Tech Support banner
Status
Not open for further replies.
1 - 12 of 12 Posts

·
Registered
Joined
·
21 Posts
Discussion Starter · #1 ·
I've read through the self help threads. I found that the resolved clickspring thread last posted 01\14\07 was the most helpful although I am running some other programs. Ok, here goes:

WinXP SP2, two profiles. Profile A (password protected) repeatedly receives a ClickSpring.PuritySCAN warning from Windows Defender and removed is selected each time. Profile B (not password protected) does not receive the warning at all. I've run Ad-Aware, Spybot, MS Malicious software removal, windows update, zone alarm anti virus/spyware, SuperAntiSpyware, Windows OneCare safety scanner. Here is the Hijackthis log file:

Logfile of HijackThis v1.99.1
Scan saved at 4:53:18 PM, on 1/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe
C:\Program Files\Lexmark 5200 series\lxbtbmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\WINDOWS\system32\lxbtcoms.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\HJT\Hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {5FA8A657-36ED-6312-BDEA-32A67E2D91CB} - C:\WINDOWS\system32\pevlrp.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark 5200 series] "C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe"
O4 - HKLM\..\Run: [LXBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll,[email protected]
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID {DA9935BA-22F7-44ee-BD12-BD8B87700BEA}
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: MANSION - {CD03D14B-0EF6-4f5a-BB81-1ECAFFC676AF} - C:\Program Files\MANSION\Villa\MANSION.exe
O9 - Extra 'Tools' menuitem: MANSION - {CD03D14B-0EF6-4f5a-BB81-1ECAFFC676AF} - C:\Program Files\MANSION\Villa\MANSION.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9602.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/luxr/default/mjolauncher.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://download.games.yahoo.com/games/web_games/popcap/bejeweled2/popcaploader_v6.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e te-110-12-0000245 (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: lxbt_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbtcoms.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
 

·
Registered
Joined
·
2,335 Posts
Hello pegasus2149, and welcome to TSF


Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools,
then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.


Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding.
Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this
webpage would not be available when you're carrying out the fix.



IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER.

----------------------------------------

The fixes we will use are specific to your problems and should only be used for this issue on this machine.

Please only use this topic to reply to. Do not start another thread.
If any other issues arise let me know.

The process is not instant. Please continue to review my answers until I tell you your machine is clear.
Absence of symptoms does not mean that everything is clear. So lets do this to the end!

Please make every effort to reply to my posts in a timely manner. Malware breeds malware and the longer an infection remains on a system, the more
likely additional infections will result.


----------------------------------------

You have a few things showing in the log. Let's clean this up and find out what else may be hiding.


----------------------------------------

DOWNLOADS


CLEANUP! version 4.52 – TEMP FILE CLEANING


Please download Cleanup! and install it. You will use this later.

Alternative link Cleanup Alt


*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does not make backups.



AVG Anti-Spyware 7.5



Please download AVG Anti Spyware

Use the link at the bottom of the page under "AVG Anti-Spyware Free for Windows"





  1. Install AVG Anti-Spyware 7.5.
  2. Double-click the icon on Desktop to launch AVG A-S 7.5
  3. On the top of the main screen click Shield
  4. Click the word active to change it to inactive
  5. On the top of the main screen click Update.
  6. Then click on Start Update. The update will start and a progress bar will show the updates being installed.
  7. I also recommend changing the "Update interval" to something more reasonable like 12 hours.


SDFix

Download SDFix and save it to your desktop.

We will use this later.



ComboFix



1. Download this file - You MUST save it to your desktop

COMBOFIX





2. 2. Go to <<Start>> then <<Run>> then paste in the single line command then click OK

"%userprofile%\desktop\combofix.exe" /v pevlrp



3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

----------------------------------------

DISABLE ANTI-SPYWARE APPLICATIONS

Please disable these Anti-Spyware programs as they may interfere with this fix. You may re-enable them after we clean your system.

----------------------------------------

SAFE MODE RE-BOOT

Please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Use the up arrow key to highlight Safe Mode and press Enter.
5) Login with your usual account. Make sure to close any open browsers.

----------------------------------------

FIXES AND DELETIONS



Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =


Please remember to close all other windows, including browsers then click Fix checked.

----------------------------------------

SDFix

  • Right click the SDFix.zip folder and choose Extract All,
  • Open the extracted folder and double click RunThis.bat to start the script.
  • Type Y to begin the script.
  • It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • Your system will take longer that normal to restart as the fixtool will be running and removing files.
  • When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons.
  • Finally open the SDFix folder on your desktop and copy and paste the contents of the results file
    Report.txt back onto the forum with a new HijackThis log

----------------------------------------

RUNNING SCANNERS


Cleanup

Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
Set the program up as follows:

Click "Options..."
Move the arrow down to "Custom CleanUp!"
Put a check next to the following (Make sure nothing else is checked!):
  • Empty Recycle Bins
  • Delete Cookies
  • Delete Prefetch files (if present)
  • Cleanup! All Users
  • Click on the Temporary Files tab and uncheck the box for Scan drives for files matching if it’s checked.
Click OK
Press the CleanUp! button to start the program and DO NOT reboot when prompted.


AVG Anti-Spyware 7.5

  • Run AVG A-s with it's updated definitions: (...it's important that all windows must be closed)
    This scan can take quite a while to run, so be prepared.
  • Click Scanner
  • Click on the Scan tab
  • Click Complete System Scan to begin scanning.



  • When the scan is complete click Recommended Action and change it to Quarantine (1),
  • If not click Recommended Action and choose Quarantine from the popup menu. (2)
  • At the bottom of the window click on the Apply all Actions button. (3)

When done, click the Save Scan Report button. (4) then click Save Report As and save it to your desktop.

IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.



Note: DO NOT USE the computer while AVG A/S is scanning. If Explorer or the Control Panel are opened some malware types will
reinfect your system or will not be cleaned properly.

----------------------------------------

SYSTEM RE-BOOT

Reboot into Normal Mode.

----------------------------------------


ON-LINE SCANS

Perform an online scan with Internet Explorer with Panda ActiveScan

  1. Click on
    located at the bottom of the page.
  2. A "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
  3. Enter your e-mail address, country, and state & click "Free Online Scan" * The download of the 8 MB Panda's ActiveX control will take place *

Begin the scan by selecting

  • If it finds any malware, it will offer you a report.
  • Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
  • Click on
    then click

* You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
* Turn off the real time scanner of any existing antivirus program while performing the online scan


----------------------------------------

FOLLOW-UP

Please return and post these items in the order listed:

c:\combofix.txt
SDFix log
AVG A/S
Panda scan
A new HJT log run in Normal Mode


Please note: In order to properly see what is on your system, all HJT logs must be run in the normal mode

Please let me know how your system is behaving.
 

