Infected with alcra from limewire this is my hijack this log

beougher · Jan 21, 2007

I am infected by an alcra virius or worm from limewire. Limewire never shuts down when I shut it down it automatically pops back up.
I already did the 5 step program and here is my
hijackthis log

Logfile of HijackThis v1.99.1
Scan saved at 12:33:19 AM, on 1/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\MI3AA1~1\wcescomm.exe

hope this helps thanx
chdbeougher at hotmail.com

fredmh · Jan 21, 2007

Your HJT log is incomplete. Please run a new scan and post the entire log

ie: Header and running processes and the R thru 023 entries.

beougher · Jan 22, 2007

I am infected by an alcra virius or worm from limewire. Limewire never shuts down when I shut it down it automatically pops back up.
I already did the 5 step program and here is my
hijackthis log

Logfile of HijackThis v1.99.1
Scan saved at 2:48:46 PM, on 1/22/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\MI3AA1~1\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\svchost.exe
C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-us\bin\WindowsSearch.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-us\bin\WindowsSearchIndexer.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\limewire\limewire.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Chad.EMACHINE\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = googel.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = googel.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R3 - URLSearchHook: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - C:\PROGRA~1\BEARSH~2\BEARSH~2\MediaBar.dll
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [BearFlix] "C:\Program Files\BearFlix\BearFlix.exe" /pause
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MI3AA1~1\wcescomm.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: svchost.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-us\bin\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll/search.htm
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by106w.bay106.mail.live.com/mail/resources/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://maricopa.gov/assessor/gis/plugin/mgaxctrl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1151740312937
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1151796431515
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

what should I do next

beougher · Jan 25, 2007

Limewire keeps poping up on its own

I am infected by an alcra virius or worm from limewire. Limewire never shuts down when I shut it down it automatically pops back up.
I already did the 5 step program and here is my
hijackthis log

Logfile of HijackThis v1.99.1
Scan saved at 2:48:46 PM, on 1/22/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\MI3AA1~1\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\svchost.exe
C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-us\bin\WindowsSearch.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-us\bin\WindowsSearchIndexer.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\limewire\limewire.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Chad.EMACHINE\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = googel.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = googel.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R3 - URLSearchHook: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - C:\PROGRA~1\BEARSH~2\BEARSH~2\MediaBar.dll
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [BearFlix] "C:\Program Files\BearFlix\BearFlix.exe" /pause
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MI3AA1~1\wcescomm.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: svchost.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-us\bin\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll/search.htm
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by106w.bay106.mail.live.com/m...s/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://maricopa.gov/assessor/gis/plugin/mgaxctrl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1151740312937
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1151796431515
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

what should I do next

fredmh · Jan 25, 2007

Hello beougher, and welcome to TSF

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools,
then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding.
Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this
webpage would not be available when you're carrying out the fix.

IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER.

----------------------------------------

The fixes we will use are specific to your problems and should only be used for this issue on this machine.

Please only use this topic to reply to. Do not start another thread.
If any other issues arise let me know.

The process is not instant. Please continue to review my answers until I tell you your machine is clear.
Absence of symptoms does not mean that everything is clear. So lets do this to the end!

Please make every effort to reply to my posts in a timely manner. Malware breeds malware and the longer an infection remains on a system, the more
likely additional infections will result.

----------------------------------------

P2P - I see you have P2P software installed on your machine. We are not here to pass judgment on file-sharing as a concept.
However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more
susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

These programs are:

Limewire
BearShare

----------------------------------------

DOWNLOADS

CLEANUP! version 4.52 – TEMP FILE CLEANING

Please download Cleanup! and install it. You will use this later.

Alternative link Cleanup Alt

*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does not make backups.

AVG Anti-Spyware 7.5

Please download AVG Anti Spyware

Use the link at the bottom of the page under "AVG Anti-Spyware Free for Windows"

Install AVG Anti-Spyware 7.5.
Double-click the icon on Desktop to launch AVG A-S 7.5
On the top of the main screen click Shield
Click the word active to change it to inactive
On the top of the main screen click Update.
Then click on Start Update. The update will start and a progress bar will show the updates being installed.
I also recommend changing the "Update interval" to something more reasonable like 12 hours.

SDFix

Download SDFix and save it to your desktop.

We will use this later.

----------------------------------------

SAFE MODE RE-BOOT

Please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Use the up arrow key to highlight Safe Mode and press Enter.
5) Login with your usual account. Make sure to close any open browsers.

----------------------------------------

FIXES AND DELETIONS

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = googel.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = googel.com

Please remember to close all other windows, including browsers then click Fix checked.

----------------------------------------

SDFix

Right click the SDFix.zip folder and choose Extract All,
Open the extracted folder and double click RunThis.bat to start the script.
Type Y to begin the script.
It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
Your system will take longer that normal to restart as the fixtool will be running and removing files.
When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons.
Finally open the SDFix folder on your desktop and copy and paste the contents of the results file
Report.txt back onto the forum with a new HijackThis log

----------------------------------------

RUNNING SCANNERS

Cleanup

Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
Set the program up as follows:

Click "Options..."
Move the arrow down to "Custom CleanUp!"
Put a check next to the following (Make sure nothing else is checked!):

Empty Recycle Bins
Delete Cookies
Delete Prefetch files (if present)
Cleanup! All Users
Click on the Temporary Files tab and uncheck the box for Scan drives for files matching if it’s checked.

Click OK
Press the CleanUp! button to start the program and DO NOT reboot when prompted.

