Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 


Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads
Reload this Page Winfixer, Vundo, Infostealer, Popups
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read


Resolved HJT Threads Resolved spyware and popup issues.

 
 
LinkBack Thread Tools
Old 04-01-2007, 07:07 PM   #1 (permalink)
Registered User
 
Join Date: Apr 2007
Posts: 5
OS: XP Pro


Winfixer, Vundo, Infostealer, Popups
Hi I have been having problems removing winfixer, vundo, and numerous other malware.I have used the VundoFix program the winfixer tool and tried numerous other steps to get the malware off my computer. I followed all the steps on you site before posting this thread. I pasted Deckard’s System Scanner Log along with the Panda scan log, I also attached the extra and the Panda scan log. Help will be much appreciated since I have been trying to remove these components for the past week.



Deckard's System Scanner v20070328.36
Run by Administrator on 2007-04-01 at 19:53:09
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

System Restore is disabled; attempting to re-enable...success.


-- Last 1 Restore Point(s) --
1: 2007-04-01 23:53:21 UTC - RP1 - System Checkpoint


Backed up registry hives.

Performed disk cleanup.


-- HijackThis (run as Administrator.exe) ---------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 8:00:05 PM, on 4/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
F:\Program Files\University of Vermont\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Browser MOUSE\mouse32a.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Muiltmedia keyboard utility\1.3\KbdAp32A.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Documents and Settings\Administrator\Desktop\dss.exe
C:\DOCUME~1\ADMINI~1\Desktop\HIJACK~1\Administrator.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com...r/fix_homepage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.uvm.edu/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {22A005B6-73F1-47E8-BA6E-581B42C79707} - C:\WINDOWS\system32\mtafqsfm.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {57E218E6-5A80-4f0c-AB25-83598F25D7E9} - C:\WINDOWS\system32\mimiajiu.dll
O2 - BHO: (no name) - {6851522E-EDC2-4B87-BC01-7E276F373068} - (no file)
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser MOUSE\mouse32a.exe
O4 - HKLM\..\Run: [FLMK08KB] C:\Program Files\Muiltmedia keyboard utility\1.3\MMKEYBD.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [InstantTray] C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdcc...d/tgctlins.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://i.a.cnn.net/cnn/resources/cult3d/cult.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase9602.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - F:\Program Files\University of Vermont\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe


-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R0 VOBID - c:\windows\system32\drivers\vobid.sys
R1 AFS2K - c:\windows\system32\drivers\afs2k.sys
R1 Cdr4_xp - c:\windows\system32\drivers\cdr4_xp.sys
R1 Cdralw2k - c:\windows\system32\drivers\cdralw2k.sys
R1 cdudf_xp - c:\windows\system32\drivers\cdudf_xp.sys
R1 omci (OMCI WDM Device Driver) - c:\windows\system32\drivers\omci.sys
R1 pwd_2k - c:\windows\system32\drivers\pwd_2k.sys
R1 UdfReadr_xp - c:\windows\system32\drivers\udfreadr_xp.sys
R1 vobcom - c:\windows\system32\drivers\vobcom.sys
R1 vobiw - c:\windows\system32\drivers\vobiw.sys
R2 MCSTRM - c:\windows\system32\drivers\mcstrm.sys
R2 NetAlrt - c:\windows\system32\drivers\netalrt.sys
R2 NwlnkIpx (NWLink IPX/SPX/NetBIOS Compatible Transport Protocol) - c:\windows\system32\drivers\nwlnkipx.sys
R2 NwlnkNb (NWLink NetBIOS) - c:\windows\system32\drivers\nwlnknb.sys
R2 NwlnkSpx (NWLink SPX/SPXII Protocol) - c:\windows\system32\drivers\nwlnkspx.sys
R2 PlatAlrt - c:\windows\system32\drivers\platalrt.sys
R2 tmcomm - c:\windows\system32\drivers\tmcomm.sys
R3 ASAPIW2K - c:\windows\system32\drivers\asapiw2k.sys
R3 cdrdrv - c:\windows\system32\drivers\cdrdrv.sys
R3 DNE (Deterministic Network Enhancer Miniport) - c:\windows\system32\drivers\dne2000.sys
R3 E1000 (Intel(R) PRO/1000 Adapter Driver) - c:\windows\system32\drivers\e1000nt5.sys
R3 mmc_2K - c:\windows\system32\drivers\mmc_2k.sys
R3 NWRDR (NetWare Rdr) - c:\windows\system32\drivers\nwrdr.sys
R3 smwdm - c:\windows\system32\drivers\smwdm.sys

S3 ac97intc (Intel(r) 82801 Audio Driver Install Service (WDM)) - c:\windows\system32\drivers\ac97intc.sys
S3 CrucialSMBusScan - c:\windows\system32\drivers\crucialsmbusscan.sys (file missing)
S3 dvd_2K - c:\windows\system32\drivers\dvd_2k.sys
S3 EL90XBC (3Com EtherLink XL 90XB/C Adapter Driver) - c:\windows\system32\drivers\el90xbc5.sys
S3 Jukebox - c:\windows\system32\drivers\ctpdusb2.sys
S3 NMSCFG (NIC Management Service Configuration Driver) - c:\windows\system32\drivers\nmscfg.sys
S3 Pcouffin (VSO Software pcouffin) - c:\windows\system32\drivers\pcouffin.sys
S3 SABProcEnum - c:\progra~1\mozill~1\sabprocenum.sys (file missing)
S3 Ser2pl (Prolific2 Serial port driver) - c:\windows\system32\drivers\ser2pl.sys
S4 cbidf - c:\windows\system32\drivers\cbidf2k.sys
S4 dac2w2k - c:\windows\system32\drivers\dac2w2k.sys


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 ASFAgent (ASF Agent) - c:\program files\intel\asf agent\asfagent.exe
R2 CVPND (Cisco Systems, Inc. VPN Service) - "f:\program files\university of vermont\vpn client\cvpnd.exe"
R2 Iap - c:\program files\dell\openmanage\client\iap.exe
R2 NWCWorkstation (Client Service for NetWare) - c:\windows\system32\svchost.exe -k netsvcs
R2 SavRoam - "c:\program files\symantec antivirus\savroam.exe"
R2 Symantec AntiVirus - "c:\program files\symantec antivirus\rtvscan.exe"

S3 NMSSvc (Intel(R) NMS) - c:\windows\system32\nmssvc.exe
S3 ServiceLayer - "c:\program files\common files\pcsuite\services\servicelayer.exe"


-- Scheduled Tasks -------------------------------------------------------------

2007-04-01 19:09:21 358 --a------ C:\WINDOWS\Tasks\HP Usg Daily.job<HPUSGD~1.JOB>
2007-04-01 17:33:05 330 --ah----- C:\WINDOWS\Tasks\MP Scheduled Scan.job<MPSCHE~1.JOB>
2007-03-27 05:00:00 458 --ah----- C:\WINDOWS\Tasks\Green Technologies LLC. 1156822041.job<GREENT~1.JOB>