·
Registered
Joined
·
21 Posts
Discussion Starter · #3 ·
(Part 1 of 3)(too many characters) Hi again, I worked on this all night. Profile A is NO longer getting the ClickSpring.PuritySCAN warning from Windows Defender. Here are the log files you requested in the order you want:

"Carol" - 07-01-23 22:19:14 Service Pack 2
ComboFix 07-01-23.2 - Running from: "C:\Documents and Settings\Carol\desktop"
Command switches used :: /v pevlrp

(((((((((((((((((((((((((((((((((((((((((((((((( Vundo Log )))))))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\pevlrp.dll


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *



(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\unsvchosts.lzma
C:\Program Files\Common Files\{347BD~1
C:\Program Files\Common Files\{A47BD~1
C:\Program Files\Common Files\{A47BD~2
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Folders Quarantined:
C:\qoobox\purity\Program Files\RACLE~1
C:\qoobox\purity\Program Files\Common Files\CROSOF~1
C:\qoobox\purity\Program Files\Common Files\FNTS~1
C:\qoobox\purity\Program Files\Common Files\SKS~1
C:\qoobox\purity\Program Files\Common Files\CROSOF~1\dexplore.exe
C:\qoobox\purity\WINDOWS\DOBE~1
C:\qoobox\purity\WINDOWS\SMANTE~1
C:\qoobox\purity\WINDOWS\system32\SKS~1
C:\qoobox\purity\WINDOWS\system32\SKS~1\SKS~1


((((((((((((((((((((((((((((((( Files Created from 2006-12-23 to 2007-01-23 ))))))))))))))))))))))))))))))))))


2007-01-23 22:20 <DIR> d-------- C:\WINDOWS\erdnt
2007-01-23 22:14 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-01-23 22:14 <DIR> d-------- C:\Program Files\Grisoft
2007-01-23 19:30 <DIR> d-------- C:\Program Files\Mexican Motor Mafia
2007-01-23 16:48 <DIR> d-------- C:\HJT
2007-01-23 16:13 <DIR> d-------- C:\{80010297-0000-0000-4566-0CAD770FD4A9}
2007-01-23 15:18 <DIR> d-------- C:\Program Files\Windows Live Safety Center
2007-01-22 18:17 <DIR> d-------- C:\WINDOWS\CAVTemp
2007-01-22 16:28 1,021,504 --a------ C:\WINDOWS\system32\vete.dll
2007-01-22 15:33 <DIR> d-------- C:\DOCUME~1\Carol\Application Data\MailFrontier
2007-01-22 15:18 77,824 --a------ C:\WINDOWS\system32\driverif.dll
2007-01-22 15:18 75,776 --a------ C:\WINDOWS\zllsputility.exe
2007-01-22 15:18 653,072 --a------ C:\WINDOWS\system32\imsinstall.dll
2007-01-22 15:18 645,904 --a------ C:\WINDOWS\system32\drivers\vetmonnt.sys
2007-01-22 15:18 21,605 --a------ C:\WINDOWS\system32\drivers\vet-filt.sys
2007-01-22 15:18 15,668 --a------ C:\WINDOWS\system32\drivers\vet-rec.sys
2007-01-22 15:18 12,288 --a------ C:\WINDOWS\system32\vetntmsg.dll
2007-01-22 15:18 115,088 --a------ C:\WINDOWS\system32\drivers\vetfddnt.sys
2007-01-22 15:18 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
2007-01-22 15:18 <DIR> d-------- C:\WINDOWS\system32\ZoneLabs
2007-01-22 15:17 <DIR> d-------- C:\WINDOWS\Internet Logs
2007-01-18 22:47 <DIR> d-------- C:\Program Files\The Treasures Of Montezuma
2007-01-18 22:12 <DIR> d-------- C:\Program Files\Mysteryville
2007-01-17 11:01 <DIR> d-------- C:\Program Files\Aztec Bricks
2007-01-13 09:54 <DIR> d-------- C:\Program Files\Mystery Case Files Ravenhearst
2007-01-12 03:00 <DIR> d-------- C:\WINDOWS\ie7updates
2007-01-08 21:19 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-01-08 21:19 <DIR> d-------- C:\DOCUME~1\Carol\Application Data\SUPERAntiSpyware.com
2007-01-08 21:18 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-01-08 10:23 <DIR> d--hs---- C:\WINDOWS\Smlt
2007-01-05 13:05 <DIR> d-------- C:\DOCUME~1\Carol\Application Data\iWin
2007-01-05 12:00 <DIR> d-------- C:\Program Files\DNA
2006-12-28 18:06 <DIR> d-------- C:\DOCUME~1\Carol\Application Data\Boomzap
2006-12-27 21:54 <DIR> d-------- C:\Program Files\Pocket Tanks Deluxe
2006-12-27 18:14 <DIR> d-------- C:\DOCUME~1\Carol\Application Data\Beep Industries
2006-12-25 11:40 <DIR> d-------- C:\Program Files\Holiday Bonus
2006-12-24 22:16 <DIR> d-------- C:\Program Files\Scorched3D
2006-12-23 20:05 406,224 --a------ C:\WINDOWS\ReindeerPoop.scr
2006-12-23 20:05 404,844 --a------ C:\WINDOWS\ReindeerPoop.exe
2006-12-23 20:05 40,960 --a------ C:\WINDOWS\ReindeerPoop.dll
2006-12-23 19:32 <DIR> d-------- C:\Program Files\Bookworm Adventures Deluxe
2006-12-23 13:19 <DIR> d-------- C:\Program Files\DeductionPro 2006
2006-12-23 13:12 51,716 --a------ C:\WINDOWS\system32\pdf995mon.dll
2006-12-23 13:12 118,784 --a------ C:\WINDOWS\system32\pdfmona.dll
2006-12-23 13:12 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\pdf995
2006-12-23 13:10 <DIR> d-------- C:\Program Files\TaxCut06
2006-12-23 13:09 <DIR> d--hs---- C:\WINDOWS\ftpcache