AVG Anti-Spyware 7.5

Run AVG A-s with it's updated definitions: (...it's important that all windows must be closed)
This scan can take quite a while to run, so be prepared.
Click Scanner
Click on the Scan tab
Click Complete System Scan to begin scanning.
When the scan is complete click Recommended Action and change it to Quarantine (1),
If not click Recommended Action and choose Quarantine from the popup menu. (2)
At the bottom of the window click on the Apply all Actions button. (3)

When done, click the Save Scan Report button. (4) then click Save Report As and save it to your desktop.

IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.

Note: DO NOT USE the computer while AVG A/S is scanning. If Explorer or the Control Panel are opened some malware types will
reinfect your system or will not be cleaned properly.

----------------------------------------

SYSTEM RE-BOOT

Reboot into Normal Mode.

----------------------------------------

ON-LINE SCANS

Perform an online scan with Internet Explorer with Panda ActiveScan

Click on

located at the bottom of the page.
A "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
Enter your e-mail address, country, and state & click "Free Online Scan" * The download of the 8 MB Panda's ActiveX control will take place *

Begin the scan by selecting

If it finds any malware, it will offer you a report.
Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
Click on

then click

* You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
* Turn off the real time scanner of any existing antivirus program while performing the online scan

----------------------------------------

FOLLOW-UP

Please return and post these items in the order listed:

SDFix log
AVG A/S
Panda scan
A new HJT log run in Normal Mode

Please note: In order to properly see what is on your system, all HJT logs must be run in the normal mode

Please let me know how your system is behaving.

beougher · Jan 26, 2007

sdfix

I saved the sdfix zip file on my desktop, but when i get to safe mode to open it there is only on file and when I run it a note pad pops up and tells me to run in safe mode. I can not get it to run

fredmh · Jan 27, 2007

In safe Mode, go to C:\SDFix. You will then see a RunThis file

beougher · Jan 27, 2007

report this after sdfix

here is the report from sdfx

SDFix: Version 1.62

Fri 01/26/2007 - 16:15:08.85

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Name:

Path:

Restoring Windows Registry Entries
Restoring Default Hosts File

Rebooting...

Normal Mode:
Checking Files:

No Files Found..

Alternate Streams Check:

C:\WINDOWS\system32
No streams found.

Final Check:

Remaining Services:
------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled

xpsp2res.dll,-22019"
"C:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"="C:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe:*:Enabled:HP Software Update Client"
"C:\\Program Files\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare\\BearShare.exe:*:Enabled:BearShare"
"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe:*:Enabled:BearShare"
"C:\\StubInstaller.exe"="C:\\StubInstaller.exe:*:Enabled:LimeWire swarmed installer"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*

isabled:Internet Explorer"
"C:\\Program Files\\BearFlix\\bearflix.exe"="C:\\Program Files\\BearFlix\\bearflix.exe:*:Enabled:BearFlix"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled

xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled

xpsp2res.dll,-22019"
"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled

xpsp3res.dll,-20000"

Remaining Files:
---------------

Backups Folder: - C:\SDFix\backups\backups.zip

Checking For Files with Hidden Attributes :

C:\NTDETECT.COM
C:\Program Files\Autodesk\Autodesk DWF Viewer\_Setupx.dll
C:\Program Files\Common Files\csshare\shell\us\shellext.dll
C:\Program Files\Autodesk\Autodesk DWF Viewer\Setup.exe
C:\Program Files\CompuServe 7.0\csphx.exe
C:\Program Files\CompuServe 7.0\cstray.exe
C:\Program Files\CompuServe 7.0\RBM.exe
C:\Program Files\CompuServe 7.0\wcs2000.exe
C:\Program Files\CompuServe 7.0\COMIT\cswitch.exe
C:\WINDOWS\system32\cdplayer.exe.manifest
C:\WINDOWS\system32\logonui.exe.manifest
C:\CONFIG.SYS
C:\hiberfil.sys
C:\IO.SYS
C:\MSDOS.SYS
C:\pagefile.sys
C:\Documents and Settings\All Users.WINDOWS\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\lock.tmp
C:\Program Files\InterActual\InterActual Player\iti3.tmp

Finished

fredmh · Jan 27, 2007

OK. I'll wait for the other logs.

beougher · Jan 28, 2007

im having trouble with the AVG scan
I ran the scan in safe mode and when the scan was complete I had several threats but the program froze up and was completely unreponsive. I restarted the computer and tried run the scan agian and avg wont even start up. So know im trying to unistall it and it wont even do that, so for its been uninstalling for 2 hours and has not made any progress on the uninstall.
Now my computer running slugish aswell. Any suggestions?

fredmh · Jan 29, 2007

How are yu trying to uninstall it? It should uninstall through add/remove.

beougher · Jan 31, 2007

follow up logs

finshed here are my logs
adfix log

SDFix: Version 1.62

Fri 01/26/2007 - 16:15:08.85

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Name:

Path:

Restoring Windows Registry Entries
Restoring Default Hosts File

Rebooting...

Normal Mode:
Checking Files:

No Files Found..

Alternate Streams Check:

C:\WINDOWS\system32
No streams found.