-- Files created between 2007-03-01 and 2007-04-01 -----------------------------

2007-04-01 19:37:34 21312 --a------ C:\WINDOWS\choice.exe
2007-04-01 19:36:35 0 d-------- C:\ie-spyad
2007-04-01 19:34:01 0 d-------- C:\Program Files\SpywareGuard<SPYWAR~2>
2007-04-01 19:30:24 0 d-------- C:\Program Files\SpywareBlaster<SPYWAR~1>
2007-04-01 17:42:21 0 d-------- C:\WINDOWS\system32\ActiveScan<ACTIVE~1>
2007-04-01 17:42:18 0 d-------- C:\WINDOWS\LastGood
2007-04-01 16:05:46 0 d-------- C:\Documents and Settings\Administrator\Application Data\Lavasoft
2007-04-01 16:05:31 0 d-------- C:\Program Files\Lavasoft
2007-04-01 16:04:51 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard<WISEIN~1>
2007-03-31 02:26:19 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2007-03-31 02:25:50 75512 --a------ C:\WINDOWS\zllsputility.exe<ZLLSPU~1.EXE>
2007-03-31 02:25:49 11264 --a------ C:\WINDOWS\system32\SpOrder.dll
2007-03-31 02:25:05 1087216 --a------ C:\WINDOWS\system32\zpeng24.dll
2007-03-31 02:25:05 0 d-------- C:\WINDOWS\system32\ZoneLabs
2007-03-31 00:23:58 1272246 ---hs---- C:\WINDOWS\system32\tvvwa.bak1<TVVWA~1.BAK>
2007-03-30 15:55:48 132116 --a------ C:\WINDOWS\system32\mtafqsfm.dll
2007-03-30 15:55:22 48708 --a------ C:\WINDOWS\system32\mimiajiu.dll
2007-03-26 10:45:06 0 d-------- C:\Program Files\Windows Live Safety Center<WIE5D0~1>
2007-03-26 04:21:16 0 d-------- C:\VundoFix Backups<VUNDOF~1>
2007-03-26 01:40:41 1234857 ---hs---- C:\WINDOWS\system32\nqtss.bak1<NQTSS~1.BAK>
2007-03-25 19:09:07 1234897 ---hs---- C:\WINDOWS\system32\abadd.bak1<ABADD~1.BAK>
2007-03-25 18:05:29 1234857 ---hs---- C:\WINDOWS\system32\oqtss.bak1<OQTSS~1.BAK>
2007-03-25 18:04:38 280676 ---hs---- C:\WINDOWS\system32\vtutq.dll
2007-03-25 14:52:53 1234857 ---hs---- C:\WINDOWS\system32\ijjlm.bak1<IJJLM~1.BAK>
2007-03-25 14:52:08 280676 ---hs---- C:\WINDOWS\system32\vtsqp.dll
2007-03-25 14:24:54 1234857 ---hs---- C:\WINDOWS\system32\cfhkj.bak1<CFHKJ~1.BAK>
2007-03-25 14:24:09 280676 ---hs---- C:\WINDOWS\system32\ddabc.dll
2007-03-25 14:00:22 132116 --a------ C:\WINDOWS\system32\yxycjxeq.dll
2007-03-25 13:59:43 1234857 ---hs---- C:\WINDOWS\system32\dccdd.bak1<DCCDD~1.BAK>
2007-03-25 05:19:35 1233962 ---hs---- C:\WINDOWS\system32\rqtwa.ini2<RQTWA~1.INI>
2007-03-25 04:36:51 1233962 ---hs---- C:\WINDOWS\system32\rqtwa.bak1<RQTWA~1.BAK>
2007-03-25 03:29:25 280676 -----n--- C:\WINDOWS\system32\geebc.dll
2007-03-25 02:57:24 1234857 ---hs---- C:\WINDOWS\system32\rrqss.bak1<RRQSS~1.BAK>
2007-03-25 01:51:57 132116 --a------ C:\WINDOWS\system32\uxlojsta.dll
2007-03-25 00:59:53 0 d-------- C:\Program Files\Windows Defender<WIFD1F~1>
2007-03-25 00:25:42 0 d-------- C:\WINDOWS\network diagnostic<NETWOR~1>
2007-03-25 00:05:26 1233962 ---hs---- C:\WINDOWS\system32\knnmp.bak1<KNNMP~1.BAK>
2007-03-24 20:45:37 1234857 ---hs---- C:\WINDOWS\system32\mlnmp.bak1<MLNMP~1.BAK>
2007-03-24 19:54:46 1242724 ---hs---- C:\WINDOWS\system32\ilkkj.ini2<ILKKJ~1.INI>
2007-03-24 19:47:12 1234913 ---hs---- C:\WINDOWS\system32\ilkkj.bak1<ILKKJ~1.BAK>
2007-03-24 19:36:49 0 --a------ C:\WINDOWS\ORUN32.EXE
2007-03-24 19:36:36 0 --a------ C:\WINDOWS\system32\CMMGR32.EXE
2007-03-24 19:23:34 0 d-------- C:\WINDOWS\system32\SuperAdBlocker.com<SUPERA~1.COM>
2007-03-24 16:47:03 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com<SUPERA~1.COM>
2007-03-24 16:46:28 0 d-------- C:\Program Files\SUPERAntiSpyware<SUPERA~1>
2007-03-24 16:46:28 0 d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com<SUPERA~1.COM>
2007-03-24 14:57:27 1234897 ---hs---- C:\WINDOWS\system32\rtstv.bak2<RTSTV~1.BAK>
2007-03-23 21:07:12 353 ---hs---- C:\WINDOWS\system32\dgjlm.ini2<DGJLM~1.INI>
2007-03-23 21:02:12 0 d-------- C:\WINDOWS\FLV Player<FLVPLA~1>
2007-03-23 18:49:06 76560 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2007-03-23 18:45:00 0 d-------- C:\Program Files\InterMute<INTERM~1>
2007-03-22 18:18:03 26697 --a------ C:\WINDOWS\system32\hggfeeb.dll
2007-03-22 0541 47360 --a------ C:\Documents and Settings\Administrator\Application Data\pcouffin.sys
2007-03-22 0541 87608 --a------ C:\Documents and Settings\Administrator\Application Data\ezpinst.exe
2007-03-22 04:38:17 47360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2007-03-22 04:37:50 0 d-------- C:\Program Files\Common Files\Download Manager<DOWNLO~1>
2007-03-22 04:07:25 0 d-------- C:\Program Files\Multi Install 2.3<MULTII~1.3>
2007-03-21 19:39:25 0 d-------- C:\Documents and Settings\All Users\Application Data\River Past G5<RIVERP~1>
2007-03-21 19:25:26 180224 --a------ C:\WINDOWS\system32\xvidvfw.dll
2007-03-21 19:25:26 761856 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-03-21 15:20:17 0 d-------- C:\Documents and Settings\Administrator\Application Data\DivX
2007-03-16 01:10:16 0 d-------- C:\Program Files\utorrent
2007-03-15 23:50:04 0 d-------- C:\Documents and Settings\Administrator\Application Data\uTorrent
2007-03-09 20:37:37 0 d-------- C:\WINDOWS\system32\Sony PSP USB Device<SONYPS~1>
2007-03-07 02:37:10 0 d-------- C:\Documents and Settings\Administrator\Application Data\Oracle
2007-03-07 02:29:49 0 d-------- C:\Program Files\Oracle
2007-03-07 02:08:20 87808 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2007-03-07 02:08:20 107696 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-03-07 02:07:12 0 d-------- C:\Program Files\Symantec AntiVirus<SYMANT~1>
2007-03-07 02:04:35 0 d-------- C:\SAVInst
2007-03-07 00:57:58 0 d-------- C:\Program Files\iPod
2007-03-07 00:57:35 0 d-------- C:\Program Files\iTunes


-- Find3M Report ---------------------------------------------------------------

2007-04-01 19:21:20 26993 --a------ C:\WINDOWS\mozver.dat
2007-04-01 18:17:40 0 d-------- C:\Program Files\Common Files\Symantec Shared<SYMANT~1>
2007-04-01 18:16:30 0 d-------- C:\Program Files\Browser MOUSE<BROWSE~1>
2007-03-30 04:41:07 2932 --a------ C:\WINDOWS\system32\d3d9caps.dat
2007-03-25 18:08:01 33 --a------ C:\Documents and Settings\Administrator\Application Data\pcouffin.log
2007-03-25 18:07:56 1144 --a------ C:\Documents and Settings\Administrator\Application Data\pcouffin.inf
2007-03-25 18:07:56 1074 --a------ C:\Documents and Settings\Administrator\Application Data\pcouffin.cat
2007-03-24 20:50:04 0 d-------- C:\Program Files\Common Files\AOL
2007-03-07 02:08:21 0 d-------- C:\Program Files\Symantec
2007-03-07 0246 0 d-------- C:\Program Files\NavNT
2007-03-07 00:55:12 0 d-------- C:\Program Files\QuickTime<QUICKT~1>
2007-03-06 21:08:38 0 d-------- C:\Program Files\Starcraft<STARCR~1>
2007-02-28 10:04:42 0 d-------- C:\Documents and Settings\Administrator\Application Data\Viewpoint<VIEWPO~1>
2007-02-23 00:29:58 524288 --a------ C:\WINDOWS\system32\DivXsm.exe
2007-02-23 00:29:56 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-02-23 00:29:52 118520 -----n--- C:\WINDOWS\system32\pxinsi64.exe
2007-02-23 00:29:52 116472 -----n--- C:\WINDOWS\system32\pxcpyi64.exe
2007-02-23 00:29:52 129784 -----n--- C:\WINDOWS\system32\pxafs.dll
2007-02-23 00:29:49 200704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-02-23 00:29:49 1044480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-02-23 00:25:24 196608 --a------ C:\WINDOWS\system32\dtu100.dll
2007-02-23 00:25:24 73728 --a------ C:\WINDOWS\system32\dpl100.dll
2007-02-23 00:25:23 53248 --a------ C:\WINDOWS\system32\dpuGUI10.dll
2007-02-23 00:25:22 57344 --a------ C:\WINDOWS\system32\dpv11.dll
2007-02-23 00:25:22 344064 --a------ C:\WINDOWS\system32\dpus11.dll
2007-02-23 00:25:22 593920 --a------ C:\WINDOWS\system32\dpuGUI11.dll
2007-02-23 00:25:22 294912 --a------ C:\WINDOWS\system32\dpu11.dll
2007-02-23 00:25:22 294912 --a------ C:\WINDOWS\system32\dpu10.dll
2007-02-23 00:25:19 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll<DIVX_X~3.DLL>
2007-02-23 00:25:19 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll<DIVX_X~1.DLL>
2007-02-23 00:25:19 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll<DIVX_X~2.DLL>
2007-02-22 02:54:54 0 d-------- C:\Program Files\AIM95
2007-02-22 02:54:34 0 d-------- C:\Documents and Settings\Administrator\Application Data\Aim
2007-02-20 18:26:02 0 d-------- C:\Program Files\Java
2007-02-15 21:40:35 124472 --a------ C:\WINDOWS\system32\DivXCodecUpdateChecker.exe<DIVXCO~1.EXE>
2007-02-09 05:43:00 0 d-------- C:\Documents and Settings\Administrator\Application Data\AdobeUM
2007-02-08 04:24:18 0 d-------- C:\Program Files\Trillian
2007-02-06 21:07:39 0 d-------- C:\Program Files\AIM6
2007-02-02 21:48:35 0 d-------- C:\Documents and Settings\Administrator\Application Data\acccore
2007-02-02 21:44:22 0 d-------- C:\Program Files\Common Files\Nullsoft
2007-02-02 16:01:04 0 d-------- C:\Program Files\Recolored<RECOLO~1>
2007-01-18 01:03:45 4 --a------ C:\WINDOWS\system32\862704
2007-01-08 19:01:14 17408 --a------ C:\WINDOWS\system32\corpol.dll


-- Registry Dump ---------------------------------------------------------------


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"InstantTray"="C:\\Program Files\\Pinnacle\\Shared Files\\InstantCDDVD\\PCLETray.exe"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ATIModeChange"="Ati2mdxx.exe"
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"FLMOFFICE4DMOUSE"="C:\\Program Files\\Browser MOUSE\\mouse32a.exe"
"FLMK08KB"="C:\\Program Files\\Muiltmedia keyboard utility\\1.3\\MMKEYBD.EXE"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_11\\bin\\jusched.exe\""
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"vptray"="C:\\PROGRA~1\\SYMANT~1\\VPTray.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"PinnacleDriverCheck"="C:\\WINDOWS\\System32\\PSDrvCheck.exe"
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"ZoneAlarm Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"MMTray"="C:\\Program Files\\Musicmatch\\Musicmatch Jukebox\\mm_tray.exe"
"MimBoot"="C:\\PROGRA~1\\MUSICM~1\\MUSICM~1\\mimboot.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"AdaptecDirectCD"="\"C:\\Program Files\\Roxio\\Easy CD Creator 5\\DirectCD\\DirectCD.exe\""
"PinnacleDriverCheck"="C:\\WINDOWS\\System32\\PSDrvCheck.exe"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"starzd"="\"C:\\Program Files\\Real\\RealPlayer\\starz\\starzd.exe\" 86400000"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Adobe Reader Speed Launch.lnk"
"backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Adobe\\ACROBA~3.0\\Reader\\READER~1.EXE "
"item"="Adobe Reader Speed Launch"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\QuickBooks Update Agent.lnk"
"backup"="C:\\WINDOWS\\pss\\QuickBooks Update Agent.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\COMMON~1\\Intuit\\QUICKB~1\\QBUpdate\\qbupdate.exe "
"item"="QuickBooks Update Agent"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^University of Vermont VPN Client.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\University of Vermont VPN Client.lnk"
"backup"="C:\\WINDOWS\\pss\\University of Vermont VPN Client.lnkCommon Startup"
"location"="Common Startup"
"command"="F:\\PROGRA~1\\UNIVER~1\\VPNCLI~1\\vpngui.exe \"-user_logon\""
"item"="University of Vermont VPN Client"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ymetray.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\ymetray.lnk"
"backup"="C:\\WINDOWS\\pss\\ymetray.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Yahoo!\\YAHOO!~1\\ymetray.exe C:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe -preload"
"item"="ymetray"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="aim6"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\AIM6\\aim6.exe\" /d locale=en-US ee://aol/imApp"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hpcmpmgr"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="HPWuSchd2"
"hkey"="HKLM"
"command"="C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWuSchd2.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hpztsb09"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\hpztsb09.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon05]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hphmon05"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\hphmon05.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD05]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hphupd05"
"hkey"="HKLM"
"command"="C:\\Program Files\\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\\hphupd05.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="iTunesHelper"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="mimboot"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\MUSICM~1\\MUSICM~1\\mimboot.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="LAUNCH~1"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\Nokia\\NOKIAP~1\\LAUNCH~1.EXE -startup"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PcSync2"
"hkey"="HKCU"
"command"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\PcSync2.exe /NoDialog"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="realsched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WatchDog]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="WatchDog"
"hkey"="HKLM"
"command"="C:\\Program Files\\mobile PhoneTools\\WatchDog.exe"
"inimapping"="0"