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2010-02-18 13:14 2397 --a------ C:\WINDOWS\system32\drivers\symlcbrd.sys
2007-01-23 19:05 -------- d-------- C:\Program Files\lx_cats
2007-01-22 15:46 -------- d-------- C:\Documents and Settings\Carol\Application Data\mailfrontier
2007-01-22 15:33 -------- d-------- C:\Program Files\Common Files\symantec shared
2007-01-22 15:30 -------- d-------- C:\Program Files\norton systemworks
2007-01-16 09:12 -------- d-------- C:\Program Files\java
2007-01-14 18:38 -------- d-------- C:\Program Files\luxor amun rising
2007-01-12 11:50 -------- d-------- C:\Program Files\mystery case files prime suspects
2007-01-12 10:55 -------- d-------- C:\Program Files\mystery case files huntsville
2007-01-08 21:19 -------- d-------- C:\Documents and Settings\Carol\Application Data\superantispyware.com
2007-01-06 16:54 -------- d---s---- C:\Documents and Settings\Carol\Application Data\microsoft
2007-01-05 19:18 -------- d-------- C:\Program Files\big kahuna reef
2007-01-05 13:12 -------- d-------- C:\Documents and Settings\Carol\Application Data\iwin
2006-12-28 19:06 -------- d-------- C:\Documents and Settings\Carol\Application Data\boomzap
2006-12-27 18:14 -------- d-------- C:\Documents and Settings\Carol\Application Data\beep industries
2006-12-22 20:18 -------- d-------- C:\Program Files\abundante
2006-12-22 16:13 -------- d-------- C:\Program Files\mirror mixup
2006-12-22 15:59 -------- d-------- C:\Documents and Settings\Carol\Application Data\pi eye games
2006-12-21 12:53 -------- d-------- C:\Program Files\hidden expedition titanic
2006-12-18 17:43 -------- d-------- C:\Program Files\diamond detective
2006-12-13 19:58 -------- d-------- C:\Program Files\atlantis quest
2006-12-12 20:10 -------- d-------- C:\Program Files\avi mpeg rm wmv joiner
2006-12-10 09:32 -------- d-------- C:\Program Files\winter in forest 3d screensaver
2006-12-10 09:26 72748 --a------ C:\WINDOWS\unins001.exe
2006-12-10 09:26 72748 --a------ C:\WINDOWS\unins000.exe
2006-12-10 09:26 -------- d-------- C:\Program Files\anark
2006-12-10 09:01 282624 --a------ C:\WINDOWS\new england snow.scr
2006-12-08 20:30 -------- d-------- C:\Program Files\eusing free registry cleaner
2006-12-08 19:30 -------- d-------- C:\Program Files\mirror magic
2006-12-08 19:15 -------- d-------- C:\Program Files\kodak
2006-12-07 01:40 2362184 --a------ C:\WINDOWS\system32\wmvcore.dll
2006-12-05 18:56 -------- d-------- C:\Program Files\windows defender
2006-12-05 17:59 -------- d-------- C:\Program Files\yahoo!
2006-12-02 18:18 -------- d-------- C:\Program Files\travelogue 360 paris
2006-11-25 18:10 77560 --a------ C:\Documents and Settings\Carol\Application Data\gdipfontcachev1.dat
2006-11-08 00:06 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-11-07 21:03 6049280 --------- C:\WINDOWS\system32\ieframe.dll
2006-11-07 21:03 50688 --------- C:\WINDOWS\system32\msfeedsbs.dll
2006-11-07 21:03 458752 --------- C:\WINDOWS\system32\msfeeds.dll
2006-11-07 21:03 413696 --a------ C:\WINDOWS\system32\vbscript.dll
2006-11-07 21:03 231424 --a------ C:\WINDOWS\system32\webcheck.dll
2006-11-07 21:03 180736 --------- C:\WINDOWS\system32\ieui.dll
2006-11-07 21:03 156160 --a------ C:\WINDOWS\system32\msls31.dll
2006-11-07 03:27 382976 --a------ C:\WINDOWS\system32\iedkcs32.dll
2006-11-07 03:27 229376 --a------ C:\WINDOWS\system32\ieaksie.dll
2006-11-07 03:26 71680 --a------ C:\WINDOWS\system32\admparse.dll
2006-11-07 03:26 55296 --a------ C:\WINDOWS\system32\iesetup.dll
2006-11-07 03:26 54784 --a------ C:\WINDOWS\system32\ie4uinit.exe
2006-11-07 03:26 43008 --a------ C:\WINDOWS\system32\iernonce.dll
2006-11-07 03:26 152064 --a------ C:\WINDOWS\system32\ieakeng.dll
2006-11-07 03:26 13312 --a------ C:\WINDOWS\system32\ieudinit.exe
2006-11-07 03:26 123904 --a------ C:\WINDOWS\system32\advpack.dll
2006-11-07 03:25 161792 --a------ C:\WINDOWS\system32\ieakui.dll
2006-11-04 14:14 1245696 --a------ C:\WINDOWS\system32\msxml4.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Norton SystemWorks"="C:\\Program Files\\Common Files\\Symantec Shared\\CfgWiz.exe /GUID {DA9935BA-22F7-44ee-BD12-BD8B87700BEA}"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SoundMan"="SOUNDMAN.EXE"
"Lexmark 5200 series"="\"C:\\Program Files\\Lexmark 5200 series\\lxbtbmgr.exe\""
"LXBTCATS"="rundll32 C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\LXBTtime.dll,[email protected]"
"FaxCenterServer"="\"C:\\Program Files\\Lexmark Fax Solutions\\fm3032.exe\" /s"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"AcctMgr"="C:\\Program Files\\Norton SystemWorks\\Password Manager\\AcctMgr.exe /startup"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\""
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"QD FastAndSafe"=""
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"{A47BD646-096B-1033-0721-050314010001}"="C:\\Program Files\\Spybot - Search & Destroy\\Update.exe te-110-12-0000245"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcctMgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="AcctMgr"
"hkey"="HKLM"
"command"="C:\\Program Files\\Norton SystemWorks\\Password Manager\\AcctMgr.exe /startup"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ALi5289]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ALi5289"
"hkey"="HKLM"
"command"="C:\\Program Files\\ULI5289\\ALi5289.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"winvnc"=dword:00000003
"NVSvc"=dword:00000002

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook"
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0

*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_AVGASCLN


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\C Drive.job
C:\WINDOWS\tasks\MP Scheduled Scan.job
C:\WINDOWS\tasks\Norton SystemWorks One Button Checkup.job
C:\WINDOWS\tasks\Symantec Drmc.job

Completion time: 07-01-23 22:23:01

------------------------------------------------------------------

SDFix: Version 1.62

Tue 01/23/2007 - 22:42:31.96

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Name:

Path:


Restoring Windows Registry Entries
Restoring Default Hosts File


Rebooting...

Normal Mode:
Checking Files:

Files will be copied to Backups folder and removed:

C:\WINDOWS\system32\install.exe - Deleted



Alternate Streams Check:

C:\WINDOWS\system32
No streams found.

Final Check:

Remaining Services:
------------------


Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\WINDOWS\\system32\\fxsclnt.exe"="C:\\WINDOWS\\system32\\fxsclnt.exe:*:Enabled:Microsoft Fax Console"
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Disabled:iTunes"
"C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"="C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe:*:Enabled:TrueVector Service"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"


Remaining Files:
---------------

Backups Folder: - C:\SDFix\backups\backups.zip


Checking For Files with Hidden Attributes :

C:\NTDETECT.COM
C:\QooBox\Purity\Program Files\Common Files\CROSOF~1\dexplore.exe
C:\WINDOWS\system32\cdplayer.exe.manifest
C:\WINDOWS\system32\logonui.exe.manifest
C:\hiberfil.sys
C:\IO.SYS
C:\MSDOS.SYS
C:\pagefile.sys
C:\WINDOWS\system32\config\system.tmp.LOG

Finished
 

·
Registered
Joined
·
21 Posts
Discussion Starter · #4 ·
(Part 2 of 3):

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 11:26:10 PM 1/23/2007

+ Scan result:



C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP425\A0058478.dll -> Adware.Maxifiles : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP425\A0058479.exe -> Adware.Maxifiles : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP427\A0058797.exe -> Adware.Maxifiles : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP430\A0059025.dll -> Adware.Maxifiles : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00137410.dll -> Adware.MaxSearch : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054250.exe -> Adware.MaxSearch : Cleaned with backup (quarantined).
D:\Old XP Pro\Program Files\Common Files\Real\WeatherBug\MiniBugTransporter.dll -> Adware.Minibug : Cleaned with backup (quarantined).
C:\QooBox\Purity\Program Files\Common Files\CROSOF~1\dexplore.exe -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00137500.VIR -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP420\A0058113.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP425\A0058498.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP425\A0058499.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP430\A0059033.DLL -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP432\A0059078.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP432\A0059079.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP432\A0059080.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP436\A0059215.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP436\A0059216.exe -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP438\A0062632.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00137412.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00137413.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-18\Dc1\system.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP416\A0057983.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP422\A0058191.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP430\A0059024.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP427\A0058793.EXE -> Adware.WebHancer : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP427\A0058795.dll -> Adware.WebHancer : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP414\A0054746.EXE -> Downloader.Small.buy : Cleaned with backup (quarantined).
D:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP409\A0054123.EXE -> Dropper.Delf.xo : Cleaned with backup (quarantined).
D:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP409\A0054124.exe -> Dropper.Delf.xo : Cleaned with backup (quarantined).
D:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP409\A0054128.EXE -> Dropper.Delf.xo : Cleaned with backup (quarantined).
D:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP409\A0054129.exe -> Dropper.Delf.xo : Cleaned with backup (quarantined).
C:\Documents and Settings\Carol\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-44f46a27-2d424837.zip/Gummy.class -> Not-A-Virus.Exploit.ByteVerify : Cleaned with backup (quarantined).
D:\Mark\WinACE WinRAR WinZip WinISO + password & cracker\OS Password Cracker\saminside.zip/SAMInside.exe -> Not-A-Virus.PSWTool.Win32.SAMInside.2540 : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00137675.TXT -> TrackingCookie.Liveperson : Cleaned.
C:\RECYCLER\NPROTECT\00137698.TXT -> TrackingCookie.Popuptraffic : Cleaned.
C:\RECYCLER\NPROTECT\00136413.TXT -> TrackingCookie.Questionmarket : Cleaned.
C:\RECYCLER\NPROTECT\00137666.TXT -> TrackingCookie.Questionmarket : Cleaned.
C:\RECYCLER\NPROTECT\00137638.TXT -> TrackingCookie.Sexcounter : Cleaned.
C:\Documents and Settings\Carol\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-44f46a27-2d424837.zip/Beyond.class -> Trojan.ClassLoader.k : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP425\A0058476.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP425\A0058482.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP425\A0058496.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP430\A0059034.EXE -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP436\A0059137.EXE -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP436\A0059161.EXE -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP436\A0059171.EXE -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP436\A0059208.EXE -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP436\A0059241.EXE -> Trojan.Small : Cleaned with backup (quarantined).
C:\My Downloads\007 spy software crack.zip/007 spy software crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\007 spy software crack.zip/007 spy software crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\3ds max 7 crack.zip/3ds max 7 crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\3ds max 7 crack.zip/3ds max 7 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\3gp converter crack.zip/3gp converter crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\3gp converter crack.zip/3gp converter crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Abakus UIQ3 crack.zip/Abakus UIQ3 crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Abakus UIQ3 crack.zip/Abakus UIQ3 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Adobe Acrobat Pro crack.zip/Adobe Acrobat Pro crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Adobe Acrobat Pro crack.zip/Adobe Acrobat Pro crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\CamStudio crack.zip/CamStudio crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\CamStudio crack.zip/CamStudio crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Cash Cow crack.zip/Cash Cow crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Cash Cow crack.zip/Cash Cow crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\DVD Cloner IV crack.zip/DVD Cloner IV crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\DVD Cloner IV crack.zip/DVD Cloner IV crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\EMPIRE EARTH 2 crack.zip/EMPIRE EARTH 2 crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\EMPIRE EARTH 2 crack.zip/EMPIRE EARTH 2 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\EasyBoot crack.zip/EasyBoot crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\EasyBoot crack.zip/EasyBoot crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\FLASHFXP crack.zip/FLASHFXP crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\FLASHFXP crack.zip/FLASHFXP crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\FinePrint crack.zip/FinePrint crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\FinePrint crack.zip/FinePrint crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Kaspersky Anti-Virus Personal Pro crack.zip/Kaspersky Anti-Virus Personal Pro crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Kaspersky Anti-Virus Personal Pro crack.zip/Kaspersky Anti-Virus Personal Pro crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Macromedia Flash 8 crack.zip/Macromedia Flash 8 crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Macromedia Flash 8 crack.zip/Macromedia Flash 8 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Magic Photo Editor crack.zip/Magic Photo Editor crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Magic Photo Editor crack.zip/Magic Photo Editor crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\MagicLines crack.zip/MagicLines crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\MagicLines crack.zip/MagicLines crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\MagicMatch crack.zip/MagicMatch crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\MagicMatch crack.zip/MagicMatch crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Mpeg crack.zip/Mpeg crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Mpeg crack.zip/Mpeg crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Mystic Inn crack.zip/Mystic Inn crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Mystic Inn crack.zip/Mystic Inn crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Outpost Firewall Pro crack.zip/Outpost Firewall Pro crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Outpost Firewall Pro crack.zip/Outpost Firewall Pro crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Perpetual Disco Screen Saver crack.zip/Perpetual Disco Screen Saver crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Perpetual Disco Screen Saver crack.zip/Perpetual Disco Screen Saver crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Pinball Arcade crack.zip/Pinball Arcade crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Pinball Arcade crack.zip/Pinball Arcade crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Pinnacle Studio Plus Titanium Edition v10.6 crack.zip/Pinnacle Studio Plus Titanium Edition v10.6 crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Pinnacle Studio Plus Titanium Edition v10.6 crack.zip/Pinnacle Studio Plus Titanium Edition v10.6 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Poker Superstars crack.zip/Poker Superstars crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Poker Superstars crack.zip/Poker Superstars crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Quick time crack.zip/Quick time crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Quick time crack.zip/Quick time crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\R-Studio crack.zip/R-Studio crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\R-Studio crack.zip/R-Studio crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Simply Calenders crack.zip/Simply Calenders crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Simply Calenders crack.zip/Simply Calenders crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Sothink SWF Decompiler 3.4 build 60912 crack.zip/Sothink SWF Decompiler 3.4 build 60912 crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Sothink SWF Decompiler 3.4 build 60912 crack.zip/Sothink SWF Decompiler 3.4 build 60912 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\System Mechanic 6.0u crack.zip/System Mechanic 6.0u crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\System Mechanic 6.0u crack.zip/System Mechanic 6.0u crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\System Mechanic 7 Pro crack.zip/System Mechanic 7 Pro crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\System Mechanic 7 Pro crack.zip/System Mechanic 7 Pro crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Universal Shield crack.zip/Universal Shield crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Universal Shield crack.zip/Universal Shield crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Video Edit Magic v4.21 crack.zip/Video Edit Magic v4.21 crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\Video Edit Magic v4.21 crack.zip/Video Edit Magic v4.21 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\VirusRescue crack.zip/VirusRescue crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\VirusRescue crack.zip/VirusRescue crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\WIN ZIP crack.zip/WIN ZIP crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\WIN ZIP crack.zip/WIN ZIP crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\acronis true image crack.zip/acronis true image crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\acronis true image crack.zip/acronis true image crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\adult crack.zip/adult crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\adult crack.zip/adult crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\agnitum crack.zip/agnitum crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\agnitum crack.zip/agnitum crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\anyplace control 3.2 crack.zip/anyplace control 3.2 crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\anyplace control 3.2 crack.zip/anyplace control 3.2 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\autodesk inventor crack.zip/autodesk inventor crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\autodesk inventor crack.zip/autodesk inventor crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\avira crack.zip/avira crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\avira crack.zip/avira crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\betrapped crack.zip/betrapped crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\betrapped crack.zip/betrapped crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\black crack.zip/black crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\black crack.zip/black crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\boris crack.zip/boris crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\boris crack.zip/boris crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\canopus crack.zip/canopus crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\canopus crack.zip/canopus crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\cuteftp 8 crack.zip/cuteftp 8 crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\cuteftp 8 crack.zip/cuteftp 8 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\digitando crack.zip/digitando crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\digitando crack.zip/digitando crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\diskkeeper crack.zip/diskkeeper crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\diskkeeper crack.zip/diskkeeper crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\divx pro 5.2.1 crack.zip/divx pro 5.2.1 crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\divx pro 5.2.1 crack.zip/divx pro 5.2.1 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\dreamweaver 6 crack.zip/dreamweaver 6 crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\dreamweaver 6 crack.zip/dreamweaver 6 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\dvd-cloner crack.zip/dvd-cloner crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\dvd-cloner crack.zip/dvd-cloner crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\eltima crack.zip/eltima crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\eltima crack.zip/eltima crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\far cry crack.zip/far cry crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\far cry crack.zip/far cry crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\garmin crack.zip/garmin crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\garmin crack.zip/garmin crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\holiday lights crack.zip/holiday lights crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\holiday lights crack.zip/holiday lights crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\ice clock 3d crack.zip/ice clock 3d crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\ice clock 3d crack.zip/ice clock 3d crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\icoo crack.zip/icoo crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\icoo crack.zip/icoo crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\illustrator crack.zip/illustrator crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\illustrator crack.zip/illustrator crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\internet download manager 5.05 crack.zip/internet download manager 5.05 crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\internet download manager 5.05 crack.zip/internet download manager 5.05 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\intervideo windvr crack.zip/intervideo windvr crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\intervideo windvr crack.zip/intervideo windvr crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\karu crack.zip/karu crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\karu crack.zip/karu crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\keygen nero 7 crack.zip/keygen nero 7 crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\keygen nero 7 crack.zip/keygen nero 7 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\luxor amun rising crack.zip/luxor amun rising crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\luxor amun rising crack.zip/luxor amun rising crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\magic dvd crack.zip/magic dvd crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\magic dvd crack.zip/magic dvd crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\magix music maker crack.zip/magix music maker crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\magix music maker crack.zip/magix music maker crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\mahjong quest crack.zip/mahjong quest crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\mahjong quest crack.zip/mahjong quest crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\mathcad crack.zip/mathcad crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\mathcad crack.zip/mathcad crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\media center crack.zip/media center crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\media center crack.zip/media center crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\memoriesontv crack.zip/memoriesontv crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\memoriesontv