Final Check:

Remaining Services:
------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled

xpsp2res.dll,-22019"
"C:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"="C:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe:*:Enabled:HP Software Update Client"
"C:\\Program Files\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare\\BearShare.exe:*:Enabled:BearShare"
"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe:*:Enabled:BearShare"
"C:\\StubInstaller.exe"="C:\\StubInstaller.exe:*:Enabled:LimeWire swarmed installer"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*

isabled:Internet Explorer"
"C:\\Program Files\\BearFlix\\bearflix.exe"="C:\\Program Files\\BearFlix\\bearflix.exe:*:Enabled:BearFlix"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled

xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled

xpsp2res.dll,-22019"
"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled

xpsp3res.dll,-20000"

Remaining Files:
---------------

Backups Folder: - C:\SDFix\backups\backups.zip

Checking For Files with Hidden Attributes :

C:\NTDETECT.COM
C:\Program Files\Autodesk\Autodesk DWF Viewer\_Setupx.dll
C:\Program Files\Common Files\csshare\shell\us\shellext.dll
C:\Program Files\Autodesk\Autodesk DWF Viewer\Setup.exe
C:\Program Files\CompuServe 7.0\csphx.exe
C:\Program Files\CompuServe 7.0\cstray.exe
C:\Program Files\CompuServe 7.0\RBM.exe
C:\Program Files\CompuServe 7.0\wcs2000.exe
C:\Program Files\CompuServe 7.0\COMIT\cswitch.exe
C:\WINDOWS\system32\cdplayer.exe.manifest
C:\WINDOWS\system32\logonui.exe.manifest
C:\CONFIG.SYS
C:\hiberfil.sys
C:\IO.SYS
C:\MSDOS.SYS
C:\pagefile.sys
C:\Documents and Settings\All Users.WINDOWS\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\lock.tmp
C:\Program Files\InterActual\InterActual Player\iti3.tmp

Finished

avg A/s
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 12:14:10 PM 1/30/2007

+ Scan result:

C:\System Volume Information\_restore{35A4A879-B4E1-4F85-811E-93C3722DA63B}\RP564\A0065762.exe/VVSN.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Documents and Settings\Chad.EMACHINE\My Documents\HomeWork\Civ2TestOfTime-dm.exe -> Adware.Trymedia : Cleaned with backup (quarantined).
C:\My Downloads\Shared\WebExe 1.54.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\WebExpress 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\WebFerret Free 5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\WebFill 1.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\WebFlash 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\WebFlowChart 0.8.8.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\WebGen 1.01.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\WebGen.cz 602.225.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\WebGobbler 1.2.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\WebGrab 1.02.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\WebGrab 3.6.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\WebGrid DataGrid Graphs WYSIWYG html editor 1.7.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\WebHare Lite 1.01.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\WebHtmlEdit Control 2.3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\WebImg 2.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webaroo 1 beta.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webation Active 7.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webby 1.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\WebbyFiles (Java) 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webcalng 3.1p2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webcam 1-2-3 3.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webcam Broadcaster 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webcam Dashboard 2.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webcam Desktop Theater 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webcam Diagnostics 1.02.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webcam Flix 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webcam Mugshot 1.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webcam SMS 4.0.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webcam Saver 1.3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webcam Surveyor 1.3.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webcam Uploader 2004 4.0.6.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webcam Watchdog 4.01.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webcam Watcher 3.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webcam Zone Trigger 1.7.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webcam and Screen Recorder 1.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\WebcamMail 2.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\WebcamMax 2.1.0.6.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\WebcamNow Video Broadcaster 3.3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\WebcamNow Video Broadcaster for MAC 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\WebcamOnTop 5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webcams 3.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\WebcastMaker 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webcompetitor 3.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webcyte Design Alarm Clock 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webcyte Design Font Viewer 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webdata Pro 1.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webetiser 3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webgenz CMS Professional Edition 6.2.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Webimage Miner 2.4.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Weeds 2x05 (HDTV-hV)[VTV].zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Weeds S02E05 720P HDTV AC3 5 1 XviD-hV [eztv].zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Why join.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\WinRAR Complete Pack 2006 (full) - [www slotorrent net].zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\WinRAR v3 61 Full WinALL-AnyFile.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\WinRar v3 60 - Final Extreme Edition ( Complete Apps And Themes ).zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Windows Media Centre Boot CD.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Windows XP Home Bootable CD.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Winger - IV (2006).zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\World Series Of Poker 2006 E17 PDTV XviD-TBS [eztv].zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\World Series Of Poker 2006 E18 PDTV XviD-TBS [eztv].zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\World Trade Center 2006 CAM XviD-SubAtom.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\World Trade Center 2006 TS SVCD-XanaX.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\World Trade Center 2006 WP Xvid ENG.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\XP Repair Pro 2006 v3 1 6 (www.acetorrents.net).zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Y Messenger Plus 1.7.0.8.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YAAC 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YADA (Yet Another Download Accelerator) 1.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YAKI 1.09a.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YAMP 2.3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YATS32 Yet Another Time Synchronizer 8.7.25.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YMPEGProfessional MPEG-2, DVD, KVCD, KDVD Encoder 3.3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YOOXA LINES 1.25.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YP.Com _ToolBar Toolbar 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YPOPs 0.8.3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YPOPs 0.8.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YS Flight Simulation System 2000 20050402.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YTunes 1.00.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YUVTools 1.1.8.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YW Guestbook 1.45.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YaCy 0.44.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YaTM 1.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yacht 2.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yachts 3D Screensaver 1.4.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yadio 1.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yagol 1.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YahArch 1.0.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahadi Web Browser 4.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo AutoReply Featuring Groups 3.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Autoreply 2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Calendar .zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Companion Toolbar 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Desktop Search beta .zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Essentials 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Funny 2.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Go Mobile .zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Go for TV 0.1.34.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Group Downloader 2.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Historical Quotes Downloader 1.04.01.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Local Traffic Widget 1.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Mail Checker 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Maps widget .zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Message Archive Decoder 4.13.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Messenger (CE palmtop, MIPS) 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Messenger (Classic) 2.5.3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Messenger 2.5.3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Messenger 3 beta.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Messenger Monitor Sniffer 3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Messenger Plug-In SDK 1.0b1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Messenger with Voice 8.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Music Jukebox 2.0.0.127.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Pop 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Ranking Booster 7.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Toolbar with AntiSpy 6.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Video Search 1.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo Widgets Engine 3.1.4.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahoo! SiteBuilder 2.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YahooBin 1.03.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YahtChallenge 4.0.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahtzee .zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahtzee 1.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahtzee 123 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yahtzee for Pocket PC 1.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yak Community Client 3015c.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yak On 1.10.04.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YakaMoov 1.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yakity-YakMail 1.7.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yakoon 2.0.0.210.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yaldex Colored ScrollBars 1.6.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yaldex PopUp 4.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yaldex StatusTitle Maker 5.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yamaha CRW-F1ZE Firmware Upgrade 1.0d (1042002).zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yamaha CRW-F1ZEN Firmware Upgrade 1.0d (1042002).zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yamicsoft Password Storage 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yammy Yammy 1.13.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yankee Clipper X 1.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yanoff 1.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yanoff Minus 3.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yantras 2.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yapp - the Project Calculator 2.0.6.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yaps 2.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yarrow Mailer 1.12.0.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yasa AudioDataVideo CD Burner 4.3.9.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yasa MPEGAVI to VCDDVDSVCDMPEGAVI Converter 2.4.74.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yasa Video Converter 3.2.058.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yasp--MSN Messenger Content 0.3.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yassak 5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yate - Yet Another Telephony Engine 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yatzee 1.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yatzy 2.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yav's RAD Tools 1.3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Ycopy 1.0d.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YcySoft Flash ScreenSaver Maker 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YcySoft ScreenSaver Producer 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Ye Olde Darts 2.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yeah Write 1.7.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yeam's Froogle Uploader 1.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Year 10 Interactive Maths (2nd Ed) - Home Licence 5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Year 7 Interactive Maths (2nd Ed) - Home Licence 5.00.01.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Year 8 Interactive Maths (2nd Ed) - Home Licence 5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Year 9 Interactive Maths (2nd Ed) - Home Licence 5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YearPlanner 2.4.4.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yeeta 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yellow Button 2.1.9.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yellow Flowers Jigsaw Puzzle 104pc.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yellow Pages Crawler 1.091.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yellow Shirt Odyssey 2.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YellowBill 1.01.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YellowPen 2.1.27.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yellowpipe Lynx Viewer 1.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YemuZip 1.2.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yendorian Tales demo .zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YeoSoft MDB to XML Converter 1.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YeoSoft Text to MP3 Speaker 5.1.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yerevan Drive Demo.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yes! I Can Run My Business Runtime Edition 7.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yesolo on the Keyboard 8.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yet Another Pirate Party.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yhalematik 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YiShow Explorer 6.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yinghan English-Chinese Dictionary 2.3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yinghan Talking English-Chinese Dictionary 2.8.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yinyang 1.02.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yipe II 1.06.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yipe III 1.16.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yipe III 1.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YoGen Audio Converter 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YoGen Audio Recorder 3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YoGen Vocal Remover 3.0.1.3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yoda Stories demo .zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yoga 2.4.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yoga Flashcards 3.11.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yoga For General Desktop Application 1.1.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yogasana For General Desktop Application 1.1.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yojimbo 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yokozuna for Pocket PC 1.