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook"
"{E44527F6-1296-4A84-B67D-A6CEA6ED4B69}"=""
"{33CFF9A3-7ECB-4382-806D-AB0138BC7386}"=""
"{81559C35-8464-49F7-BB0E-07A383BEF910}"=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="\"C:\\PROGRA~1\\COMMON~1\\MICROS~1\\DW\\dwtrig20.exe\" -t"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoCDBurning"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source REG_SZ file:///C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/msohtml1/10/clip_image001.jpg

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
Source REG_SZ file:///C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/msohtml1/10/clip_image002.jpg

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0



-- End of Deckard's System Scanner: finished at 2007-04-01 at 20:01:15 ---------


Incident Status Location

Spyware:Spyware/Vundo Not disinfected C:\WINDOWS\system32\mimiajiu.dll
Dialer:dialer.bny Not disinfected c:\windows\pcconfig.dat
Adware:adware/secure32 Not disinfected c:\windows\securea.html
Adware:adware/delta Not disinfected Windows Registry
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Administrator\.jpi_cache\file\1.0\Gummy.class-421ef8d3-1604063e.class
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Administrator\.jpi_cache\jar\1.0\archive.jar-5ab18800-2e72362a.zip[Dummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Administrator\.jpi_cache\jar\1.0\archive.jar-6d2f0470-6bc52143.zip[Dummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Administrator\.jpi_cache\jar\1.0\archive1213.jar-455277fe-35d17a88.zip[Dummy.class]
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ik57k27d.Default User1\cookies.txt[.statcounter.com/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ik57k27d.Default User1\cookies.txt[.hitbox.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ik57k27d.Default User1\cookies.txt[.advertising.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ik57k27d.Default User1\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ik57k27d.Default User1\cookies.txt[.advertising.com/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ik57k27d.Default User1\cookies.txt[.fastclick.net/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ik57k27d.Default User1\cookies.txt[.atdmt.com/]
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ik57k27d.Default User1\cookies.txt[.ads.pointroll.com/]
Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ik57k27d.Default User1\cookies.txt[.trafficmp.com/]
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ik57k27d.Default User1\cookies.txt[.questionmarket.com/]
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ik57k27d.Default User1\cookies.txt[.overture.com/]
Spyware:Cookie/cs.sexcounter Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ik57k27d.Default User1\cookies.txt[.cs.sexcounter.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ik57k27d.Default User1\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ik57k27d.Default User1\cookies.txt[.atwola.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ik57k27d.Default User1\cookies.txt[.2o7.net/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ik57k27d.Default User1\cookies.txt[.mediaplex.com/]
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ik57k27d.Default User1\cookies.txt[.adrevolver.com/]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ik57k27d.Default User1\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ik57k27d.Default User1\cookies.txt[.realmedia.com/]
Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ik57k27d.Default User1\cookies.txt[.z1.adserver.com/]
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ik57k27d.Default User1\cookies.txt[.zedo.com/]
Spyware:Cookie/SexList Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ik57k27d.Default User1\cookies.txt[.sexlist.com/]
Spyware:Cookie/Bfast Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ik57k27d.Default User1\cookies.txt[.bfast.com/]
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ik57k27d.Default User1\cookies.txt[.bluestreak.com/]
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ik57k27d.Default User1\cookies.txt[.toplist.cz/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.advertising.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.2o7.net/]
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.atwola.com/]
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.ads.pointroll.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.ads.pointroll.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.questionmarket.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.bs.serving-sys.com/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.statcounter.com/]
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.overture.com/]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.trafficmp.com/]
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.casalemedia.com/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.hitbox.com/]
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.perf.overture.com/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.fastclick.net/]
Spyware:Cookie/PayCounter Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.paycounter.com/]
Spyware:Cookie/SexList Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.sexlist.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.realmedia.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.zedo.com/]
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.adrevolver.com/]
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[statse.webtrendslive.com/]
Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.z1.adserver.com/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.xiti.com/]
Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.maxserving.com/]
Spyware:Cookie/cs.sexcounter Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.cs.sexcounter.com/]
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.bluestreak.com/]
Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.yadro.ru/]
Spyware:Cookie/MediaTickets Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ri6pdthv.default\cookies.txt[.kinghost.com/]
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\apv05843.slt\cookies.txt[.questionmarket.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\apv05843.slt\cookies.txt[.doubleclick.net/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\apv05843.slt\cookies.txt[.fastclick.net/]
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\apv05843.slt\cookies.txt[.bluestreak.com/]
Spyware:Cookie/Bfast Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\apv05843.slt\cookies.txt[.bfast.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\apv05843.slt\cookies.txt[.atdmt.com/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\apv05843.slt\cookies.txt[.mediaplex.com/]
Spyware:Cookie/CentrPort Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\apv05843.slt\cookies.txt[.centrport.net/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\apv05843.slt\cookies.txt[.mediaplex.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\apv05843.slt\cookies.txt[.advertising.com/]
Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\apv05843.slt\cookies.txt[.trafficmp.com/]
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@atwola[1].txt
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@burstnet[2].txt
Spyware:Cookie/Ccbill Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@ccbill[1].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@com[1].txt
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@drivecleaner[1].txt
Spyware:Cookie/Outster Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@outster[1].txt
Spyware:Cookie/Reliablestats Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@stats1.reliablestats[1].txt
Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@winantispyware[1].txt
Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@winantivirus[1].txt
Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@www.burstbeacon[1].txt
Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@www.winantivirus[1].txt
Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@www1.addfreestats[1].txt
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@xiti[1].txt
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Administrator\Desktop\VirtumundoBeGone.exe[²ƒÇ]
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\nse5.tmp
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\nsx5.tmp
Adware:Adware/Startpage.ACY Not disinfected C:\Program Files\Support.com\adelphia\scripts\IEconfig.vbs
Spyware:Cookie/Atwola Not disinfected C:\WINDOWS\Temp\Cookies\administrator@atwola[1].txt
J108 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Important Information
Join the #1 Tech Support Forum Today - It's Totally Free!

TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free.

Join TechSupportforum.com Today - Click Here

Old 04-06-2007, 04:07 PM   #2 (permalink)
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
 
Glaswegian's Avatar
 
Join Date: Sep 2005
Location: Glasgow
Posts: 25,427
OS: Win XP Pro SP3 / Win 7 Pro

My System

Blog Entries: 10
Re: Winfixer, Vundo, Infostealer, Popups
Hi and welcome to TSF.

Apologies for any delay in replying, but we have been rather busy lately, and, of course, all our helpers are volunteers.

My name is Iain and I will be helping you clean your system.

I couldn’t find extra.txt – can you try and attach it again?


You may wish to Subscribe to this thread (Thread Tools > Subscribe to this thread) so that you are notified when you receive a reply.

Please read these instructions carefully and then print out or copy this page to Notepad in order to assist you when carrying out the fix. You should not have any open browsers or live internet connections when you are following the procedures below.

Note that the fix may take several posts. Please continue to respond to my instructions until I confirm that your log is clean. Remember that although your symptoms may vanish, this does NOT mean that your system is clean.

If there is anything you don't understand, please ask BEFORE proceeding with the fixes.

Please ensure that you follow the instructions in the order I have them listed.


Clear your Firefox cookies. From the open browser, go to Tools > Options > Privacy > Cookies > Clear.


Clear your IE cookies. Start > Settings > Control Panel > Internet Options > General tab > under Temporary files, click on Delete Cookies.



Show Hidden Files
Go to My Computer > Tools > Folder Options > View tab and make sure that Show hidden files and folders is enabled. Also make sure that the System files and Folders are showing / visible. Uncheck the Hide protected operating system files option.


Do you know what this folder is – or what the contents are?

C:\WINDOWS\system32\862704


Downloads
Please download Cleanup! or use this Alternate Link if the main link does not work and install it. You will use this later.
*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does NOT make backups. If you have any files in any TEMP directory and you need to keep them, then please MOVE THEM NOW!


Download AVG Anti Spyware

Use the link at the bottom of the page under "AVG Anti-Spyware Free for Windows"


  • Install AVG Anti Spyware
  • Double-click the icon on Desktop to launch AVG
  • On the top of the main screen click Shield
  • Click the word active to change it to inactive
  • On the top of the main screen click Update.
  • Then click on Start Update. The update will start and a progress bar will show the updates being installed.
  • Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
  • Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
  • Under "Reports"
    • Select "Automatically generate report after every scan"
    • Un-Select "Only if threats were found"

When you have finished updating, EXIT AVG Anti Spyware.


Download this file - combofix.exe to your desktop.
Alternate link.

IMPORTANT - You must place combofix on your desktop!!


Run Combofix



Click the Windows 'Start' button > Select Run - then copy and paste the red line of text below into the run box & click OK

"%userprofile%\desktop\combofix.exe" /v mtafqsfm mimiajiu vtutq vtsqp ddabc yxycjxeq geebc uxlojsta hggfeeb

When finished, the tool will produce a log for you at c:\combofix.txt. Post that log in your next reply.

Note: Do not mouseclick combofix's window while it's running. That may cause it to stall.



Disable Windows Defender
Please disable your Windows Defender Real-time Protection, as it may hinder the removal of some entries.
  • Open Windows Defender.
  • Click on Tools, General Settings.
  • Scroll down and uncheck Turn on real-time protection (recommended).
  • After you uncheck this, click on the Save button and close Windows Defender.



