntanayog.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\rutjgknp.exe.vir Infected: Trojan-Downloader.Win32.Agent.gwe skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vtutr.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\catchme2008-01-17_192302.32.zip/qlgojmza.dat Infected: Rootkit.Win32.Agent.tw skipped
C:\QooBox\Quarantine\catchme2008-01-17_192302.32.zip/qlgojmza.dat.1 Infected: Rootkit.Win32.Agent.tw skipped
C:\QooBox\Quarantine\catchme2008-01-17_192302.32.zip/ddrawe.dll Infected: Trojan.Win32.BHO.abo skipped
C:\QooBox\Quarantine\catchme2008-01-17_192302.32.zip ZIP: infected - 3 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP202\A0122962.exe Infected: Trojan-Spy.Win32.BZub.buz skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP207\A0127193.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128187.exe Infected: Trojan-Downloader.Win32.Osel.bx skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128190.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128191.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128194.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128195.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128196.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128197.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128198.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128199.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128200.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129189.exe Infected: Trojan-Downloader.Win32.PurityScan.fe skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129190.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129191.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129193.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129194.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129196.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129197.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129198.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129202.exe Infected: Trojan-Downloader.Win32.PurityScan.fe skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129205.exe Infected: Trojan-Downloader.Win32.Adload.ni skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129206.dll Infected: not-a-virus:AdWare.Win32.PurityScan.gl skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129207.exe Infected: not-a-virus:AdWare.Win32.PurityScan.gq skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129212.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130189.exe Infected: Trojan-Downloader.Win32.PurityScan.fe skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130190.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130192.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130193.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130194.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130196.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130197.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130198.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130203.exe Infected: Trojan-Downloader.Win32.PurityScan.fe skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130205.exe Infected: Trojan-Downloader.Win32.Adload.ni skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130208.exe Infected: not-a-virus:AdWare.Win32.PurityScan.gq skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130213.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130214.exe Infected: Trojan-Spy.Win32.Zbot.mt skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130215.exe Infected: Trojan-Downloader.Win32.PurityScan.eg skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130217.exe Infected: not-a-virus:AdWare.Win32.Agent.vv skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130222.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130404.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130408.dll Infected: not-a-virus:AdWare.Win32.PurityScan.gl skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130409.exe Infected: Trojan-Downloader.Win32.Osel.bx skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130436.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130437.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130438.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130440.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130441.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130442.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130443.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130444.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130445.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130449.exe Infected: Trojan-Downloader.Win32.PurityScan.fe skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130451.exe Infected: Trojan-Downloader.Win32.Adload.ni skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130454.dll Infected: not-a-virus:AdWare.Win32.PurityScan.gl skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130455.exe Infected: not-a-virus:AdWare.Win32.PurityScan.gq skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130460.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130471.exe Infected: Trojan-Downloader.Win32.PurityScan.eg skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130480.dll Infected: not-a-virus:AdWare.Win32.PurityScan.gl skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130483.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130485.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130494.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130497.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130505.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130507.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130515.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130516.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0130574.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.clz skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0130576.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0130582.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131579.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131581.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131589.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131591.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131598.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131599.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131612.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131614.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0132612.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0132613.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132625.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132626.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132642.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132643.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132652.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132654.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132693.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132694.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132701.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132705.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132706.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132714.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132716.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132737.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132738.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132746.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132747.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0133746.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0133748.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP211\A0133756.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP211\A0133757.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP211\A0133764.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP211\A0133766.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133774.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133775.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133779.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133780.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133842.exe Infected: not-a-virus:AdWare.Win32.Agent.vv skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133844.