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yokozuna! 1.0.4.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YoncaTV PLUS 2.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yoono 2.0.0.361.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yore Version Control Client 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\York's PocketTime (ARMXScale) 1.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yosemite Backup Standard 8.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yosemite Falls Screensaver 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yosemite by The Drawing Hand 5.6.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yoshi's Island Icons 0.9.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YostWorks Dock Dispatcher 1.0.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\You Control Tunes 1.2.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\You Don't Know Jack TV demo .zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\You Don't Know Jack demo .zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\You Got Booted 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\You Need It 1.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\You Perform 1.1.3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\You Will Learn It 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\You've Got Files 2.409.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\You've Got Mail 1.2 build 1008.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\You, Me and Dupree IM icons .zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YouHaveFiles 1.0.14.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YouTubeMCE 0.6.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Youmehub Multi User 1.0.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Young Jeezy - Welcome To Tha Tundra_MixFiend.com_2006.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Young Sherlock Holmes and the Pyramid of Fear.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YoungStar Skills Expert Math 1.02.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YoungStar Skills Expert Math 1.4.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Youngblood demo .zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Your Bad Attitude 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Your Birthday News 3.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Your Brothers Keeper 5.3.18.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Your Camera 2.6.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Your CueCat Driver 0.90.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Your Guide to ICCF Numeric Notation 12.08.2005.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Your Guide to Merchant Accounts 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Your Own ScreenSaver 1.3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Your Personal Catalogue 1.0.07.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Your Step By Step Guide To Success On The Internet 1.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Your Treasure Map to Success in MLM 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Your Uninstaller 2006 5.0.0.233.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Your Voice Reminder 1.6.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YourBestCatalog 0.92.16.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YourDir 1.7.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YourFolder 2.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YourKit Profiler for .NET 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YourStamp 1.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Youthere1.com's Toolbar 4.5.115.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YoutubeDownloader 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yubilee Messenger 2.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yudoku 1.02.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YukonSoft E-Business Solutions (Y.E.S.!) 7.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yuletide Scenes Christmas Saver 5.0.14.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\YumZee 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yummi 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yummy FTP 1.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yummy Puzzle 1.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\Yunus 3.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[A-E] Capeta 25 [A0EA9895] avi.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[AHQ] Tenjou Tenge 01-26 [Dual Audio] MKV.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[AniMa-RAW]Ghost in the Shell Stand Alone Complex-Solid State Society[TV screening w 2 bonus video].zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[Anidojo] Shin Bible Black 3 UNC ITA.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[CRACK] GTR 2 RELOADED CRACKBRANDNEW + WEBSEED.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[DB-BR] Naruto 200.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[DB] Bleach 96.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[DB] Naruto 200 [00016DC4] avi.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[Devil's] Ergo Proxy 19 vostfr avi.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[HKG&X2][Strawberry Panic][24][RMVB][BIG5] rmvb.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[Kyuu] Black Blood Brothers - 01[BD798197] avi.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[Kyuu] Black Blood Brothers - 01v2[F60849A5] avi.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[Kyuu] Kiba - 24[413AC28F] avi.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[Lunar] Coyote Ragtime Show - 09 [F44A933D] avi.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[Lunar] Ouran High School Host Club - 23 [4F3AF25E] avi.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[MANGA ITA]Video Gilr Len (seguito di Video Girl Ai)[colombo-bt org].zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[PSP] Killzone Liberation Demo [USA] - [www ESPALPSP com] rar.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[PSP] Ridge Racer 2 [JAP]-[RIP] - [www ESPALPSP com] rar.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[PSP] Ridge Racers 2 [JAP]-[FULL] - [www ESPALPSP com] rar.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[PSP]LEGO Star Wars II The Original Trilogy[EUR][MULTI-6 FULL][www ESPALPSP com] rar.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[Pino-no-Usagi] Ergo Proxy 20 [3858286D] avi.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[S^M] BLEACH 96 RAW avi.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[S^M] NARUTO 200 RAW avi.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[Shinsen-Subs] Blood+ 47 [43A70960] avi.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[Shinsen-Subs] Blood+ 48 [0F450D9F] avi.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[Shinsen-Subs] NIGHT HEAD GENESIS - 07 [3E85756E] avi.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[T-N]Keroro Gunsou Movie[183607E6]DVD avi.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[T-N]Transformers Victory - 21-24.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[WF] School Rumble - 26 [BD11525D] avi.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[WLGO&KTKJ][Utawarerumono][24][BIG5][RV10] rmvb.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\[gg] Coyote Ragtime Show 09 [100A65BB] mkv.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\akkan 1 zip.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\b-Wall XP Firewall Control 2.5.059.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\b2evolution 0.9.0.11.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\broken sword.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\cJAM - Central Jet Accounts Manager 1.5.0.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\call of juarez.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\cbConnect 2.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\cb_PMM Port-Mapping-Monitoring 1.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\company of heroes.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\cool wallpapers 1024x768.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\cool wallpapers 1280x1024.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\cool wallpapers 800x600.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\cool wallpapers1024x768.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\cool wallpapers1280x1024.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\cool wallpapers800x600.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\da vinci code.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\dcp 9-10-06.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\eDonkey Just Died.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\eLToN JoHN - THe CaPTaiN aND THe KiD-2oo6-RNS.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\family guy.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\fifa 07.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\fifa 2007.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\hAcx Internet Auto-Dialer 0.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iGolf 1.04.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iHOC Query .NET 1.0.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iHatePopups 1.5.443.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iHateSpam 4.0.619.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iHateSpam for Exchange 1.7.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iHavePhotos 1.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iHelp 1.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iHub Toolbar 4.5.101.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iIChat Logger 2.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iISystem Wiper 2.4.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iInventory 7.0.1.12.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iKE Office WE 7.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iKey 2.0.3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iKeyword 0.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iKnow Process Scanner 1.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iLab Easy Leaves 1.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iLab Job Manager 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iM1A2 Abrams demo .zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iMEDIAN 4.10.1121.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iMac DVD-ROM Update 1.0 (122299).zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iMac Firmware Update 4.1.9.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iMac Update 1.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iMacros 5.1 build 115.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iMagic Hotel Reservation 3.59.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iMagic Inventory 1.91.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iMagic Kennel Reservation 1.15.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iMagic Restaurant Reservation 2.15.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iMagic Survey Pro 1.24.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iMagic Timetable Master 2.8.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iMailLight 0.9.0.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iMediaConvert 3.3.15.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iMesh 6.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iMeter 1.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iMic Control 1.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iMiser Research Assistant 3.1 build 1073.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iModel Predictor 2003.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iModeller 3D Web Edition 2.6.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iMovie 4.0.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iMovie Plug-in Pack 2.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iMovie Updater 2.1.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iMp3 1.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iMpeg Converter 2.15.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iNET Grabber 1.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iNavigate Free Menu Code Edition 4.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iNeeda Password & Tracker 3.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iNeeda Password & Tracker Pro 3.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iNet Protector 2.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iNet Stream Archiver 1.6.7.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iNetAdviser 4.5.10.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iNetCalc 2.59.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iNetFormFiller 3.03.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iNetFormFiller Free 3.5.07.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iNetFormFiller Professional 3.0.03.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iNetSoft Calendar 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iNetSoft Workspace 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iNetWatcher 6.1.03.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iNewYork 2.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iNews 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\imEye 1.3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\imageCLASS MF6530 Printer Driver for Windows 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\imageCLASS MF6550 Printer Driver for Windows 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\imageCLASS MF6560 Printer Driver for Windows 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\imageCLASS MF6580 Printer Driver for Windows 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\imageX 3.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\imageshackert 0.5.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\imeem 1.28.6.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\inContext 3.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\inDisc Recovery 3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\iron maiden.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\jAptSchedule 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\jAscii 1.0.20.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\jBubblet 1.0.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\jClientUpload 1.6.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\jCron 1.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\jEdit 4.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\jFolder 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\jIRC Applet 2.6.