Disable SpywareGuard
Please disable Spywareguard, as it may hinder the removal of some entries. You can re-enable it after you're clean.
  • Right click the running icon of Spywareguard located in the system tray (near the clock - bottom right corner)
  • Go to Menu > File > Exit and confirm the programme's close.




Reboot
Reboot your system in Safe Mode.
  • Restart the computer. The computer begins processing a set of instructions known as BIOS.
  • After hearing your computer beep once during startup, but before the Windows icon appears, press F8 (dependent on your system this may be F5 or another key)
  • Instead of Windows loading as normal, a menu should appear
  • Use the arrow key to highlight Safe Mode and press Enter.



Uninstall Programmes
Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs (if present):

ViewMgr or anything Viewpoint




HijackThis Entries
Open Hijack This and click on Scan. Check the following entries (if they still exist) (make sure you do not miss any)

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {6851522E-EDC2-4B87-BC01-7E276F373068} - (no file)

Please remember to close all other windows, including browsers then click Fix checked.




File Deletions
Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

c:\windows\pcconfig.dat
c:\windows\securea.html
c:\Program Files\Viewpoint
C:\Documents and Settings\Administrator\Application Data\Viewpoint




Run CleanUp!
*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does NOT make backups. If you have any files in any TEMP directory and you need to keep them, then please MOVE THEM NOW!

Open Cleanup! by double-clicking the icon on your desktop (or from Start > All Programs). Set the program up as follows:

Click Options
Move the slider button down to Custom CleanUp!
Check the following:
  • Empty Recycle Bins
  • Delete Cookies
  • Delete Prefetch files
  • Cleanup! All Users
  • Click on the “Temporary Files” tab and uncheck the box for “Scan drives for file matching” if it’s checked.

Click OK, Press the CleanUp! button to start the program and DO NOT REBOOT when prompted.
Note: CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these BEFORE running CleanUp! If you have a 64 bit Operating System do NOT run Cleanup and let me know as we will use another utility.




Run AVG Anti Spyware
Run AVG with it's updated definitions (...it's important that all windows must be closed)
  • Click Scanner
  • Click on the Scan tab
  • Click Complete System Scan to begin scanning.
  • When the scan is complete click Recommended Action and change it to Quarantine
  • Then click Apply all actions
Once finished, click the Save report button, then click Save Report As and save it to your desktop.

NOTE: AVG scan may require an hour.



Reboot
Reboot your system in Normal Mode.



Logs required
c:\combofix.txt
AVG Log
HijackThis Log

Please also let me know how your system is performing now and if you have any specific problems. In order to provide you with the best possible help, please ensure that HijackThis logs are produced only while in Normal Mode.
__________________
Iain - Defender of the Haggis and all things Scottish.
I don't help by PM - post in the Forums.



PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner
Glaswegian is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 04-10-2007, 06:11 PM   #3 (permalink)
Registered User
 
Join Date: Apr 2007
Posts: 5
OS: XP Pro


Re: Winfixer, Vundo, Infostealer, Popups
Re: Winfixer, Vundo, Infostealer, Popups

--------------------------------------------------------------------------------
Hi Iain,

First off I want to thank you for volunteering your time it is a very noble thing to do and very much appreciated. The delay is no problem my computer would stay infected with out your help as I have run out of ideas.
I reattached the old Deckard Systems extra.txt log that you could not find before I followed your instructions.
I have no idea what this is : C:\WINDOWS\system32\862704
I uninstalled a viewpoint program.
I removed both the R0 and O2 entries in Hijack this.
I removed the following files and folders:
c:\windows\pcconfig.dat
c:\windows\securea.html
c:\Program Files\Viewpoint
C:\Documents and Settings\Administrator\Application Data\Viewpoint

I followed all your instructions and attached the following logs.

Logs required
Extra.txt
c:\combofix.txt
AVG Log
HijackThis Log in Safe Mode
HijackThis Log in Normal mode

Here is Hijack this log from safe mode:
Logfile of HijackThis v1.99.1
Scan saved at 11:23:55 PM, on 4/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Administrator\Desktop\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com...r/fix_homepage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.uvm.edu/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {6851522E-EDC2-4B87-BC01-7E276F373068} - (no file)
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser MOUSE\mouse32a.exe
O4 - HKLM\..\Run: [FLMK08KB] C:\Program Files\Muiltmedia keyboard utility\1.3\MMKEYBD.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [InstantTray] C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdcc...d/tgctlins.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://i.a.cnn.net/cnn/resources/cult3d/cult.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase9602.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - F:\Program Files\University of Vermont\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Here is the Hijack this log from normal mode after I followed instructions:
Logfile of HijackThis v1.99.1
Scan saved at 8:02:58 PM, on 4/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
F:\Program Files\University of Vermont\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Browser MOUSE\mouse32a.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Muiltmedia keyboard utility\1.3\KbdAp32A.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\WINDOWS\msagent\AgentSvr.exe
C:\Documents and Settings\Administrator\Desktop\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com...r/fix_homepage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.uvm.edu/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser MOUSE\mouse32a.exe
O4 - HKLM\..\Run: [FLMK08KB] C:\Program Files\Muiltmedia keyboard utility\1.3\MMKEYBD.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [InstantTray] C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdcc...d/tgctlins.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://i.a.cnn.net/cnn/resources/cult3d/cult.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase9602.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - F:\Program Files\University of Vermont\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

So far I have not had any problems but I have only been using my computer for an hour after I followed your instructions. I look forward to hearing from you.

Thanks once again
Attached Files
File Type: txt ComboFix-quarantined-files.txt (633 Bytes, 1 views)
File Type: txt ComboFix.txt (19.1 KB, 1 views)
File Type: txt Report-Scan-20070410-180456.txt (31.2 KB, 1 views)
File Type: txt extra.txt (16.4 KB, 1 views)
J108 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 04-11-2007, 01:54 PM   #4 (permalink)
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
 
Glaswegian's Avatar
 
Join Date: Sep 2005
Location: Glasgow
Posts: 25,427
OS: Win XP Pro SP3 / Win 7 Pro

My System

Blog Entries: 10
Re: Winfixer, Vundo, Infostealer, Popups
Hi again

Please read these instructions carefully and then print out or copy this page to Notepad in order to assist you when carrying out the fix. You should not have any open browsers or live internet connections when you are following the procedures below.


I need you to run combofix again – please follow my instructions carefully if we are to remove the malware files from your system. You should copy and paste the line of red text as described below.


Run Combofix



Click the Windows 'Start' button > Select Run - then copy and paste the red line of text below into the run box & click OK

"%userprofile%\desktop\combofix.exe" /v awvvt.dll urqpmnn.dll vtsqp ddabc yxycjxeq geebc uxlojsta hggfeeb opnnnkl.dll

When finished, the tool will produce a log for you at c:\combofix.txt. Post that log in your next reply.

Note: Do not mouseclick combofix's window while it's running. That may cause it to stall.



Online Scan
Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky WebScanner

Next Click on Kaspersky Online Scanner


A Welcome screen will appear - click 'Accept' at the bottom. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
Scan using the following Anti-Virus database:
  • Extended
Scan Options:
  • Scan Archives
  • Scan Mail Bases
Click OK

Now under select a target to scan: Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post.
Take note of the name(s) and location(s) of any file(s) it detects but fails to clean.

* Turn off the real time scanner of any existing antivirus program while performing the online scan

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.



Please post back with c:\combofix.txt, Kaspersky Log and a fresh HijackThis Log.
__________________
Iain - Defender of the Haggis and all things Scottish.
I don't help by PM - post in the Forums.



PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner
Glaswegian is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 04-11-2007, 11:55 PM   #5 (permalink)
Registered User
 
Join Date: Apr 2007
Posts: 5
OS: XP Pro


Re: Winfixer, Vundo, Infostealer, Popups
Hi Iain,

I have attached all of the logs and followed your instructions.
Please tell me how to proceed.
Thanks

Kaspersky Online Scan
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Thursday, April 12, 2007 1:53:11 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 12/04/2007
Kaspersky Anti-Virus database records: 296011
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
F:\
G:\
H:\

Scan Statistics:
Total number of scanned objects: 77294
Number of viruses found: 8
Number of infected objects: 85 / 0
Number of suspicious objects: 0
Duration of the scan process: 02:16:55