crack.zip/memoriesontv crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\milkshape crack.zip/milkshape crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\milkshape crack.zip/milkshape crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\ms office 2007 crack.zip/ms office 2007 crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\ms office 2007 crack.zip/ms office 2007 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\mystery crack.zip/mystery crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\mystery crack.zip/mystery crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\n-track studio v5.0.2 crack.zip/n-track studio v5.0.2 crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\n-track studio v5.0.2 crack.zip/n-track studio v5.0.2 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\nero 6 crack.zip/nero 6 crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\nero 6 crack.zip/nero 6 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\nero 7 ultra crack.zip/nero 7 ultra crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\nero 7 ultra crack.zip/nero 7 ultra crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\office 2003 small business crack.zip/office 2003 small business crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\office 2003 small business crack.zip/office 2003 small business crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\operation flashpoint crack.zip/operation flashpoint crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\operation flashpoint crack.zip/operation flashpoint crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\partition manager crack.zip/partition manager crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\partition manager crack.zip/partition manager crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\pc cillin crack.zip/pc cillin crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\pc cillin crack.zip/pc cillin crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\pc-cillin 2007 crack.zip/pc-cillin 2007 crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\pc-cillin 2007 crack.zip/pc-cillin 2007 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\power DVD 7.0 crack.zip/power DVD 7.0 crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\power DVD 7.0 crack.zip/power DVD 7.0 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\privacy guardian crack.zip/privacy guardian crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\privacy guardian crack.zip/privacy guardian crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\pro crack.zip/pro crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\pro crack.zip/pro crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\real player crack.zip/real player crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\real player crack.zip/real player crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\red alert crack.zip/red alert crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\red alert crack.zip/red alert crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\route 66 crack.zip/route 66 crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\route 66 crack.zip/route 66 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\setup factory crack.zip/setup factory crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\setup factory crack.zip/setup factory crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\simcity 3000 crack.zip/simcity 3000 crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\simcity 3000 crack.zip/simcity 3000 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\sims 2 pets crack.zip/sims 2 pets crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\sims 2 pets crack.zip/sims 2 pets crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\spin it again crack.zip/spin it again crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\spin it again crack.zip/spin it again crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\super ad blocker crack.zip/super ad blocker crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\super ad blocker crack.zip/super ad blocker crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\swf decompiler crack.zip/swf decompiler crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\swf decompiler crack.zip/swf decompiler crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\switch crack.zip/switch crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\switch crack.zip/switch crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\switch v 1.11 crack.zip/switch v 1.11 crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\switch v 1.11 crack.zip/switch v 1.11 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\system mechanic 7 professional crack.zip/system mechanic 7 professional crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\system mechanic 7 professional crack.zip/system mechanic 7 professional crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\toast crack.zip/toast crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\toast crack.zip/toast crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\tuneup utilities2006 crack.zip/tuneup utilities2006 crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\tuneup utilities2006 crack.zip/tuneup utilities2006 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\uninstall tool crack.zip/uninstall tool crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\uninstall tool crack.zip/uninstall tool crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\viewletcam crack.zip/viewletcam crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\viewletcam crack.zip/viewletcam crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\winrar 361 crack.zip/winrar 361 crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\winrar 361 crack.zip/winrar 361 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\wm recorder 11 crack.zip/wm recorder 11 crack.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\wm recorder 11 crack.zip/wm recorder 11 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054139.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054139.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054140.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054140.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054141.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054141.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054142.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054142.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054143.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054143.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054144.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054144.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054145.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054145.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054146.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054146.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054147.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054147.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054148.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054148.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054149.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054149.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054150.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054150.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054151.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054151.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054152.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054152.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054154.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054154.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054163.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054163.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054164.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054164.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054165.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054165.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054166.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054166.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054167.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054167.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054168.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054168.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054169.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054169.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054170.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054170.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054171.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054171.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054172.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054172.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054173.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054173.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054174.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054174.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054175.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054175.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054176.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054176.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054177.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054177.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054178.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054178.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054179.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054179.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054180.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054180.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054181.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054181.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054182.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054182.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054183.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054183.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054184.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054184.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054185.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054185.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054186.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054186.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054187.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054187.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054188.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054188.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054189.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054189.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054190.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054190.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054191.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054191.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054192.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054192.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054193.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054193.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054194.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054194.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054195.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054195.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054196.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054196.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054197.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054197.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054198.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054198.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054199.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054199.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054200.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054200.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054201.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054201.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054202.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054202.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054203.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054203.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054204.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054204.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054205.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054205.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054206.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054206.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054207.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054207.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054208.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054208.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054209.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054209.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054210.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054210.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054211.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054211.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054212.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054212.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054213.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054213.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054214.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054214.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054215.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054215.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054216.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054216.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054217.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054217.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054218.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054218.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054219.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054219.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054220.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054220.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054221.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054221.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054222.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054222.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054223.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054223.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054224.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054224.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054225.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054225.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054226.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054226.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054227.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054227.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054228.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054228.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054229.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054229.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054231.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054231.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054232.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054232.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054233.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054233.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054234.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054234.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054235.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054235.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054236.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054236.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054237.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054237.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054238.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054238.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054239.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054239.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054240.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054240.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054241.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054241.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054242.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054242.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054243.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054243.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054244.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054244.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054245.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054245.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054246.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054246.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054247.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054247.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054248.EXE/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054248.EXE/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054260.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054260.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
D:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP409\A0054126.exe/td.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
D:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP409\A0054126.exe/zgo.exe -> Worm.Agent.v : Cleaned with backup (quarantined).
C:\My Downloads\007 spy software crack.zip/007 spy software crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\3ds max 7 crack.zip/3ds max 7 crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\3gp converter crack.zip/3gp converter crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\Abakus UIQ3 crack.zip/Abakus UIQ3 crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\Adobe Acrobat Pro crack.zip/Adobe Acrobat Pro crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\CamStudio crack.zip/CamStudio crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\Cash Cow crack.zip/Cash Cow crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\DVD Cloner IV crack.zip/DVD Cloner IV crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\EMPIRE EARTH 2 crack.zip/EMPIRE EARTH 2 crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\EasyBoot crack.zip/EasyBoot crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\FLASHFXP crack.zip/FLASHFXP crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\FinePrint crack.zip/FinePrint crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\Kaspersky Anti-Virus Personal Pro crack.zip/Kaspersky Anti-Virus Personal Pro crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\Macromedia Flash 8 crack.zip/Macromedia Flash 8 crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\Magic Photo Editor crack.zip/Magic Photo Editor crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\MagicLines crack.zip/MagicLines crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\MagicMatch crack.zip/MagicMatch crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\Mpeg crack.zip/Mpeg crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\Mystic Inn crack.zip/Mystic Inn crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\Outpost Firewall Pro crack.zip/Outpost Firewall Pro crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\Perpetual Disco Screen Saver crack.zip/Perpetual Disco Screen Saver crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\Pinball Arcade crack.zip/Pinball Arcade crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\Pinnacle Studio Plus Titanium Edition v10.6 crack.zip/Pinnacle Studio Plus Titanium Edition v10.6 crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\Poker Superstars crack.zip/Poker Superstars crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\Quick time crack.zip/Quick time crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\R-Studio crack.zip/R-Studio crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\Simply Calenders crack.zip/Simply Calenders crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\Sothink SWF Decompiler 3.4 build 60912 crack.zip/Sothink SWF Decompiler 3.4 build 60912 crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\System Mechanic 6.0u crack.zip/System Mechanic 6.0u crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\System Mechanic 7 Pro crack.zip/System Mechanic 7 Pro crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\Universal Shield crack.zip/Universal Shield crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\Video Edit Magic v4.21 crack.zip/Video Edit Magic v4.21 crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\VirusRescue crack.zip/VirusRescue crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\WIN ZIP crack.zip/WIN ZIP crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\acronis true image crack.zip/acronis true image crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\adult crack.zip/adult crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\agnitum crack.zip/agnitum crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\anyplace control 3.2 crack.zip/anyplace control 3.2 crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\autodesk inventor crack.zip/autodesk inventor crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\avira crack.zip/avira crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\betrapped crack.zip/betrapped crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\black crack.zip/black crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\boris crack.zip/boris crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\canopus crack.zip/canopus crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\cuteftp 8 crack.zip/cuteftp 8 crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\digitando crack.zip/digitando crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\diskkeeper crack.zip/diskkeeper crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\divx pro 5.2.1 crack.zip/divx pro 5.2.1 crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\dreamweaver 6 crack.zip/dreamweaver 6 crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\dvd-cloner crack.zip/dvd-cloner crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\eltima crack.zip/eltima crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\far cry crack.zip/far cry crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\garmin crack.zip/garmin crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\holiday lights crack.zip/holiday lights crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\ice clock 3d crack.zip/ice clock 3d crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\icoo crack.zip/icoo crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\illustrator crack.zip/illustrator crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\internet download manager 5.05 crack.zip/internet download manager 5.05 crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\intervideo windvr crack.zip/intervideo windvr crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\karu crack.zip/karu crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\keygen nero 7 crack.zip/keygen nero 7 crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\luxor amun rising crack.zip/luxor amun rising crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\magic dvd crack.zip/magic dvd crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\magix music maker crack.zip/magix music maker crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\mahjong quest crack.zip/mahjong quest crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\mathcad crack.zip/mathcad crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\media center crack.zip/media center crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\memoriesontv crack.zip/memoriesontv crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\milkshape crack.zip/milkshape crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\ms office 2007 crack.zip/ms office 2007 crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\mystery crack.zip/mystery crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\n-track studio v5.0.2 crack.zip/n-track studio v5.0.2 crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\nero 6 crack.zip/nero 6 crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\nero 7 ultra crack.zip/nero 7 ultra crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\office 2003 small business crack.zip/office 2003 small business crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\operation flashpoint crack.zip/operation flashpoint crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\partition manager crack.zip/partition manager crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\pc cillin crack.zip/pc cillin crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\pc-cillin 2007 crack.zip/pc-cillin 2007 crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\power DVD 7.0 crack.zip/power DVD 7.0 crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\privacy guardian crack.zip/privacy guardian crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\pro crack.zip/pro crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\real player crack.zip/real player crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\red alert crack.zip/red alert crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\route 66 crack.zip/route 66 crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\setup factory crack.zip/setup factory crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\simcity 3000 crack.zip/simcity 3000 crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\sims 2 pets crack.zip/sims 2 pets crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\spin it again crack.zip/spin it again crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\super ad blocker crack.zip/super ad blocker crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\swf decompiler crack.zip/swf decompiler crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\switch crack.zip/switch crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\switch v 1.11 crack.zip/switch v 1.11 crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\system mechanic 7 professional crack.zip/system mechanic 7 professional crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\toast crack.zip/toast crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\tuneup utilities2006 crack.zip/tuneup utilities2006 crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\uninstall tool crack.zip/uninstall tool crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\viewletcam crack.zip/viewletcam crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\winrar 361 crack.zip/winrar 361 crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\My Downloads\wm recorder 11 crack.zip/wm recorder 11 crack.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054139.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054140.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054141.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054142.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054143.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054144.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054145.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054146.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054147.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054148.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054149.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054150.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054151.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054152.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054154.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054163.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054164.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054165.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054166.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054167.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054168.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054169.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054170.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054171.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054172.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054173.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054174.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054175.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054176.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054177.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054178.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054179.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054180.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054181.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054182.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054183.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054184.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054185.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054186.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054187.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054188.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054189.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054190.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054191.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054192.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054193.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054194.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054195.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054196.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054197.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054198.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054199.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054200.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054201.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054202.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054203.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054204.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054205.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054206.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054207.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054208.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054209.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054210.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054211.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054212.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054213.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054214.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054215.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054216.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054217.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054218.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054219.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054220.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054221.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054222.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054223.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054224.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054225.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054226.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054227.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054228.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054229.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054231.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054232.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054233.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054234.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054235.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054236.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054237.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054238.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054239.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054240.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054241.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054242.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054243.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054244.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054245.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054246.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054247.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054248.EXE/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP410\A0054260.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).
D:\System Volume Information\_restore{E4A9ACFA-9670-42BC-BFBC-91FDA2DD59C9}\RP409\A0054126.exe/run.exe -> Worm.VB.njc : Cleaned with backup (quarantined).