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\jKool Personal 1.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\jLynx JDBC Framework 1.0 R3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\jMemorize 0.9.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\jNote 1.4.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\jenna jameson.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\jit-mdb 2000 8.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\jit-not 8.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\jit-sap 8.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\jit-vb 8.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\jit-xls 8.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\john mayer.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\justin timberlake.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\knSudokuDiagonal 1.0.23.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\krpRegions Library 2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\l'equipe du 14 09 2006 pdf.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\lego star wars.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\listcent BrowserToolbarSearchbar 4.5.114.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\liteLabel 2.4.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\little man.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\little miss sunshine.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\liveDJpro 1.3.564.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\miami vice.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\monster house.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\nhl 07.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\nhl 2007.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\nip tuck.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\paxCompiler 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\payACH 1.5.29.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\pc world october 2006 pdf.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\pcAudit 6.3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\pcGuardIT Client Edition 1.0.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\pcInternet Patrol 3.2.3.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\pcParent Watchdog 8.3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\pclip108.exe 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\prison break french.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\prison break.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\qBittorrent The ultimate Linux Bittorrent Client.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\s2 (s~quad) Small Business Edition 1.0.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\sCARface Raging Racing 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\safeHtmRename 1.0.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\scissor sisters.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\screen-scraper basic edition 2.7.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\snakes on a plane.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\spyware Doctor 4 0 0 2602 rar +crak.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\star wars.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\stargate atlantis.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\step up.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\superman returns.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\the covenant.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\the killers.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify C1D0-510 7.0.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - A+2003 Practice Test for Exam 220-301 - 224+ Questions 7.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - A+2003 Practice Test for Exam 220-302 - 325+ Questions 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - CIW Practice Test for Exam 1D0-420 - 153+ Questions 6.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - CIW Practice Test for Exam 1D0-425 - 265+ Questions 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - CIW Practice Test for Exam 1D0-450 - 150+ Questions 6.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - CIW Practice Test for Exam 1D0-470 - 345+ Questions 8.02.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - CIW Practice Test for Exam 1D0-510 - 485+ Questions 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - CIW Practice Test for Exam 1D0-520 - 250+ Questions 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - I-Net+ Practice Test for Exam IK0-002 - 250+ Questions 7.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - JCP Practice Test for Exam 310-025 - 232+ Questions 6.10.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - Linux+ Practice Test for Exam XK0-002 - 346+ Questions 8.02.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCDST Practice Test for Exam 70-271 - 325+ Questions 8.02.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCDST Practice Test for Exam 70-272 - 238+ Questions 7.02.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCDST Practice Test for Exam 70-272 - 238+ Questions 8.03.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSA Practice Test for Exam N10-002 - 192+ Questions 6.10.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSA Practice Test for Exam SK0-001 - 160+ Questions 6.10.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSD Practice Test for Exam 70-305 - 320+ Questions 8.02.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSD Practice Test for Exam 70-310 - 330+ Questions 8.02.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSD Practice Test for Exam 70-315 - 315+ Questions 8.01.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSD Practice Test for Exam 70-316 - 305+ Questions 8.01.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSD Practice Test for Exam 70-320 - 325+ Questions 8.01.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSD.NET Practice Test for Exam 70-315 - 315+ Questions 8.01.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSD.NET Practice Test for Exam 70-316 - 255+ Questions 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSD.NET Practice Test for Exam 70-320 - 250+ Questions 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSE Practice Test for Exam 70-210 - 410+ Questions 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSE Practice Test for Exam 70-214 - 102+ Questions 7.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSE Practice Test for Exam 70-215 - 475+ Questions 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSE Practice Test for Exam 70-216 - 335+ Questions 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSE Practice Test for Exam 70-218 - 300+ Questions 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSE Practice Test for Exam 70-219 - 190+ Questions 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSE Practice Test for Exam 70-220 - 160+ Questions 6.09.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSE Practice Test for Exam 70-221 - 195+ Questions 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSE Practice Test for Exam 70-223 - 93+ Questions 7.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSE Practice Test for Exam 70-224 - 250+ Questions 6.12.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSE Practice Test for Exam 70-227 - 200+ Questions 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSE Practice Test for Exam 70-228 - 306+ Questions 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSE Practice Test for Exam 70-229 - 306+ Questions 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSE Practice Test for Exam 70-270 - 294+ Questions 8.01.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSE Practice Test for Exam 70-284 - 224+ Questions 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSE Practice Test for Exam 70-290 - 400+ Questions 8.05.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSE Practice Test for Exam 70-291 - 400+ Questions 8.04.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSE Practice Test for Exam 70-292 - 390+ Questions 8.05.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSE Practice Test for Exam 70-293 - 335+ Questions 8.02.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSE Practice Test for Exam 70-294 - 320+ Questions 8.02.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSE Practice Test for Exam 70-296 - 360+ Questions 8.01.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSE Practice Test for Exam 70-298 - 105+ Questions 8.02.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSE Practice Test for Exam 70-299 - 290+ Questions 8.02.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSE Practice Test for Exam 70-306 - 336+ Questions 8.02.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - MCSE-2003 Practice Test for Exam 70-298 - 90+ Questions 8.01.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - Network+2005 Practice Test for Exam N10 8.03.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - OCP Practice Test for Exam 1Z0-001 - 300+ Questions 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - OCP Practice Test for Exam 1Z0-007 - 280+ Questions 6.07.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - OCP Practice Test for Exam 1Z0-031 - 280+ Questions 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - OCP Practice Test for Exam 1Z0-032 - 280+ Questions 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - OCP Practice Test for Exam 1Z0-033 - 280+ Questions 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - OCP Practice Test for Exam 1Z0-147 - 280+ Questions 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - SCJP Practice Test for Exam 310-035 - 435+ Questions 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify - Security+ Practice Test for Exam SY0-101 - 253+ Questions 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify C1D0-450 7.0.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify C220-301 A + Core Hardware (2003) 7.0.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify C220-302 A + Operating System Technologies (2003) 7.0.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify CIK0-002 i-Net+PrepKit 7.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify CN10-002+PrepKit 6.10.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify MCDBA MCSD.NET - 70-229,Exam Simulation 8.0.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify O1Z0-147 Oracle9i Program with PLSQL 8.0.5.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify Prekit 70-305 Exam 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify Prekit 70-306 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify Prekit 70-310 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify Prekit [C1D0-470] CIW Professional 8.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify PrepKit For CIW Exam 1D0-420 6.00.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify PrepKit for Microsoft exam 70-028 6.09.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify PrepKit for Microsoft exam 70-029 6.08.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify Prepkit [CIK0-001] i-Net 6.11.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify S310-025 SUN Certified Programmer For JAVA 2 Platform 6.10.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify SCX310-035 Sun Certified Programmer for Java 2 Platform 1.4 7.02.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uCertify Server+PrepKit 6.10.05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uGrabIt 1.0.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uICE 2.19.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uMark Lite 1.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uMark Professional 1.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\uMenu 1.03.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\ubSpawn 0.3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\v-Phone 1.04-3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\vCaller ID Basic 1.0r.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\vCard Manipulator 1.3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\vCard Wizard 2.21.0080.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\vCardOrganizer 1.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\vDrive Plus 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\vLog 1.69.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\vbMysqlBrowse 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\vbWizards 1.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\viewTunes Jukebox 1.0.3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\viewTunes Jukebox 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\viralPDF .zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\visKeeper 2.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\w3IDE NexGen Edition 2.0.0c.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\wAPI Monitor for Windows 3.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\wArcanoid V The Solar System 3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\wBoard 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\webGuru 1.4.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\webcamAMP 1.4.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\windows vista.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\windows xp.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\world trade center.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\x men.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\xTorrent Taking Bittorrent to another Level.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\yBook 1.4.28.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\yBrowser 8.0.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\yDecode 1.22.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\yEd Diagram Editor 2.4.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\yGen 1.0.1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\yGuide Yoga 1.6.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\yKAP Issue and Bug Tracking Software 2.40.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\yLend 1.0.2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\yMail 1.0.13.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\yPlay 1.0.55.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\yRead 2.0.46.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\yRoute 2.0.38.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\yTimer 1.0.17.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\yWriter 2.2.83.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\My Downloads\Shared\yvReminder 3.0.2256.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Program Files\outlook\p.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Program Files\outlook\v.tmp -> Worm.VB.dw : Cleaned with backup (quarantined).