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Inbox/[From "Experience, Inc." <jesse@experience.com>][Date Fri, 18 Nov 2005 05:02:41 -0500]/UNNAMED/[From "eBay Member: lask8snow" <sm-member@ebay.com>][Date Fri, 18 Nov 2005 14:05:16 -0800]/UNNAMED/[From "endofitem@ebay.com" <endofitem@ebay.com>][Date Fri, 18 Nov 2005 14:09:10 -0800]/UNNAMED/[From from [138.88.226.200] by ws6-3.us4.outblaze.com with http for][Date Sun, 18 Dec 2005 09:55:10 - ... /[From eBay Inc <custservice_ref_42863952@ebay.com>][Date Tue, 20 Dec 2005 08:11:02 -060 ... /html Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Inbox/[From "Experience, Inc." <jesse@experience.com>][Date Fri, 18 Nov 2005 05:02:41 -0500]/UNNAMED/[From "eBay Member: lask8snow" <sm-member@ebay.com>][Date Fri, 18 Nov 2005 14:05:16 -0800]/UNNAMED/[From "endofitem@ebay.com" <endofitem@ebay.com>][Date Fri, 18 Nov 2005 14:09:10 -0800]/UNNAMED/[From from [138.88.226.200] by ws6-3.us4.outblaze.com with http for][Date Sun, 18 Dec 2005 09:55:10 - ... /[From eBay Inc <custservice_ref_42863952@ebay.com>][Date Tue, 20 Dec 2005 08:11:02 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Inbox/[From "Experience, Inc." <jesse@experience.com>][Date Fri, 18 Nov 2005 05:02:41 -0500]/UNNAMED/[From "eBay Member: lask8snow" <sm-member@ebay.com>][Date Fri, 18 Nov 2005 14:05:16 -0800]/UNNAMED/[From "endofitem@ebay.com" <endofitem@ebay.com>][Date Fri, 18 Nov 2005 14:09:10 -0800]/UNNAMED/[From from [138.88.226.200] by ws6-3.us4.outblaze.com with http for][Date Sun, 18 Dec 2005 09:55:10 -0800]/UNNAMED/[From "ACS Webmaster" <mailreply@acs.org>][Date Mon, 19 Dec 2005 21:28:36 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Inbox/[From "Experience, Inc." <jesse@experience.com>][Date Fri, 18 Nov 2005 05:02:41 -0500]/UNNAMED/[From "eBay Member: lask8snow" <sm-member@ebay.com>][Date Fri, 18 Nov 2005 14:05:16 -0800]/UNNAMED/[From "endofitem@ebay.com" <endofitem@ebay.com>][Date Fri, 18 Nov 2005 14:09:10 -0800]/UNNAMED/[From from [138.88.226.200] by ws6-3.us4.outblaze.com with http for][Date Sun, 18 Dec 2005 09:55 ... /[From "B ... /[From eBay <support_refnum_0453798@ebay.com>][Date Mon, 26 Dec 2005 08:07:58 +0200]/html Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Inbox/[From "Experience, Inc." <jesse@experience.com>][Date Fri, 18 Nov 2005 05:02:41 -0500]/UNNAMED/[From "eBay Member: lask8snow" <sm-member@ebay.com>][Date Fri, 18 Nov 2005 14:05:16 -0800]/UNNAMED/[From "endofitem@ebay.com" <endofitem@ebay.com>][Date Fri, 18 Nov 2005 14:09:10 -0800]/UNNAMED/[From from [138.88.226.200] by ws6-3.us4.outblaze.com with http for][Date Sun, 18 Dec 2005 09:55 ... /[From "Buy.com Coupon"<buy.com_offers@enews.buy.com>][Date Fri, 23 Dec 2005 23:17:35 -0500 (EST)]/text Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Inbox/[From "Experience, Inc." <jesse@experience.com>][Date Fri, 18 Nov 2005 05:02:41 -0500]/UNNAMED/[From "eBay Member: lask8snow" <sm-member@ebay.com>][Date Fri, 18 Nov 2005 14:05:16 -0800]/UNNAMED/[From "endofitem@ebay.com" <endofitem@ebay.com>][Date Fri, 18 Nov 2005 14:09:10 -0800]/UNNAMED/[From from [138.88.226.200] by ws6-3.us4.outblaze.com with http for][Date Sun, 18 Dec 2005 09:55: ... /[From "Weight Watchers" <WeightWatchers@lastminoffers.com>][Date Mon, 2 Jan 2006 1133 -0600]/html Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Inbox/[From "Experience, Inc." <jesse@experience.com>][Date Fri, 18 Nov 2005 05:02:41 -0500]/UNNAMED/[From "eBay Member: lask8snow" <sm-member@ebay.com>][Date Fri, 18 Nov 2005 14:05:16 -0800]/UNNAMED/[From "endofitem@ebay.com" <endofitem@ebay.com>][Date Fri, 18 Nov 2005 14:09:10 -0800]/UNNAMED/[From from [138.88.226.200] by ws6-3.us4.outblaze.com with http for][Date Sun, 18 Dec 2005 09:55: ... /[From "rosereffell@hotmail.com" <rosereffell@hotmail.com>][Date Fri, 23 Dec 2005 14:50:44 -0500]/text Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Inbox/[From "Experience, Inc." <jesse@experience.com>][Date Fri, 18 Nov 2005 05:02:41 -0500]/UNNAMED/[From "eBay Member: lask8snow" <sm-member@ebay.com>][Date Fri, 18 Nov 2005 14:05:16 -0800]/UNNAMED/[From "endofitem@ebay.com" <endofitem@ebay.com>][Date Fri, 18 Nov 2005 14:09:10 -0800]/UNNAMED/[From from [138.88.226.200] by ws6-3.us4.outblaze.com with http for][Date Sun, 18 Dec 2005 09:55:10 -0800 ... /[From "Coldplay" <coldplay@email.coldplay.com>][Date Fri, 23 Dec 2005 1314 -0000]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Inbox/[From "Experience, Inc." <jesse@experience.com>][Date Fri, 18 Nov 2005 05:02:41 -0500]/UNNAMED/[From "eBay Member: lask8snow" <sm-member@ebay.com>][Date Fri, 18 Nov 2005 14:05:16 -0800]/UNNAMED/[From "endofitem@ebay.com" <endofitem@ebay.com>][Date Fri, 18 Nov 2005 14:09:10 -0800]/UNNAMED/[From from [138.88.226.200] by ws6-3.us4.outblaze.com with http for][Date Sun, 18 Dec 2005 09:55:10 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Inbox/[From "Experience, Inc." <jesse@experience.com>][Date Fri, 18 Nov 2005 05:02:41 -0500]/UNNAMED/[From "eBay Member: lask8snow" <sm-member@ebay.com>][Date Fri, 18 Nov 2005 14:05:16 -0800]/UNNAMED/[From "endofitem@ebay.com" <endofitem ... /[From "Fletcher Corley" <bagwash@cix.compulink.co.uk>][Date Gauge=XXXXXXXXXIIIIIIIII, Probability=99%, Report='KNOWN_SPAM_CONTENT 8, OBFU_CLASS_FINANCIAL_MED 4, RELAY_IN_NJABL_DYNABLOCK 2.5, DATE_IN_PAST_03_06 1.0, INVALID_DATE 0.5, __BAT_MSGID 0, __CT 0, Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Inbox/[From "Experience, Inc." <jesse@experience.com>][Date Fri, 18 Nov 2005 05:02:41 -0500]/UNNAMED/[From "eBay Member: lask8snow" <sm-member@ebay.com>][Date Fri, 18 Nov 2005 14:05:16 -0800]/UNNAMED/[From "endofitem@ebay.com" <endofitem ... /[From "Debora Shafer" <abatillet@chooz.com>][Date Gauge=XXXXXXXXXIIIIIIIII, Probability=99%, Report='KNOWN_SPAM_PARAGRAPH 8, RELAY_IN_CBL 8, OBFU_CLASS_FINANCI ... /[From Michelle K McGee <Michelle.McGee@uvm.edu>][Date Fri, 27 Jan 2006 14:26:06 -0500]/text Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Inbox/[From "Experience, Inc." <jesse@experience.com>][Date Fri, 18 Nov 2005 05:02:41 -0500]/UNNAMED/[From "eBay Member: lask8snow" <sm-member@ebay.com>][Date Fri, 18 Nov 2005 14:05:16 -0800]/UNNAMED/[From "endofitem@ebay.com" <endofitem ... /[From "Debora Shafer" <abatillet@chooz.com>][Date Gauge=XXXXXXXXXIIIIIIIII, Probability=99%, Report='KNOWN_SPAM_PARAGRAPH 8, RELAY_IN_CBL 8, OBFU_CLASS_FINANCI ... ... /[From "John Kerry" <info@johnkerry.com>][Date Fri, 27 Jan 2006 02:53:13 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Inbox/[From "Experience, Inc." <jesse@experience.com>][Date Fri, 18 Nov 2005 05:02:41 -0500]/UNNAMED/[From "eBay Member: lask8snow" <sm-member@ebay.com>][Date Fri, 18 Nov 2005 14:05:16 -0800]/UNNAMED/[From "endofitem@ebay.com" <endofitem ... /[From "Debora Shafer" <abatillet@chooz.com>][Date Gauge=XXXXXXXXXIIIIIIIII, Probability=99%, Report='KNOWN_SPAM_PARAGRAPH 8, RELAY_IN_CBL 8, OBFU_CLASS_FINANCI ... /[From john abbott <jdabbott@uvm.edu>][Date Wed, 25 Jan 2006 13:23:09 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Inbox/[From "Experience, Inc." <jesse@experience.com>][Date Fri, 18 Nov 2005 05:02:41 -0500]/UNNAMED/[From "eBay Member: lask8snow" <sm-member@ebay.com>][Date Fri, 18 Nov 2005 14:05:16 -0800]/UNNAMED/[From "endofitem@ebay.com" <endofitem ... /[From "Debora Shafer" <abatillet@chooz.com>][Date Gauge=XXXXXXXXXIIIIIIIII, Probability=99%, Report='KNOWN_SPAM_PARAGRAPH 8, RELAY_IN_CBL 8, OBFU_CLASS_FINANCIAL_LOW 3, RELAY_IN_NJABL_DYNABLOCK 2.5, DATE_IN_FUTURE_03_06 1.407, INVALID_DATE 0.5, __BAT_MSGID Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Inbox/[From "Experience, Inc." <jesse@experience.com>][Date Fri, 18 Nov 2005 05:02:41 -0500]/UNNAMED/[From "eBay Member: lask8snow" <sm-member@ebay.com>][Date Fri, 18 Nov 2005 14:05:16 -0800]/UNNAMED/[From "endofitem@ebay.com" <endofitem ... /[From "Ward Crawford" <baitommyv@0451.com>][Date Gauge=XXXXXXXXXIIIIIIIII, Probability=99%, Report='KNOWN_SPAM_CONTENT 8, RELAY_IN_CBL 8, RELAY_IN_NJ ... /[From Melissa Sandoval <Melissa.Sandoval@uvm.edu>][Date Tue, 24 Jan 2006 12:54:34 -0500]/text Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Inbox/[From "Experience, Inc." <jesse@experience.com>][Date Fri, 18 Nov 2005 05:02:41 -0500]/UNNAMED/[From "eBay Member: lask8snow" <sm-member@ebay.com>][Date Fri, 18 Nov 2005 14:05:16 -0800]/UNNAMED/[From "endofitem@ebay.com" <endofitem ... /[From "Ward Crawford" <baitommyv@0451.com>][Date Gauge=XXXXXXXXXIIIIIIIII, Probability=99%, Report='KNOWN_SPAM_CONTENT 8, RELAY_IN_CBL 8, RELAY_IN_NJABL_DYNABLOCK 2.5, DATE_IN_PAST_03_06 1.0, __BAT_MSGID 0, __CT 0, __CTE 0, __CT_TEXT_PLAIN 0, __HAS_MSGID 0 Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Inbox/[From "Experience, Inc." <jesse@experience.com>][Date Fri, 18 Nov 2005 05:02:41 -0500]/UNNAMED/[From "eBay Member: lask8snow" <sm-member@ebay.com>][Date Fri, 18 Nov 2005 14:05:16 -0800]/UNNAMED/[From "endofitem@ebay.com" <endofitem@ebay.com>][Date Fri, 18 Nov 2005 14:09:10 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Inbox/[From "Experience, Inc." <jesse@experience.com>][Date Fri, 18 Nov 2005 05:02:41 -0500]/UNNAMED/[From "eBay Member: lask8snow" <sm-member@ebay.com>][Date Fri, 18 Nov 2005 14:05:16 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Inbox/[From "Experience, Inc." <jesse@experience.com>][Date Fri, 18 Nov 2005 05:02:41 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Inbox Mail Berkeley mbox: infected - 19 skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[Fr ... /[From ... /[From ... /[From eBay <identdep_op57538@ebay.com>][Date Wed, 20 Jul 2005 00:55:06 -0100]/html Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[ ... /[Fro ... /[From "Hann ... /[From eBay <supprefnum0091@ebay.com>][Date Mon, 05 Sep 2005 20:43:03 -0200]/html Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[ ... /[Fr ... /[From eBay Inc <support_refnum_484490385590@ebay.com>][Date Sun, 25 Sep 2005 06:30:15 +0300]/html Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[ .. ... /[From ... /[From eBay <support_refnum_0453798@ebay.com>][Date Mon, 26 Dec 2005 08:07:58 +020 ... /html Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[ .. ... /[From ... /[From eBay <support_refnum_0453798@ebay.com>][Date Mon, 26 Dec 2005 08:07:58 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[ .. ... /[From "Buy.com Special" ... /[From Rosereffellpugh@aol.com][Date Fri, 23 Dec 2005 16:11:28 EST]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[ .. ... /[From "Buy.com Special"<buy.com_offers@enews.buy.com>][Date Sat, 10 Dec 2005 09:26:04 -0500 (EST)]/html Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[ ... / ... .. ... /[From Aaron Maxwell Garovoy <agarovoy@uvm.edu>][Date Thu, 8 Dec 2005 22:52:57 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[ ... / ... .. ... /[F ... /[From <kpvzocjiagmqduxd@geocities.com>][Date Thu, 08 Dec 2005 11:13:52 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[ ... / ... .. ... /[From "Richard Pittman" <sales@keywestliving.com>][Date Sat, 19 Nov 2005 15:29:17 +0000]/html Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[ ... / ... ... /[From Ang ... /[From Bert Welsh <xoksw@yahoo.com>][Date Mon, 07 Nov 2005 06:14:57 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[ ... / ... ... /[From Angela Vogel <Angela.Vogel@uvm.edu>][Date Mon, 24 Oct 2005 15:25:08 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[ ... / ... /[From ... /[From Barbara Hanna <ajeanigal@yahoo.com>][Date Mon, 10 Oct 2005 09:52:38 -0300]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[ ... / ... /[From "Jordan Bryant" <jordanjpglejmxxih@comcast.net>][Date Mon, 26 Sep 2005 01:49:09 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[ ... /[From "Leslie Morales" <lesliewdhqohkhdotd@netvision.net.il>][Date Fri, 9 Sep 2005 18:53:16 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[ ... / ... /[From "Michelle Kennedy" <michelledbhcelvjja@yahoo.com>][Date Mon, 5 Sep 2005 18:45:50 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[ ... /[Fro ... /[From "Hannah Murray" <hannahtctwivrrnip@chello.pl>][Date Fri, 2 Sep 2005 20:17:42 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[ ... /[From "Cassandra Carter" <cassandrazzgpebvdcokv@verizon.net>][Date Sun, 28 Aug 2005 16:18:34 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[Fr .. ... /[From "Paige Bailey" <paigegjdkuglzsowx@adelphia.net>][Date Mon, 15 Aug 2005 15:42:53 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[Fr ... /[From "Sydney Ellis" <sydneywmjzycqcjuv@dedicado.com.uy>][Date Wed, 10 Aug 2005 12:40:21 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[Fr .. ... /[From "Grace Richardson" <gracertgzepwskyq@hotmail.com>][Date Tue, 9 Aug 2005 21:19:50 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[Fr ... /[ ... /[From "Emma Gonzalez" <emmangdqopxbbewc@hispeed.ch>][Date Sun, 7 Aug 2005 11:45:02 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[Fr ... /[Fr ... /[From "Amber Lewis" <amberzckcoqktxo@charter.com>][Date Tue, 2 Aug 2005 18:40:29 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[Fr ... /[From "Maya Thompson" <mayamnkkahtqkohd@netvision.net.il>][Date Sat, 30 Jul 2005 09:27:23 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[Fr . ... /[From "Hailey Campbell" <haileymnhtijclkohv@comcast.net>][Date Thu, 28 Jul 2005 14:56:18 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[Fr ... /[Fr ... /[From "Erin Reynolds" <erinvwwxuxfgpo@excite.com>][Date Wed, 20 Jul 2005 15:45:48 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[Fr ... /[From ... /[From "Anna Hamilton" <annadbdpegxzgyg@iol.cz>][Date Sun, 17 Jul 2005 09:48:05 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[Fr ... /[From "Sophia Sullivan" <sophiadwtdykjhgogz@earthlink.net>][Date Sun, 10 Jul 2005 10:59:53 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[From "J .. ... /[From "Lauren Perry" <laurengbsperfljuj@iam.net.ma>][Date Tue, 5 Jul 2005 11:05:49 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[From "J ... /[From "Marissa Reyes" <marissazbxtevhrmabb@telepac.pt>][Date Sun, 3 Jul 2005 12:37:01 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[From "Jennifer ... /[From "Megan Cox" <meganrdwsynhvbeqr@comnet.bg>][Date Fri, 1 Jul 2005 13:15:08 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED/[From "Jennifer Boyd" <jenniferlhqzykjcxy@gaoland.net>][Date Thu, 16 Jun 2005 16:11:29 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED/[From "Stephanie Reynolds" <stephaniestbfewdrse@charter.com>][Date Mon, 13 Jun 2005 17:01:30 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED/[From "Elizabeth" <elizabethkhjduvxhqyjr@earthlink.net>][Date Sat, 11 Jun 2005 16:56:10 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text/[From "Alexandra" <alexandravnqqshgdytjy@comcast.net>][Date Sat, 21 May 2005 12:21:10 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk/[From mcgourty@mitre.org][Date Mon, 16 May 2005 14:40:44 UTC]/text Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\zaw88kpr.default\Mail\imap.uvm.edu\Junk Mail Berkeley mbox: infected - 36 skipped
C:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\AOL OCP\AIM\Storage\All Users\localStorage\common.cls Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012007041120070412\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\ZLT00619.TMP Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\ZLT00678.TMP Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-03252007-010048.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00D00000\46D779AB.VBN Infected: Trojan.Win32.BHO.g skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00D00001\46D77A70.VBN Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\02EC0000\46EEB903.VBN Infected: Trojan.Win32.BHO.g skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07C00000\47C75D1F.VBN Infected: Trojan.Win32.BHO.g skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07C00001\47C75D66.VBN Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08800000\4E87018A.VBN Infected: Trojan.Win32.BHO.g skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08B80000\4EBD6B73.VBN Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C4C0000\4E4EBEAC.VBN Infected: Trojan.Win32.BHO.g skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C980000\4E9EF256.VBN Infected: Trojan.Win32.BHO.g skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0D6C0000\4F6EC538.VBN Infected: Trojan.Win32.BHO.g skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E840000\4E87E824.VBN Infected: Trojan.Win32.BHO.g skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E840001\4E87E881.VBN Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg2.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMNot.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMReg.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMRSt.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped
C:\Program Files\Symantec AntiVirus\SAVRT\0220NAV~.TMP Object is locked skipped
C:\Program Files\Symantec AntiVirus\SAVRT\0462NAV~.TMP Object is locked skipped
C:\QooBox\Quarantine\WINDOWS\SYSTEM32\ddabc.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.ic skipped
C:\QooBox\Quarantine\WINDOWS\SYSTEM32\geebc.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.ic skipped
C:\QooBox\Quarantine\WINDOWS\SYSTEM32\uxlojsta.dll.vir Infected: Packed.Win32.Klone.j skipped
C:\QooBox\Quarantine\WINDOWS\SYSTEM32\vtsqp.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.ic skipped
C:\QooBox\Quarantine\WINDOWS\SYSTEM32\vtutq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.ic skipped
C:\QooBox\Quarantine\WINDOWS\SYSTEM32\yxycjxeq.dll.vir Infected: Packed.Win32.Klone.j skipped
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP12\A0001284.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ic skipped
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP12\A0001285.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ic skipped
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP12\A0001286.dll Infected: Packed.Win32.Klone.j skipped
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP12\A0001287.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ic skipped
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP12\A0001288.dll Infected: Packed.Win32.Klone.j skipped
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP13\change.log Object is locked skipped
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP9\A0000950.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ic skipped
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP9\A0001036.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bq skipped
C:\VundoFix Backups\pmnli.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.ic skipped
C:\WINDOWS\$NtUninstallKB825119$\$NtUninstallKB828035$\msgsvc.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB825119$\$NtUninstallKB828035$\spuninst\spuninst.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB825119$\$NtUninstallKB828035$\spuninst\spuninst.inf Object is locked skipped
C:\WINDOWS\$NtUninstallKB825119$\$NtUninstallKB828035$\spuninst\spuninst.txt Object is locked skipped
C:\WINDOWS\$NtUninstallKB825119$\$NtUninstallKB828035$\wkssvc.dll Object is locked skipped
C:\WINDOWS\$NtUninstallQ307869$\$NtUninstallQ308210$\rdchost.dll Object is locked skipped
C:\WINDOWS\$NtUninstallQ307869$\$NtUninstallQ308210$\sessmgr.exe Object is locked skipped
C:\WINDOWS\$NtUninstallQ307869$\$NtUninstallQ308210$\spuninst\spuninst.exe Object is locked skipped
C:\WINDOWS\$NtUninstallQ307869$\$NtUninstallQ308210$\spuninst\spuninst.inf Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
C:\WINDOWS\Internet Logs\OMAR.ldb Object is locked skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\secureb.html Infected: Trojan.Win32.Harnig.a skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
F:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP13\change.log Object is locked skipped