::Report end
 

·
Registered
Joined
·
21 Posts
Discussion Starter · #5 ·
(Part 3 of 3):


Incident Status Location

Adware:adware/ncase Not disinfected Windows Registry
Adware:adware/cws Not disinfected Windows Registry
Potentially unwanted tool:application/mywebsearch Not disinfected HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Carol\Desktop\SDFix.zip[SDFix.exe][SDFix\apps\Process.exe]
Adware:Adware/Maxifiles Not disinfected C:\RECYCLER\NPROTECT\00137411.EXE
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\RECYCLER\NPROTECT\00137526.exe
Spyware:Cookie/Ccbill Not disinfected C:\RECYCLER\NPROTECT\00137633.TXT
Spyware:Cookie/MediaTickets Not disinfected C:\RECYCLER\NPROTECT\00137650.TXT
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137915.ZIP[007 spy software crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137916.ZIP[3ds max 7 crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137917.ZIP[3gp converter crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137918.ZIP[Abakus UIQ3 crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137919.ZIP[Adobe Acrobat Pro crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137920.ZIP[CamStudio crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137921.ZIP[Cash Cow crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137922.ZIP[DVD Cloner IV crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137923.ZIP[EMPIRE EARTH 2 crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137924.ZIP[EasyBoot crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137925.ZIP[FLASHFXP crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137926.ZIP[FinePrint crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137927.ZIP[Kaspersky Anti-Virus Personal Pro crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137928.ZIP[Macromedia Flash 8 crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137929.ZIP[Magic Photo Editor crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137930.ZIP[MagicLines crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137931.ZIP[MagicMatch crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137932.ZIP[Mpeg crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137933.ZIP[Mystic Inn crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137934.ZIP[Outpost Firewall Pro crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137935.ZIP[Perpetual Disco Screen Saver crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137936.ZIP[Pinball Arcade crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137937.ZIP[Pinnacle Studio Plus Titanium Edition v10.6 crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137938.ZIP[Poker Superstars crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137939.ZIP[Quick time crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137940.ZIP[R-Studio crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137941.ZIP[Simply Calenders crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137942.ZIP[Sothink SWF Decompiler 3.4 build 60912 crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137943.ZIP[System Mechanic 6.0u crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137944.ZIP[System Mechanic 7 Pro crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137945.ZIP[Universal Shield crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137946.ZIP[Video Edit Magic v4.21 crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137947.ZIP[VirusRescue crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137948.ZIP[WIN ZIP crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137949.ZIP[acronis true image crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137950.ZIP[adult crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137951.ZIP[agnitum crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137952.ZIP[anyplace control 3.2 crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137953.ZIP[autodesk inventor crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137954.ZIP[avira crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137955.ZIP[betrapped crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137956.ZIP[black crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137957.ZIP[boris crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137958.ZIP[canopus crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137959.ZIP[cuteftp 8 crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137960.ZIP[digitando crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137961.ZIP[diskkeeper crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137962.ZIP[divx pro 5.2.1 crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137963.ZIP[dreamweaver 6 crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137964.ZIP[dvd-cloner crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137965.ZIP[eltima crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137966.ZIP[far cry crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137967.ZIP[garmin crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137968.ZIP[holiday lights crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137969.ZIP[ice clock 3d crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137970.ZIP[icoo crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137971.ZIP[illustrator crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137972.ZIP[internet download manager 5.05 crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137973.ZIP[intervideo windvr crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137974.ZIP[karu crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137975.ZIP[keygen nero 7 crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137976.ZIP[luxor amun rising crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137977.ZIP[magic dvd crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137978.ZIP[magix music maker crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137979.ZIP[mahjong quest crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137980.ZIP[mathcad crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137981.ZIP[media center crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137982.ZIP[memoriesontv crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137983.ZIP[milkshape crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137984.ZIP[ms office 2007 crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137985.ZIP[mystery crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137986.ZIP[n-track studio v5.0.2 crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137987.ZIP[nero 6 crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137988.ZIP[nero 7 ultra crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137989.ZIP[office 2003 small business crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137990.ZIP[operation flashpoint crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137991.ZIP[partition manager crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137992.ZIP[pc cillin crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137993.ZIP[pc-cillin 2007 crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137994.ZIP[power DVD 7.0 crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137995.ZIP[privacy guardian crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137996.ZIP[pro crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137997.ZIP[real player crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137998.ZIP[red alert crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00137999.ZIP[route 66 crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00138000.ZIP[setup factory crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00138001.ZIP[simcity 3000 crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00138002.ZIP[sims 2 pets crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00138003.ZIP[spin it again crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00138004.ZIP[super ad blocker crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00138005.ZIP[swf decompiler crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00138006.ZIP[switch crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00138007.ZIP[switch v 1.11 crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00138008.ZIP[system mechanic 7 professional crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00138009.ZIP[toast crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00138010.ZIP[tuneup utilities2006 crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00138011.ZIP[uninstall tool crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00138012.ZIP[viewletcam crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00138013.ZIP[winrar 361 crack.exe]
Virus:W32/SimpleP2P.A.worm Disinfected C:\RECYCLER\NPROTECT\00138014.ZIP[wm recorder 11 crack.exe]
Adware:Adware/PurityScan Not disinfected C:\RECYCLER\NPROTECT\00138015.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\SDFix\apps\Process.exe
Spyware:Cookie/Ccbill Not disinfected D:\Old XP Pro\Documents and Settings\Jim\Cookies\[email protected][1].txt
Spyware:Cookie/Target Not disinfected D:\Old XP Pro\Documents and Settings\Jim\Cookies\[email protected][1].txt
------------------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 12:06:39 AM, on 1/24/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Lexmark 5200 series\lxbtbmon.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\HJT\Hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark 5200 series] "C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe"
O4 - HKLM\..\Run: [LXBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll,[email protected]
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID {DA9935BA-22F7-44ee-BD12-BD8B87700BEA}
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: MANSION - {CD03D14B-0EF6-4f5a-BB81-1ECAFFC676AF} - C:\Program Files\MANSION\Villa\MANSION.exe
O9 - Extra 'Tools' menuitem: MANSION - {CD03D14B-0EF6-4f5a-BB81-1ECAFFC676AF} - C:\Program Files\MANSION\Villa\MANSION.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9602.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/luxr/default/mjolauncher.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://download.games.yahoo.com/games/web_games/popcap/bejeweled2/popcaploader_v6.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: lxbt_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbtcoms.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
 

·
Registered
Joined
·
2,335 Posts
AVG is showing a lot of infected cracks on your system. These are extremely dangerous because they can download a multitude of
infections. ComboFix deleted the Purity/Clickspring files. There is a little bit of work left


----------------------------------------

REGISTRY FIX

Download the attached pegasus.zip file at the bottom of this post to your desktop. Double click on the zip folder,
then double click on the .reg file within.
Click yes to allow it to merge into your registry.

----------------------------------------

Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

C:\{80010297-0000-0000-4566-0CAD770FD4A9}


If the file resists deletion, booot into safe mode and delete

----------------------------------------

Clean Outs


Clear IE's Cookies and Cache

  • Close all instances of Outlook Express and Internet Explorer.
  • Go to Control Panel » Internet Options » General tab.
  • Click the Delete Cookies.
  • Next to it, Click the Delete Files button.
  • When prompted, place a check in: Delete all offline content, click OK.