::Report end

Incident Status Location

Adware:adware/savenow Not disinfected Windows Registry
Hacktool:Generic Application Not disinfected C:\Documents and Settings\Chad.EMACHINE\Desktop\BSINSTALL.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Chad.EMACHINE\Desktop\SDFix.zip[SDFix.exe][SDFix\apps\Process.exe]
Hacktool:Exploit/CodeBase.A Not disinfected C:\install.htm
Adware:Adware/Itbill Not disinfected C:\Program Files\fsupport\notifier.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\SDFix\apps\Process.exe
Potentially unwanted tool:Application/RealSpy Not disinfected C:\WINDOWS\system32\actskn45.ocx
hijack this

Logfile of HijackThis v1.99.1
Scan saved at 11:20:40 PM, on 1/30/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\PROGRA~1\MI3AA1~1\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-us\bin\WindowsSearch.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-us\bin\WindowsSearchIndexer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Documents and Settings\Chad.EMACHINE\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = googel.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = googel.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R3 - URLSearchHook: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - C:\PROGRA~1\BEARSH~2\BEARSH~2\MediaBar.dll
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [BearFlix] "C:\Program Files\BearFlix\BearFlix.exe" /pause
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MI3AA1~1\wcescomm.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-us\bin\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll/search.htm
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by106w.bay106.mail.live.com/mail/resources/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://maricopa.gov/assessor/gis/plugin/mgaxctrl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1151740312937
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1151796431515
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

hopr this helps

fredmh · Jan 31, 2007

Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

C:\install.htm

C:\WINDOWS\system32\actskn45.ocx

C:\Program Files\fsupport\notifier.exe

If these files resist deletion, boot into Safe Mode and delete
----------------------------------------

Your logs are now clean. Please complete the next "housekeeping" steps and read through the information below.