Scan process completed.


Hijack This log:
Logfile of HijackThis v1.99.1
Scan saved at 1:44:15 AM, on 4/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
F:\Program Files\University of Vermont\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Browser MOUSE\mouse32a.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Muiltmedia keyboard utility\1.3\KbdAp32A.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\PROGRA~1\Symantec\LIVEUP~1\LUALL.EXE
C:\Documents and Settings\Administrator\Desktop\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com...r/fix_homepage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.uvm.edu/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser MOUSE\mouse32a.exe
O4 - HKLM\..\Run: [FLMK08KB] C:\Program Files\Muiltmedia keyboard utility\1.3\MMKEYBD.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [InstantTray] C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdcc...d/tgctlins.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://i.a.cnn.net/cnn/resources/cult3d/cult.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase9602.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - F:\Program Files\University of Vermont\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
Attached Files
File Type: txt ComboFix.txt (18.7 KB, 2 views)
J108 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 04-12-2007, 02:01 PM   #6 (permalink)
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
 
Glaswegian's Avatar
 
Join Date: Sep 2005
Location: Glasgow
Posts: 25,427
OS: Win XP Pro SP3 / Win 7 Pro

My System

Blog Entries: 10
Re: Winfixer, Vundo, Infostealer, Popups
Hi again

Good work – how are things running now?