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133847.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133849.exe Infected: Trojan.Win32.Agent.crf skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133850.exe Infected: Trojan-Downloader.Win32.Agent.erf skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133855.exe Infected: Trojan-Spy.Win32.Zbot.mt skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133860.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133862.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133871.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133872.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0134870.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0134871.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0134879.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0134880.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0134891.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0134892.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135004.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135007.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135032.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135034.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135035.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135042.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135044.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135045.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135157.exe Infected: Trojan-Downloader.Win32.Adload.ni skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135161.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135163.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135164.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135174.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135175.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135177.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135193.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135194.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135195.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135202.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135203.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135206.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135210.exe Infected: Trojan-Downloader.Win32.Adload.ni skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135212.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135213.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135214.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135216.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135218.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135220.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.clz skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135222.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135225.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135226.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135227.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135238.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135249.exe Infected: Trojan-Downloader.Win32.Adload.ni skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135250.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP216\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\ModemLog_Conexant D110 MDC V.9x Modem.txt Object is locked skipped
C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{1156E72B-E402-4BA0-8419-512B234A630A}.crmlog Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\TempFile Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

Hijack This Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:13:39 AM, on 1/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1189315894890
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.dotphoto.com/ImageUploader4.cab
O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/download...2/axofupld.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://games.pogo.com/online2/pogo/b...ploader_v6.cab
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 4110 bytes

01-19-2008, 10:15 AM	#7 (permalink)
adasha Registered User Join Date: Jan 2008 Location: Texas Posts: 12 OS: Windows XP	Re: Posted Logs-need Spyware Removal Help Combofix Log: ComboFix 08-01-09.2 - Adasha Knight 2008-01-19 8:34:30.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.752 [GMT -6:00] Running from: C:\Documents and Settings\Adasha Knight\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Adasha Knight\Desktop\CFscript.txt * Created a new restore point FILE C:\WINDOWS\mrofinu72.exe.tmp C:\WINDOWS\system32\cdsjfwqt.ini . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\VundoFix Backups C:\VundoFix Backups\addmorefiles.txt C:\VundoFix Backups\hggefec.dll.bad C:\VundoFix Backups\iifeecd.dll.bad C:\VundoFix Backups\rtutv.ini.bad C:\VundoFix Backups\rtutv.ini2.bad C:\VundoFix Backups\vtutr.dll.bad C:\VundoFix Backups\vtutr.exe.bad C:\WINDOWS\mrofinu72.exe.tmp C:\WINDOWS\system32\cdsjfwqt.ini . ((((((((((((((((((((((((( Files Created from 2007-12-19 to 2008-01-19 ))))))))))))))))))))))))))))))) . 2008-01-17 19:01 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2008-01-15 21:10 . 2008-01-15 21:10 <DIR> d-------- C:\Program Files\Trend Micro 2008-01-09 14:31 . 2008-01-09 14:31 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-01-09 14:30 . 2008-01-09 14:30 <DIR> d-------- C:\ie-spyad_zo 2008-01-09 11:50 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS 2008-01-09 11:29 . 2008-01-09 13:47 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2008-01-09 11:29 . 2008-01-09 11:29 30,590 --a------ C:\WINDOWS\system32\pavas.ico 2008-01-09 11:29 . 2008-01-09 11:29 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico 2008-01-09 11:29 . 2008-01-09 11:29 1,406 --a------ C:\WINDOWS\system32\Help.ico 2008-01-08 21:01 . 2008-01-08 21:01 <DIR> d-------- C:\Deckard 2007-12-23 12:40 . 2008-01-05 14:23 <DIR> d-------- C:\Program Files\AIMTunes 2007-12-23 12:27 . 2007-12-23 12:27 4,286 --a------ C:\WINDOWS\system32\MobileSidewalk.ico . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-18 01:22 --------- d-----w C:\Program Files\QuickTime 2008-01-16 13:49 --------- d-----w C:\Program Files\Java 2008-01-09 19:15 --------- d-----w C:\Program Files\Lexmark 1200 Series 2008-01-09 19:09 --------- d-----w C:\Program Files\DIGStream 2007-12-23 18:42 --------- d-----w C:\Program Files\AIM6 2007-12-23 18:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads 2007-12-06 23:43 --------- d-----w C:\Program Files\LimeWire 2007-09-23 16:03 25,336 ----a-w C:\Documents and Settings\Adasha Knight\Application Data\GDIPFONTCACHEV1.DAT 2007-09-09 16:35 14,738 ----a-w C:\Program Files\videodownloader-1.1.1-fx.xpi 2007-01-19 04:36 722,176 ----a-w C:\Documents and Settings\Adasha Knight\gotomypc_428.exe 2006-06-25 02:14 5,244 ----a-w C:\Program Files\me 06 (84 x 114).jpg . ((((((((((((((((((((((((((((( snapshot@2008-01-17_19.27.42.48 ))))))))))))))))))))))))))))))))))))))))) . - 2008-01-18 01:02:56 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT + 2008-01-19 14:33:58 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT - 2008-01-18 01:02:56 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat + 2008-01-19 14:33:58 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat - 2008-01-18 01:02:58 4,329,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\ntuser.dat + 2008-01-19 14:34:00 4,329,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\ntuser.dat - 2008-01-18 01:02:58 348,160 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat + 2008-01-19 14:34:01 348,160 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat - 2008-01-18 01:02:59 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\NTUSER.DAT + 2008-01-19 14:34:01 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\NTUSER.DAT - 2008-01-18 01:02:59 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat + 2008-01-19 14:34:02 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Aim6"="" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2008-01-17 18:40 385024] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2008-01-17 18:40 83608] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-01-08 18:04 4898816] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-27 19:17 443968] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless] C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 18:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll S3 akshasp;Aladdin HASP Key;C:\WINDOWS\system32\DRIVERS\akshasp.sys [2005-07-20 20:08] . Contents of the 'Scheduled Tasks' folder "2008-01-19 00:29:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************ catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-19 08:43:05 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . Completion time: 2008-01-19 8:47:12 - machine was rebooted ComboFix-quarantined-files.txt 2008-01-19 14:47:08 ComboFix2.txt 2008-01-18 01:28:19 . 