----------------------------------------

Windows XP - Reset Hidden Files

Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View tab.
Deselect the Show hidden files and folders option.
Select the Hide file extensions for known types option.
Select the Hide protected operating system files option.
Click Yes to confirm.
Click OK.

----------------------------------------

Clean-out and Reset System Restore

This will clean out any junk or malicious files left behind in System Restore

To turn off System Restore click Start > Right Click My Computer > Properties.
Click the System Restore tab and Check
"Turn off System Restore" or "Turn off System Restore on all drives" Click Apply.
When turning off System Restore, the existing restore points will be deleted. Click Yes to do this then Click OK.
Turn on System Restore by Clicking Start. Right-click My Computer, and then click Properties.
Click the System Restore tab. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives."
Click Apply, and then OK.

This will create a new Restore Point.

----------------------------------------

RE-ENABLE ANTI-SPYWARE APPLICATIONS

If you were instructed to dis-able Anti-spyware applications during this fix, you may re-enable them

----------------------------------------

Please read through the following information to help protect your computer in the future.

KEEP YOUR OPERATING SYSTEM UPDATED

Please ensure that you have already patched your system against the recent WMF exploit. Go to this page to get the KB912919 patch

MICROSOFT UPDATES

It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser
up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft
and download all the critical updates to help prevent possible re-infection.

ENABLE WINDOWS AUTO UPDATE

Go to Start>Run - type wuaucpl.cpl
tick on the checkbox - "Keep my computer up to date"
Under settings, choose "Automatically download the updates, and install them on the schedule that I specify".
Click on "OK".

ENABLE WINDOWS AUTO UPDATE

From within Internet Explorer click on the Tools menu and then click on Internet Options.

Select the Security tab
- Click once on the Internet icon so it becomes highlighted.
- Select Custom Level .
  - Change 'Download signed ActiveX controls' to Prompt
  - Change 'Download unsigned ActiveX controls' to Disable
  - Change 'Initialize and script ActiveX controls not marked as safe' to Disable
  - Change 'Installation of desktop items' to Prompt
  - Change 'Launching programs and files in an IFRAME' to Prompt
  - Change 'Navigate sub-frames across different domains' to Prompt
  - When all these changes have been made, click on the OK button.
- If it prompts you as to whether or not you want to save the settings, press the Yes button.
Select OK to exit the Internet Properties page.

TOOLS TO HELP KEEP YOUR SYSTEM CLEAN

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:

SpywareBlaster to help prevent spyware from installing in the first place.

Install & update SpywareBlaster with the latest definitions.
After you have updated, click the button - enable protection for all unprotected items

SpywareGuard to catch and block spyware before it can execute.

SPYBOT - SEARCH & DESTROY Download and install Spybot - Search & Destroy with its
TeaTimer option.
This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with
the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here

AD-AWARE Download and install Ad-Aware. You should use this program to scan
your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product
can be found here

IE-SPYAD IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.

Download IE-SpyAD - Extract the contents to a new folder
From within the folder, double-click install.bat
Select Option #2 - Install the new IE-SPYAD list.
Then return to the main menu.
Select option #4 - Add the old porn sites domain

A tutorial for IE-SPYAD can be found here

MVPS HOST FILE The MVPS Hosts file replaces your current HOSTS file
with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to
those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.

Download Host.zip to your desktop.
From your Desktop right-click (hosts.zip) and select:
Extract All from the menu.
Click Next, click Next, select the option:
"Show Extracted files"
Click Finish

This will open the newly created hosts folder on your Desktop.

Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated
HOSTS file to the correct location on your machine.

MCAFEE SITE ADVISOR SITE ADVISOR is a free IE plug-in (also suport for Firefox browser)
which is used in conjunction with the Google search engine. It advises which web sites are considered safe and which sites could pose a problem.
It also shows what problems were encountered with each site, such as malicious downloads, spam, and related links.

ANTI-VIRUS AND FIREWALL PROGRAMS

ANTIVIRUS SOFTWARE It is very important that you have anti-virus software running on your machine.
This alone can save you a lot of trouble with malware in the future.
See this link for a listing of some online antivirus scanners: Anti-Spyware Tutorial

Here are some very good free Antivirus products which are available:

Avast!
AVG

If you do not have a firewall, here are 4 free ones available for personal use:

Understanding and Using Firewalls

INFORMATIONAL READING

In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles:

PC SAFETY AND SECURITY
HOW DID I GET INFECTED IN THE FIRST PLACE?
THE ANTI-SPYWARE TUTORIAL
MAKING INTERNET EXPLORER SAFER
INVASION OF THE COMPUTER SNATCHERS
The Cookie Concept

Please respond one more time and let me know you received this post so it can be marked resolved, unless you are having other problems.

If you feel that we have helped you, please help us keep this site free for all. Please visit our DONATION PAGE.

beougher · Feb 2, 2007

ok I did everthing, but could not find C:\WINDOWS\system32\actskn45.ocx
to delete and I had trouble installing IE-SPYAD. Other than that everything is running great. Thanx for your help

fredmh · Feb 2, 2007

You're welcome. Glad I could help.

If the file's not there, don't worry. It's already gone.

Infected with alcra from limewire this is my hijack this log

beougher

Registered

fredmh

Registered

beougher

Registered

beougher

Registered

fredmh

Registered

beougher

Registered

fredmh

Registered

beougher

Registered

fredmh

Registered

beougher

Registered

fredmh

Registered

beougher

Registered

fredmh

Registered

beougher

Registered

fredmh

Registered