Registry Fix
Click on the zip file attached to this post to open and extract the file J108.reg to your desktop. Double click on the file J108.reg to run it. Answer yes to any prompts and allow it to merge into the Registry.



Delete the following Files indicated in RED if they still exist.

C:\WINDOWS\SYSTEM32\tvvwa.bak1
C:\WINDOWS\SYSTEM32\nqtss.bak1
C:\WINDOWS\SYSTEM32\abadd.bak1
C:\WINDOWS\SYSTEM32\oqtss.bak1
C:\WINDOWS\SYSTEM32\ijjlm.bak1
C:\WINDOWS\SYSTEM32\cfhkj.bak1
C:\WINDOWS\SYSTEM32\dccdd.bak1
C:\WINDOWS\SYSTEM32\rqtwa.ini2
C:\WINDOWS\SYSTEM32\rqtwa.bak1
C:\WINDOWS\SYSTEM32\rrqss.bak1
C:\WINDOWS\SYSTEM32\knnmp.bak1
C:\WINDOWS\SYSTEM32\mlnmp.bak1
C:\WINDOWS\SYSTEM32\ilkkj.ini2
C:\WINDOWS\SYSTEM32\ilkkj.bak1
C:\WINDOWS\SYSTEM32\rtstv.bak2
C:\WINDOWS\SYSTEM32\dgjlm.ini2
C:\WINDOWS\SYSTEM32\d3d9caps.dat

Note: If they resist, you may have to boot to Safe Mode to delete them.



Choose any one of the following online scanners

http://housecall.trendmicro.com/ <- - you can use Firefox for this scanner
http://www3.ca.com/virusinfo/virusscan.aspx
http://www.bitdefender.com/scan8/ie.html
http://us.mcafee.com/root/mfs/default.asp
http://security.symantec.com/sscv6/d...d=ie&venid=sym


And post back with any log produced.
__________________
Iain - Defender of the Haggis and all things Scottish.
I don't help by PM - post in the Forums.



PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner
Last edited by Glaswegian; 03-27-2008 at 04:12 PM.
Glaswegian is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 04-13-2007, 12:50 PM   #7 (permalink)
Registered User
 
Join Date: Apr 2007
Posts: 5
OS: XP Pro


Re: Winfixer, Vundo, Infostealer, Popups
Hi Iain,
The popup windows seem to be gone and I have not noticed anything else that is wrong. I ran j108.reg then went to the systems32 folder and deleted all of the files that you listed in red. I tried to run http://housecall.trendmicro.com/ in firefox after 15H I gave up, it seemed to have stalled. I ran http://www3.ca.com/virusinfo/virusscan.aspx in iexplorer it detected 10 viruses that I had it delete (were they backups?). I pasted what http://www3.ca.com/virusinfo/virusscan.aspx found in the format: virus name, action taken, and location found, since it produced no log. I am also pasting a Deckard systems log.

Thanks for your help!!!

ddabc.dll.vir Win32/Vundo!generic
deleted
C:\QooBox\Quarantine\WINDOWS\SYSTEM32\

geebc.dll.vir Win32/Vundo!generic
deleted
C:\QooBox\Quarantine\WINDOWS\SYSTEM32\

vtsqp.dll.vir Win32/Vundo!generic
deleted
C:\QooBox\Quarantine\WINDOWS\SYSTEM32\

vtutq.dll.vir Win32/Vundo!generic
deleted
C:\QooBox\Quarantine\WINDOWS\SYSTEM32\

A0001284.dll Win32/Vundo!generic
deleted
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP12\

A0001285.dll Win32/Vundo!generic
deleted
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP12\

A0001287.dll Win32/Vundo!generic
deleted
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP12\

A0000950.dll Win32/Vundo!generic
deleted
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP9\

A0001036.dll Win32/Chisyne!generic
deleted
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP9\

pmnli.dll.bad Win32/Vundo!generic
deleted
C:\VundoFix Backups\



Deckard's System Scanner v20070328.36
Run by Administrator on 2007-04-13 at 14:14:26
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Administrator.exe) ---------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 2:15:53 PM, on 4/13/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
F:\Program Files\University of Vermont\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Browser MOUSE\mouse32a.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Muiltmedia keyboard utility\1.3\KbdAp32A.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
F:\Program Files\DivX\DivX Player\DivX Player.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Administrator\Desktop\dss.exe
C:\DOCUME~1\ADMINI~1\Desktop\HIJACK~1\ADMINI~1.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com...r/fix_homepage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.uvm.edu/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser MOUSE\mouse32a.exe
O4 - HKLM\..\Run: [FLMK08KB] C:\Program Files\Muiltmedia keyboard utility\1.3\MMKEYBD.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [InstantTray] C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdcc...d/tgctlins.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://i.a.cnn.net/cnn/resources/cult3d/cult.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase9602.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/v...fo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - F:\Program Files\University of Vermont\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe


-- Files created between 2007-03-13 and 2007-04-13 -----------------------------

2007-04-12 19:31:27 0 d-------- C:\Documents and Settings\Administrator\.housecall6.6<HOUSEC~1.6>
2007-04-11 2125 0 d-------- C:\WINDOWS\system32\Kaspersky Lab<KASPER~1>
2007-04-11 2121 0 d-------- C:\WINDOWS\LastGood
2007-04-09 22:25:54 3968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-04-01 19:37:34 21312 --a------ C:\WINDOWS\choice.exe
2007-04-01 19:36:35 0 d-------- C:\ie-spyad
2007-04-01 19:34:01 0 d-------- C:\Program Files\SpywareGuard<SPYWAR~2>
2007-04-01 19:30:24 0 d-------- C:\Program Files\SpywareBlaster<SPYWAR~1>
2007-04-01 17:42:21 0 d-------- C:\WINDOWS\system32\ActiveScan<ACTIVE~1>
2007-04-01 16:05:46 0 d-------- C:\Documents and Settings\Administrator\Application Data\Lavasoft
2007-04-01 16:05:31 0 d-------- C:\Program Files\Lavasoft
2007-04-01 16:04:51 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard<WISEIN~1>
2007-03-31 02:26:19 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2007-03-31 02:25:50 75512 --a------ C:\WINDOWS\zllsputility.exe<ZLLSPU~1.EXE>
2007-03-31 02:25:49 11264 --a------ C:\WINDOWS\system32\SpOrder.dll
2007-03-31 02:25:05 1087216 --a------ C:\WINDOWS\system32\zpeng24.dll
2007-03-31 02:25:05 0 d-------- C:\WINDOWS\system32\ZoneLabs
2007-03-26 10:45:06 0 d-------- C:\Program Files\Windows Live Safety Center<WIE5D0~1>
2007-03-26 04:21:16 0 d-------- C:\VundoFix Backups<VUNDOF~1>
2007-03-25 00:59:53 0 d-------- C:\Program Files\Windows Defender<WIFD1F~1>
2007-03-25 00:25:42 0 d-------- C:\WINDOWS\network diagnostic<NETWOR~1>
2007-03-24 19:36:49 0 --a------ C:\WINDOWS\ORUN32.EXE
2007-03-24 19:36:36 0 --a------ C:\WINDOWS\system32\CMMGR32.EXE
2007-03-24 19:23:34 0 d-------- C:\WINDOWS\system32\SuperAdBlocker.com<SUPERA~1.COM>
2007-03-24 16:47:03 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com<SUPERA~1.COM>
2007-03-24 16:46:28 0 d-------- C:\Program Files\SUPERAntiSpyware<SUPERA~1>
2007-03-24 16:46:28 0 d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com<SUPERA~1.COM>
2007-03-23 21:02:12 0 d-------- C:\WINDOWS\FLV Player<FLVPLA~1>
2007-03-23 18:45:00 0 d-------- C:\Program Files\InterMute<INTERM~1>
2007-03-22 0541 47360 --a------ C:\Documents and Settings\Administrator\Application Data\pcouffin.sys
2007-03-22 0541 87608 --a------ C:\Documents and Settings\Administrator\Application Data\ezpinst.exe
2007-03-22 04:38:17 47360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2007-03-22 04:37:50 0 d-------- C:\Program Files\Common Files\Download Manager<DOWNLO~1>
2007-03-22 04:07:25 0 d-------- C:\Program Files\Multi Install 2.3<MULTII~1.3>
2007-03-21 19:39:25 0 d-------- C:\Documents and Settings\All Users\Application Data\River Past G5<RIVERP~1>
2007-03-21 19:25:26 180224 --a------ C:\WINDOWS\system32\xvidvfw.dll
2007-03-21 19:25:26 761856 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-03-21 15:20:17 0 d-------- C:\Documents and Settings\Administrator\Application Data\DivX
2007-03-16 01:10:16 0 d-------- C:\Program Files\utorrent
2007-03-15 23:50:04 0 d-------- C:\Documents and Settings\Administrator\Application Data\uTorrent