2007-07-12 03:53:47 --- E O F --- Kaspersky Log: ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Saturday, January 19, 2008 11:12:43 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 19/01/2008 Kaspersky Anti-Virus database records: 523769 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ Scan Statistics: Total number of scanned objects: 71496 Number of viruses found: 19 Number of infected objects: 189 Number of suspicious objects: 0 Duration of the scan process: 01:59:02 Infected Object Name / Virus Name / Last Action C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP1.tmp Infected: Trojan-Downloader.Win32.PurityScan.fe skipped C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP1221.tmp Infected: Trojan-Downloader.Win32.PurityScan.fe skipped C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP1238.tmp Infected: Trojan-Downloader.Win32.Agent.gwh skipped C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP2.tmp Infected: Trojan-Downloader.Win32.PurityScan.fe skipped C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP5C.tmp Infected: Trojan-Downloader.Win32.PurityScan.fe skipped C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP67.tmp Infected: Trojan-Downloader.Win32.Adload.ni skipped C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP75.tmp Infected: Trojan-Downloader.Win32.Agent.gwh skipped C:\Documents and Settings\Adasha Knight\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071206-221922-851.dll Infected: Trojan.Win32.BHO.abo skipped C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071206-222313-289.dll Infected: Trojan.Win32.BHO.abo skipped C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071212-231333-851.dll Infected: Trojan.Win32.BHO.abo skipped C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071215-131912-475.dll Infected: Trojan.Win32.BHO.abo skipped C:\Documents and Settings\Adasha Knight\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Adasha Knight\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Adasha Knight\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Adasha Knight\Local Settings\History\History.IE5\MSHist012008011920080120\index.dat Object is locked skipped C:\Documents and Settings\Adasha Knight\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Adasha Knight\ntuser.dat Object is locked skipped C:\Documents and Settings\Adasha Knight\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Common Files\Real\Update_OB\realsched.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\QooBox\Quarantine\C\Program Files\Intel\Wireless\Bin\ifrmewrk.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\QooBox\Quarantine\C\Program Files\Java\jre1.6.0_01\bin\jusched.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\QooBox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\QooBox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\QooBox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\QooBox\Quarantine\C\VundoFix Backups\hggefec.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.clz skipped C:\QooBox\Quarantine\C\VundoFix Backups\iifeecd.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.clz skipped C:\QooBox\Quarantine\C\VundoFix Backups\vtutr.exe.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\QooBox\Quarantine\C\WINDOWS\mrofinu72.exe.tmp.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\QooBox\Quarantine\C\WINDOWS\mrofinu72.exe.vir Infected: Trojan-Downloader.Win32.Agent.gwh skipped C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\qlgojmza.dat.vir Object is locked skipped C:\QooBox\Quarantine\C\WINDOWS\system32\hggefec.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.clz skipped C:\QooBox\Quarantine\C\WINDOWS\system32\ntanayog.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped C:\QooBox\Quarantine\C\WINDOWS\system32\rutjgknp.exe.vir Infected: Trojan-Downloader.Win32.Agent.gwe skipped C:\QooBox\Quarantine\C\WINDOWS\system32\vtutr.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\QooBox\Quarantine\catchme2008-01-17_192302.32.zip/qlgojmza.dat Infected: Rootkit.Win32.Agent.tw skipped C:\QooBox\Quarantine\catchme2008-01-17_192302.32.zip/qlgojmza.dat.1 Infected: Rootkit.Win32.Agent.tw skipped C:\QooBox\Quarantine\catchme2008-01-17_192302.32.zip/ddrawe.dll Infected: Trojan.Win32.BHO.abo skipped C:\QooBox\Quarantine\catchme2008-01-17_192302.32.zip ZIP: infected - 3 skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP202\A0122962.exe Infected: Trojan-Spy.Win32.BZub.buz skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP207\A0127193.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128187.exe Infected: Trojan-Downloader.Win32.Osel.bx skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128190.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128191.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128194.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128195.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128196.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128197.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128198.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128199.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128200.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129189.exe Infected: Trojan-Downloader.Win32.PurityScan.fe skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129190.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129191.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129193.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129194.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129196.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129197.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129198.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129202.exe Infected: Trojan-Downloader.Win32.PurityScan.fe skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129205.exe Infected: Trojan-Downloader.Win32.Adload.ni skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129206.dll Infected: not-a-virus:AdWare.Win32.PurityScan.gl skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129207.exe Infected: not-a-virus:AdWare.Win32.PurityScan.gq skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129212.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130189.exe Infected: Trojan-Downloader.Win32.PurityScan.fe skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130190.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130192.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130193.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130194.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130196.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130197.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130198.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130203.exe Infected: Trojan-Downloader.Win32.PurityScan.fe skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130205.exe Infected: Trojan-Downloader.Win32.Adload.ni skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130208.exe Infected: not-a-virus:AdWare.Win32.PurityScan.gq skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130213.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130214.exe Infected: Trojan-Spy.Win32.Zbot.mt skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130215.exe Infected: Trojan-Downloader.Win32.PurityScan.eg skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130217.exe Infected: not-a-virus:AdWare.Win32.Agent.vv skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130222.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130404.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130408.dll Infected: not-a-virus:AdWare.Win32.PurityScan.gl skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130409.exe Infected: Trojan-Downloader.Win32.Osel.bx skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130436.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130437.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130438.