Clean Temporary Files

  • Go to Start » Run » type: cleanmgr » OK.
  • Choose (C:) and then click OK.
  • Make sure these are the only ones that are checked :
    • Temporary Internet Files
    • Temporary Files
    • Recycle Bin
  • Click OK to remove them.
  • Click Yes to confirm the deletion.


CLEAR AVG A/S QUARANTINE

  • Launch AVG A/S
  • Click on Show Quarantine
  • Click on Select All
  • Click on Remove Finally
  • Close AVG A/S



EMPTY NORTON PROTECTED RECYCLE BIN

Please visit Norton Protected Recycle Bin and follow the instructions.



Clean-out and Reset System Restore

This will clean out any junk or malicious files left behind in System Restore

  • To turn off System Restore click Start > Right Click My Computer > Properties.
  • Click the System Restore tab and Check
  • "Turn off System Restore" or "Turn off System Restore on all drives" Click Apply.
  • When turning off System Restore, the existing restore points will be deleted. Click Yes to do this then Click OK.

  • Turn on System Restore by Clicking Start. Right-click My Computer, and then click Properties.
  • Click the System Restore tab. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives."
  • Click Apply, and then OK.

This will create a new Restore Point.

----------------------------------------

ON-LINE SCANS

Kaspersky - Extended

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.

  • The program will then begin downloading the latest definition files.
  • Once the files have been downloaded click on NEXT
  • Locate the Scan Settings button & configure to:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:
      • Scan Archives
        [*]Scan Mail Bases
  • Click OK & have it scan My Computer
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect.
    We only require a report from it.
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan


----------------------------------------

FOLLOW-UP

Please return and post these items in the order listed:

Kaspersky scan
 

Attachments

·
Registered
Joined
·
2,335 Posts
I got the Kaspersky scan. That can be fixed in two easy steps


Clean Outs


Empty Outlook Express mailbox folders for all users. You have infected items from 2004/2005 showing.



REMOVING FILES FROM NORTON ANTIVIRUS QUARANTINE

Please visit Norton Quarantine and follow the instructions.


----------------------------------------


Your logs are now clean. Please complete the next "housekeeping" steps and read through the information below.


----------------------------------------

Windows XP - Reset Hidden Files


  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View tab.
  • Deselect the Show hidden files and folders option.
  • Select the Hide file extensions for known types option.
  • Select the Hide protected operating system files option.
  • Click Yes to confirm.
  • Click OK.

----------------------------------------

Clean-out and Reset System Restore

This will clean out any junk or malicious files left behind in System Restore

  • To turn off System Restore click Start > Right Click My Computer > Properties.
  • Click the System Restore tab and Check
  • "Turn off System Restore" or "Turn off System Restore on all drives" Click Apply.
  • When turning off System Restore, the existing restore points will be deleted. Click Yes to do this then Click OK.

  • Turn on System Restore by Clicking Start. Right-click My Computer, and then click Properties.
  • Click the System Restore tab. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives."
  • Click Apply, and then OK.

This will create a new Restore Point.

----------------------------------------

RE-ENABLE ANTI-SPYWARE APPLICATIONS

If you were instructed to dis-able Anti-spyware applications during this fix, you may re-enable them

----------------------------------------

Please read through the following information to help protect your computer in the future.


KEEP YOUR OPERATING SYSTEM UPDATED

Please ensure that you have already patched your system against the recent WMF exploit. Go to this page to get the KB912919 patch

MICROSOFT UPDATES

It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser
up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft
and download all the critical updates to help prevent possible re-infection.


ENABLE WINDOWS AUTO UPDATE

Go to Start>Run - type wuaucpl.cpl
tick on the checkbox - "Keep my computer up to date"
Under settings, choose "Automatically download the updates, and install them on the schedule that I specify".
Click on "OK".


ENABLE WINDOWS AUTO UPDATE

From within Internet Explorer click on the Tools menu and then click on Internet Options.
  • Select the Security tab
    • Click once on the Internet icon so it becomes highlighted.
    • Select Custom Level .
      • Change 'Download signed ActiveX controls' to Prompt
      • Change 'Download unsigned ActiveX controls' to Disable
      • Change 'Initialize and script ActiveX controls not marked as safe' to Disable
      • Change 'Installation of desktop items' to Prompt
      • Change 'Launching programs and files in an IFRAME' to Prompt
      • Change 'Navigate sub-frames across different domains' to Prompt
      • When all these changes have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Select OK to exit the Internet Properties page.



TOOLS TO HELP KEEP YOUR SYSTEM CLEAN

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:

SpywareBlaster to help prevent spyware from installing in the first place.
  • Install & update SpywareBlaster with the latest definitions.
  • After you have updated, click the button - enable protection for all unprotected items


SpywareGuard to catch and block spyware before it can execute.


SPYBOT - SEARCH & DESTROY Download and install Spybot - Search & Destroy with its
TeaTimer option.
This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with
the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here


AD-AWARE Download and install Ad-Aware. You should use this program to scan
your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product
can be found here


IE-SPYAD IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • Download IE-SpyAD - Extract the contents to a new folder
  • From within the folder, double-click install.bat
  • Select Option #2 - Install the new IE-SPYAD list.
  • Then return to the main menu.
  • Select option #4 - Add the old porn sites domain

A tutorial for IE-SPYAD can be found here


MVPS HOST FILE The MVPS Hosts file replaces your current HOSTS file
with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to
those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.

  • Download Host.zip to your desktop.
  • From your Desktop right-click (hosts.zip) and select:
    Extract All from the menu.
  • Click Next, click Next, select the option:
    "Show Extracted files"
  • Click Finish

This will open the newly created hosts folder on your Desktop.

Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated
HOSTS file to the correct location on your machine.


MCAFEE SITE ADVISOR SITE ADVISOR is a free IE plug-in (also suport for Firefox browser)
which is used in conjunction with the Google search engine. It advises which web sites are considered safe and which sites could pose a problem.
It also shows what problems were encountered with each site, such as malicious downloads, spam, and related links.


ANTI-VIRUS AND FIREWALL PROGRAMS


ANTIVIRUS SOFTWARE It is very important that you have anti-virus software running on your machine.
This alone can save you a lot of trouble with malware in the future.
See this link for a listing of some online antivirus scanners: Anti-Spyware Tutorial

Here are some very good free Antivirus products which are available:




If you do not have a firewall, here are 4 free ones available for personal use:

Understanding and Using Firewalls



INFORMATIONAL READING


In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles:




Please respond one more time and let me know you received this post so it can be marked resolved



If you feel that we have helped you, please help us keep this site free for all. Please visit our DONATION PAGE.
 

·
Registered
Joined
·
21 Posts
Discussion Starter · #9 ·
The first section:

Empty Outlook Express mailbox folders for all users. You have infected items from 2004/2005 showing.

I don't know if I can have both the users DELETE ALL their email!!
 

·
Registered
Joined
·
2,335 Posts
That is a tall order but it's better to be safe. If you can delete this, you should be ok:

C:\Documents and Settings\Carol\Local Settings\Application Data\Identities\{48195716-A778-4D3D-8554-7CB1E93452FB}\Microsoft\Outlook Express\Sent Items.dbx/[From "Carol Rahaim" <[email protected]>]

Dates: 4 Dec 2004 and 15 Feb 2005
 

·
Registered
Joined
·
21 Posts
Discussion Starter · #11 ·
All done! Everything seems to be fine, I'll install your recommended software.
Thank you very much for your time and effort, again THANKS!!!
 
1 - 12 of 12 Posts
Status
Not open for further replies.
Top