-- Find3M Report ---------------------------------------------------------------

2007-04-11 20:50:30 0 d-------- C:\Program Files\Symantec AntiVirus<SYMANT~1>
2007-04-01 19:21:20 26993 --a------ C:\WINDOWS\mozver.dat
2007-04-01 18:17:40 0 d-------- C:\Program Files\Common Files\Symantec Shared<SYMANT~1>
2007-04-01 18:16:30 0 d-------- C:\Program Files\Browser MOUSE<BROWSE~1>
2007-03-25 18:08:01 33 --a------ C:\Documents and Settings\Administrator\Application Data\pcouffin.log
2007-03-25 18:07:56 1144 --a------ C:\Documents and Settings\Administrator\Application Data\pcouffin.inf
2007-03-25 18:07:56 1074 --a------ C:\Documents and Settings\Administrator\Application Data\pcouffin.cat
2007-03-24 20:50:04 0 d-------- C:\Program Files\Common Files\AOL
2007-03-17 09:43:01 292864 --a------ C:\WINDOWS\system32\winsrv.dll
2007-03-08 11:36:28 577536 --a------ C:\WINDOWS\system32\user32.dll
2007-03-08 11:36:28 40960 --a------ C:\WINDOWS\system32\mf3216.dll
2007-03-08 11:36:28 281600 --a------ C:\WINDOWS\system32\gdi32.dll
2007-03-08 09:47:48 1843584 --a------ C:\WINDOWS\system32\win32k.sys
2007-03-07 02:37:10 0 d-------- C:\Documents and Settings\Administrator\Application Data\Oracle
2007-03-07 02:29:49 0 d-------- C:\Program Files\Oracle
2007-03-07 02:08:21 0 d-------- C:\Program Files\Symantec
2007-03-07 0246 0 d-------- C:\Program Files\NavNT
2007-03-07 00:58:08 0 d-------- C:\Program Files\iTunes
2007-03-07 00:57:58 0 d-------- C:\Program Files\iPod
2007-03-07 00:55:12 0 d-------- C:\Program Files\QuickTime<QUICKT~1>
2007-03-06 21:08:38 0 d-------- C:\Program Files\Starcraft<STARCR~1>
2007-02-23 00:29:58 524288 --a------ C:\WINDOWS\system32\DivXsm.exe
2007-02-23 00:29:56 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-02-23 00:29:52 118520 -----n--- C:\WINDOWS\system32\pxinsi64.exe
2007-02-23 00:29:52 116472 -----n--- C:\WINDOWS\system32\pxcpyi64.exe
2007-02-23 00:29:52 129784 -----n--- C:\WINDOWS\system32\pxafs.dll
2007-02-23 00:29:49 200704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-02-23 00:29:49 1044480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-02-23 00:25:24 196608 --a------ C:\WINDOWS\system32\dtu100.dll
2007-02-23 00:25:24 73728 --a------ C:\WINDOWS\system32\dpl100.dll
2007-02-23 00:25:23 53248 --a------ C:\WINDOWS\system32\dpuGUI10.dll
2007-02-23 00:25:22 57344 --a------ C:\WINDOWS\system32\dpv11.dll
2007-02-23 00:25:22 344064 --a------ C:\WINDOWS\system32\dpus11.dll
2007-02-23 00:25:22 593920 --a------ C:\WINDOWS\system32\dpuGUI11.dll
2007-02-23 00:25:22 294912 --a------ C:\WINDOWS\system32\dpu11.dll
2007-02-23 00:25:22 294912 --a------ C:\WINDOWS\system32\dpu10.dll
2007-02-23 00:25:19 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll<DIVX_X~3.DLL>
2007-02-23 00:25:19 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll<DIVX_X~1.DLL>
2007-02-23 00:25:19 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll<DIVX_X~2.DLL>
2007-02-22 02:54:54 0 d-------- C:\Program Files\AIM95
2007-02-22 02:54:34 0 d-------- C:\Documents and Settings\Administrator\Application Data\Aim
2007-02-20 18:26:02 0 d-------- C:\Program Files\Java
2007-02-15 21:40:35 124472 --a------ C:\WINDOWS\system32\DivXCodecUpdateChecker.exe<DIVXCO~1.EXE>
2007-02-05 16:17:02 185344 --a------ C:\WINDOWS\system32\upnphost.dll
2007-01-18 01:03:45 4 --a------ C:\WINDOWS\system32\862704


-- Registry Dump ---------------------------------------------------------------


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"InstantTray"="C:\\Program Files\\Pinnacle\\Shared Files\\InstantCDDVD\\PCLETray.exe"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"Aim6"="\"C:\\Program Files\\AIM6\\aim6.exe\" /d locale=en-US ee://aol/imApp"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ATIModeChange"="Ati2mdxx.exe"
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"FLMOFFICE4DMOUSE"="C:\\Program Files\\Browser MOUSE\\mouse32a.exe"
"FLMK08KB"="C:\\Program Files\\Muiltmedia keyboard utility\\1.3\\MMKEYBD.EXE"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_11\\bin\\jusched.exe\""
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"vptray"="C:\\PROGRA~1\\SYMANT~1\\VPTray.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"PinnacleDriverCheck"="C:\\WINDOWS\\System32\\PSDrvCheck.exe"
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"ZoneAlarm Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"MMTray"="C:\\Program Files\\Musicmatch\\Musicmatch Jukebox\\mm_tray.exe"
"MimBoot"="C:\\PROGRA~1\\MUSICM~1\\MUSICM~1\\mimboot.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"AdaptecDirectCD"="\"C:\\Program Files\\Roxio\\Easy CD Creator 5\\DirectCD\\DirectCD.exe\""
"PinnacleDriverCheck"="C:\\WINDOWS\\System32\\PSDrvCheck.exe"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"starzd"="\"C:\\Program Files\\Real\\RealPlayer\\starz\\starzd.exe\" 86400000"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Adobe Reader Speed Launch.lnk"
"backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Adobe\\ACROBA~3.0\\Reader\\READER~1.EXE "
"item"="Adobe Reader Speed Launch"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\QuickBooks Update Agent.lnk"
"backup"="C:\\WINDOWS\\pss\\QuickBooks Update Agent.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\COMMON~1\\Intuit\\QUICKB~1\\QBUpdate\\qbupdate.exe "
"item"="QuickBooks Update Agent"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^University of Vermont VPN Client.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\University of Vermont VPN Client.lnk"
"backup"="C:\\WINDOWS\\pss\\University of Vermont VPN Client.lnkCommon Startup"
"location"="Common Startup"
"command"="F:\\PROGRA~1\\UNIVER~1\\VPNCLI~1\\vpngui.exe \"-user_logon\""
"item"="University of Vermont VPN Client"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ymetray.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\ymetray.lnk"
"backup"="C:\\WINDOWS\\pss\\ymetray.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Yahoo!\\YAHOO!~1\\ymetray.exe C:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe -preload"
"item"="ymetray"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="aim6"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\AIM6\\aim6.exe\" /d locale=en-US ee://aol/imApp"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hpcmpmgr"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="HPWuSchd2"
"hkey"="HKLM"
"command"="C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWuSchd2.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hpztsb09"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\hpztsb09.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon05]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hphmon05"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\hphmon05.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD05]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hphupd05"
"hkey"="HKLM"
"command"="C:\\Program Files\\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\\hphupd05.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="iTunesHelper"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="mimboot"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\MUSICM~1\\MUSICM~1\\mimboot.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="LAUNCH~1"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\Nokia\\NOKIAP~1\\LAUNCH~1.EXE -startup"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PcSync2"
"hkey"="HKCU"
"command"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\PcSync2.exe /NoDialog"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="realsched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WatchDog]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="WatchDog"
"hkey"="HKLM"
"command"="C:\\Program Files\\mobile PhoneTools\\WatchDog.exe"
"inimapping"="0"


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook"
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="\"C:\\PROGRA~1\\COMMON~1\\MICROS~1\\DW\\dwtrig20.exe\" -t"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoCDBurning"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source REG_SZ file:///C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/msohtml1/10/clip_image001.jpg

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
Source REG_SZ file:///C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/msohtml1/10/clip_image002.jpg

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0



-- End of Deckard's System Scanner: finished at 2007-04-13 at 14:16:59 ---------
J108 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 04-13-2007, 03:12 PM   #8 (permalink)
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
 
Glaswegian's Avatar
 
Join Date: Sep 2005
Location: Glasgow
Posts: 25,427
OS: Win XP Pro SP3 / Win 7 Pro

My System

Blog Entries: 10
Re: Winfixer, Vundo, Infostealer, Popups
Hi again


Delete the following Folder indicated in BLUE

C:\WINDOWS\system32\862704


Once that’s done your log is clean. Any more problems? If not we’ll just tidy up and I’ll let you go, along with my recommendations for staying safe and secure.

You can go ahead and delete any special tools we used (SmitRem, SmitfraudFix, ComboFix, etc). They won't serve a future purpose and are replaced with updated versions frequently, so the copies you have are probably already out of date and there is therefore no need to keep them.



Reset Hidden/System Files
To reset your hidden and system files:
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View tab.
  • Deselect the Show hidden files and folders option.
  • Select the Hide file extensions for known types option.
  • Select the Hide protected operating system files option.
  • Click Yes to confirm.
  • Click OK.


System Restore
To turn off System Restore click Start > Right Click My Computer > Properties. Click the System Restore tab and Check "Turn off System Restore" or "Turn off System Restore on all drives" Click Apply. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this then Click OK.

To turn on System Restore by Clicking Start. Right-click My Computer, and then click Properties. Click the System Restore tab. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives." Click Apply, and then OK.

This will create a new Restore Point.



Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:

Spyware Blaster to help prevent spyware from installing in the first place.
Spyware Guard to catch and block spyware before it can execute.
Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here.


Ad-aware
Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here.


IE-SPYAD
IE-Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impairs attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. A tutorial on installing this product can be found here.


SnoopFree
SnoopFree is a real time monitor that notifies you when a programme wants to record your keystrokes or read your screen. Note that SnoopFree is only for XP systems.


MVPS Hosts File
The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file.


Alternate Browsers
Try the following free alternate browsers rather than Internet Explorer
Firefox
Opera
Maxthon


Firewalls
A good firewall will monitor incoming and outgoing traffic. NOTE: Microsoft's Firewall does not monitor outgoing traffic. If you do not have a firewall, here are 3 free ones available for personal use:
Comodo Personal Firewall
Sygate Personal Firewall
ZoneAlarm


Anti Virus Software
It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See this link for a listing of some online antivirus scanners:
Anti-Spyware Tutorial

Here are three very good free Antivirus products which are available:
BitDefender Free
Avast!
AVG

It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.


Other Protection
Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here:
Using Winpatrol to protect your computer.


In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles

PC Safety & Security - What Do I Need?.
Making Internet Explorer Safer.

Keep clean and safe and enjoy your computing!

Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Iain - Defender of the Haggis and all things Scottish.
I don't help by PM - post in the Forums.



PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner
Glaswegian is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 04-14-2007, 03:34 PM   #9 (permalink)
Registered User
 
Join Date: Apr 2007
Posts: 5
OS: XP Pro


Re: Winfixer, Vundo, Infostealer, Popups
Hi Iain,

I followed your instructions and everything seems to be in order. I will implement your recommendations in order to make my computer safer. I want to thank you for your time and help it was greatly appreciated.

Thanks
J108 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
 

« Previous Thread | Next Thread »

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



All times are GMT -7. The time now is 04:22 PM.

Contact Us - Tech Support Forum - Archive - Privacy Statement - Top


Copyright 2001 - 2009, Tech Support Forum
Home Tips Plus | Outdoor Basecamp | Automotive Support Forum

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85