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130440.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130441.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130442.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130443.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130444.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130445.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130449.exe Infected: Trojan-Downloader.Win32.PurityScan.fe skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130451.exe Infected: Trojan-Downloader.Win32.Adload.ni skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130454.dll Infected: not-a-virus:AdWare.Win32.PurityScan.gl skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130455.exe Infected: not-a-virus:AdWare.Win32.PurityScan.gq skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130460.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130471.exe Infected: Trojan-Downloader.Win32.PurityScan.eg skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130480.dll Infected: not-a-virus:AdWare.Win32.PurityScan.gl skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130483.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130485.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130494.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130497.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130505.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130507.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130515.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130516.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0130574.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.clz skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0130576.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0130582.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131579.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131581.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131589.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131591.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131598.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131599.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131612.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131614.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0132612.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0132613.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132625.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132626.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132642.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132643.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132652.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132654.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132693.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132694.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132701.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132705.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132706.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132714.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132716.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132737.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132738.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132746.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132747.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0133746.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0133748.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP211\A0133756.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP211\A0133757.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP211\A0133764.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP211\A0133766.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133774.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133775.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133779.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133780.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133842.exe Infected: not-a-virus:AdWare.Win32.Agent.vv skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133844.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133847.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133849.exe Infected: Trojan.Win32.Agent.crf skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133850.exe Infected: Trojan-Downloader.Win32.Agent.erf skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133855.exe Infected: Trojan-Spy.Win32.Zbot.mt skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133860.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133862.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133871.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133872.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0134870.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0134871.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0134879.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0134880.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0134891.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0134892.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135004.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135007.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135032.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135034.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135035.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135042.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135044.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135045.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135157.exe Infected: Trojan-Downloader.Win32.Adload.ni skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135161.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135163.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135164.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135174.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135175.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135177.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135193.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135194.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135195.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135202.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135203.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135206.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135210.exe Infected: Trojan-Downloader.Win32.Adload.ni skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135212.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135213.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135214.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135216.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135218.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135220.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.clz skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135222.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135225.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135226.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135227.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135238.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135249.exe Infected: Trojan-Downloader.Win32.Adload.ni skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135250.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP216\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\ModemLog_Conexant D110 MDC V.9x Modem.txt Object is locked skipped C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{1156E72B-E402-4BA0-8419-512B234A630A}.crmlog Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\TempFile Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. Hijack This Log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:13:39 AM, on 1/19/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/ O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1189315894890 O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.dotphoto.com/ImageUploader4.cab O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/download...2/axofupld.cab O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://games.pogo.com/online2/pogo/b...ploader_v6.cab O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe -- End of file - 4110 bytes